PRIVACY POLICY

We collect several types of information to provide and improve our Service:

Account Information: When you create an account, we collect your name, email address, and display name, and your profile photo if you add one. If you sign in through a third-party provider (Apple, Google, or Microsoft), we receive your basic profile information, such as your name and email address, from that provider.

User-Generated Content: This includes prayer journal entries, notes, saved word studies, discussion posts, prayer wall requests, photos you upload (such as church photos), messages you send through our contact form, and any other content you voluntarily submit through the Service.

Partner Listings and Church Claims: If you submit a business listing through Partners, we collect the details you enter, which can include a contact name, email address, phone number, website, physical address, and a business card or logo image. Approved listings are shown to other users. If you claim a church listing, we collect your role, the contact email and phone number you provide, and any message you include.

AI Feature Data: When you use an AI-powered feature, such as an original-language word lookup, the Bible word and verse you selected are sent to our AI provider to generate a response. Text you submit to the prayer wall, discussions, or testimonials is checked by an automated moderation service before it is posted. See Section 3 for details.

Usage Data: We automatically collect information about how you interact with the Service, including pages visited (the full page address, which includes words you enter in Bible search), features used, reading progress, the days you open the app (used for your streak), device type, browser type, operating system, referring page, IP address, and approximate location derived from your IP address (country, region, city, approximate latitude and longitude, and time zone). When you are signed in, these records are linked to your account.

Device Location (Find a Church): If you allow location access, Find a Church uses your device's location to show churches near you. Your location is sent to our database provider (Supabase) as the center of a search area so that nearby churches can be returned. We do not save it to your account or profile, but, like other requests, it can appear in our database provider's request logs, which are kept for a limited time. If you search by city or ZIP code instead, the text you enter is sent through our server to OpenStreetMap's Nominatim service to find that place. You can turn off location access at any time in your device or browser settings.

Crash and Error Reports: If the Service encounters an error, we automatically record the error message and technical details, the page address, your device's user agent (browser and operating system), the app version, and, if you are signed in, your account ID. We use these reports to find and fix problems.

Push Notification Tokens: If you enable push notifications (such as daily verse or prayer reminders), we store the notification token generated by your device, along with its platform type, so we can deliver those notifications to you. You can disable push notifications at any time in your device or browser settings.

Payment Information: If you subscribe to our Premium service on our website, our payment processor (iPOSpays, by Dejavoo) collects your payment card details on its own payment page. We do not store your full payment card number on our servers. We receive and store transaction confirmations, subscription status, the card type, the last four digits of your card, and a payment token from the processor that is used to process renewals.

Cookies and Similar Technologies: We use essential cookies to maintain your session and preferences. On our website, we may also use analytics cookies and third-party measurement tags (such as Google Analytics, Google Tag Manager, and the Meta Pixel) to understand how the Service is used and to measure the effectiveness of our outreach. These third-party tags do not run inside the ScriptureMate iOS and Android apps or on Kids Corner pages. You can control cookie preferences through your browser settings, but disabling essential cookies may affect Service functionality.

We use the information we collect for the following purposes:

• Provide, operate, and maintain the Service
• Create and manage your account
• Process subscriptions and payments
• Process and respond to your inquiries and requests
• Personalize your experience (such as reading progress and preferences)
• Power AI features by processing your inputs to generate relevant responses
• Send you administrative communications (account verification, security alerts)
• Send you emails you choose to receive, such as the daily verse email, which has an unsubscribe link in each message, and trivia contest emails when you enter a contest
• Send you occasional announcements and updates about the Service
• Improve the Service through usage analytics and performance monitoring
• Protect against fraudulent, unauthorized, or illegal activity
• Comply with legal obligations and enforce our Terms of Service

We process your data on the following legal bases: your consent, performance of our contract with you (the Terms of Service), our legitimate interests in operating and improving the Service, and compliance with legal obligations.

ScriptureMate includes AI-powered features, such as original-language word lookups, and uses automated AI moderation for community posts. When these features are used:

• Word lookups send only the Bible word, verse reference, and verse text you selected to our AI provider (Anthropic) to generate a response. Your name, email address, and account ID are not included
• Text you submit to the prayer wall, discussions, or testimonials is sent to OpenAI's moderation service, which checks it for harmful content (such as threats, harassment, or self-harm) before it is posted
• Under their API terms, these providers do not use this data to train their AI models
• A word lookup is saved to your account only if you choose to save it as a word study
• We may store minimal metadata (such as timestamps and feature usage counts) for analytics and Service improvement
• AI-generated content is for informational and spiritual enrichment purposes only and is not a substitute for professional advice

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Supabase: We use Supabase for database hosting, authentication, file storage, and backend services. Your data is stored on Supabase's infrastructure with encryption at rest and in transit. Supabase's request logs, which are kept for a limited time, record technical details of each request, including your IP address, the address requested, and your account ID when you are signed in.
• Vercel: Vercel hosts our website and the pages shown in our apps. It processes every request, including your IP address and device and browser details, and provides the approximate location (country, region, city, approximate latitude and longitude, and time zone) derived from your IP address that we store with page-view records.
• Payment Processing (iPOSpays, by Dejavoo): Our payment processor handles subscription billing and payment card processing for purchases made on our website. It receives your payment card details and your account email address, and returns to us the transaction result, card type, last four digits, and a payment token. They operate under their own privacy policy and PCI-DSS compliance standards.
• OpenAI: Automated moderation of text you submit to the prayer wall, discussions, and testimonials, to screen out harmful content before it is posted. We also use OpenAI to generate images for our own content; no personal information is sent for that.
• Anthropic: Generates original-language word explanations (it receives only the Bible word and verse you selected) and helps our team draft content such as lessons and trivia. No personal information is sent to Anthropic.
• fal.ai: Generates spoken audio, including HD voice narration of Bible passages and lessons and audio for our own content. It receives only the text being read, not your personal information.
• Resend: Delivers the emails we send you, such as account, receipt, and daily verse emails. It receives your email address, your name if it appears in the message, and the content of the email.
• Google Firebase Cloud Messaging: Delivers push notifications if you turn them on. It receives your device's notification token and the content of each notification.
• Sign-In Providers (Apple, Google, Microsoft): If you choose to sign in with one of these providers, it confirms your identity and shares your basic profile information, such as your name and email address, with us. Its handling of your data is governed by its own privacy policy.
• OpenStreetMap: Find a Church map images are loaded by your device directly from OpenStreetMap's servers, which receive your IP address and the map area being shown. When you search by city or ZIP code, the text you enter is sent from our server to OpenStreetMap's Nominatim service to locate it.
• Analytics and Measurement: On our website, we may use analytics services (such as Google Analytics, with IP anonymization, and Google Tag Manager) and measurement tags (such as the Meta Pixel) that collect usage data to understand how users interact with the Service, improve performance, and measure the effectiveness of our outreach. These tags do not run inside the ScriptureMate iOS and Android apps or on Kids Corner pages.
• Community Features: Content you post in public areas (discussion posts and prayer wall requests) is visible to other users. Prayer wall requests are always anonymous and do not display your identity. Please be mindful of the information you share publicly.
• Legal Requirements: We may disclose information if required by law, court order, governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of the transaction. We will notify you of any such change.

The service providers listed above that receive your data are required to protect it with the same or equal protection as described in this Privacy Policy.

We implement appropriate technical and organizational measures to protect your personal information, including:

• All data is transmitted over encrypted connections (HTTPS/TLS)
• Data stored with Supabase is encrypted at rest and in transit
• Database access is restricted through role-based access controls and monitored
• Authentication tokens are securely managed and rotated
• Regular security reviews and updates are performed

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account Data: Your profile, notes, prayer journal entries, favorites, reading history, and other personal content are retained for the lifetime of your account. Upon account deletion (via the “Delete my account” button in the “Danger Zone” section of your Profile page), this personal content is permanently deleted within 30 days.
• Deletion Archive: For legal and compliance reasons — including subpoena response, tax recordkeeping, and statute-of-limitations windows for civil claims — we retain a minimal record of deleted accounts in a secured archive for up to 7 years. This archive contains only the account email, display name, account dates, and payment history. It is inaccessible to other users and accessed only in response to valid legal process. If you are an EU resident and wish to invoke your GDPR Right to Erasure (Article 17) for a full deletion including the archive, email support@scripturemate.com.
• User Content: Public posts in discussions or the prayer wall are removed from the community feed when your account is deleted.
• Usage Data: Page-view records, which include your IP address, approximate location, device details, the pages you visit, and your account ID when you are signed in, are retained for up to 24 months for analytics and security purposes.
• Crash and Error Reports: Deleted automatically after 90 days.
• Payment Records: Retained as required by applicable tax and financial regulations (typically 7 years in the United States).
• AI Requests: Word lookups are not stored by us unless you save them as a word study, which stays with your account until you delete it or your account.

We may retain certain information as required by law or for legitimate business purposes, such as resolving disputes, enforcing agreements, and complying with legal obligations.

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal information we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable format
• Right to Restrict Processing: Request that we limit our processing of your personal data
• Right to Object: Object to the processing of your personal data for certain purposes
• Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time
• Right to Opt Out of Sale (CCPA): We do not sell your personal information. However, you have the right to make this request and we will confirm our practices

To exercise any of these rights, please contact us at support@scripturemate.com. We will respond to your request within 30 days (or as required by applicable law). We will not discriminate against you for exercising any of these rights.

ScriptureMate is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

Our Kids Corner feature is designed to be used under direct parental supervision. Parents or guardians are responsible for monitoring their children's use of this feature. Kids Corner does not collect any additional personal information beyond what is associated with the parent's account.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at support@scripturemate.com. We will take steps to delete such information promptly.

ScriptureMate includes community features such as the prayer wall and discussion forums. Please be aware of the following:

• Public prayer requests and discussion posts are visible to other users of the Service
• Prayer wall requests are always posted anonymously, and your identity is not displayed with them
• Even when posting anonymously, we retain the association in our database for moderation and account management purposes
• We encourage you to exercise discretion when sharing personal or sensitive information in public community features
• We are not responsible for how other users may use information you share publicly

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the new policy on this page with an updated "Last updated" date
• Sending you an email notification for significant changes (if you have an account)
• Displaying a prominent notice within the Service

Your continued use of the Service after any changes constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.