Privacy Policy

Last Updated: February 26, 2026

Introduction

Welcome to Kairos Chat. Kairos Chat is operated by Stichting 222 Ministry, a registered non-profit Christian foundation in The Netherlands and part of the Transform Iran ministry.

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services. We are committed to protecting your privacy while providing meaningful spiritual support.

Key Points:

  • We process religious data as part of our core ministry (covered by GDPR religious organization exception)
  • You have full control over what we remember through our “Disable Memory” feature
  • We only share your data in life-threatening emergencies or when required by law
  • You can view, export, or delete your data anytime

1. Who We Are

Data Controller:

Stichting 222 Ministry

KvK: 39082906 | RSIN: 816373711

Palmpolstraat 43, 1327CB, Almere, The Netherlands

Note: Kairos Chat is part of the broader Transform Iran ministry. Stichting 222 Ministry is our European foundation and bears all legal responsibility for this service under Dutch law and GDPR.

Contact Us:

  • Email: [email protected]
  • Website: https://kairoschat.ai
  • Response Time: We respond to privacy inquiries within 48 hours

Data Protection Officer:

Given our scale as a non-profit ministry, we have assessed that a formal DPO is not mandated in our case under Article 37 GDPR. However, all privacy inquiries receive the same level of attention and are handled by our designated privacy contact at [email protected].

Our Mission:

Provide personalized Christian spiritual guidance and faith development support through AI-powered conversation.

Legal Structure:

Registered non-profit foundation (Stichting) with ANBI status (Algemeen Nut Beogende Instelling — recognized public benefit organization by the Dutch Belastingdienst) and a Christian religious mission

2. What Information We Collect

2.1 Information You Provide Directly

When you create an account:

  • Email address
  • Password (securely hashed; never stored in plain text)
  • Preferred language

When you sign in with Google:

  • Your Google account email address
  • Your Google account identifier (subject ID)
  • We do NOT receive your Google profile photo, contacts, calendar, or any other Google data
  • Google’s Privacy Policy governs how Google handles your sign-in: https://policies.google.com/privacy

During conversations:

  • Your messages and questions
  • Information you choose to share about yourself
  • Prayer requests
  • Faith-related questions

In settings:

  • Preferences (memorize conversations, language, theme)
  • Consent choices (emotional wellbeing support, analytics)
  • Notification preferences

2.2 Information We Extract from Conversations

When “Memorize Conversations” is enabled, we may extract and store:

A) Religious & Spiritual Information

  • Your faith background and denomination
  • Religious beliefs and practices
  • Spiritual questions and journey
  • Prayer requests and needs
  • Church involvement
  • Relationship with God
  • Biblical interpretation preferences
  • Theological interests

Legal Basis: Religious organization exception (GDPR Article 9.2(d))

As a Christian ministry, processing religious information is necessary for our core purpose: providing personalized spiritual guidance. You voluntarily seek our religious services, and this processing helps us support your faith journey effectively.

B) Basic Personal Information

  • Your name and how you prefer to be addressed
  • General life context (e.g., “parent,” “teacher,” “student”)
  • Location (general – city or country level)
  • Interests and topics you discuss
  • Communication preferences

Legal Basis: Legitimate interest (GDPR Article 6.1(f))

We process this information to improve your experience and avoid asking repetitive questions. You benefit directly from this personalization, and you can easily opt-out.

C) Emotional & Mental Health Information (With Your Consent)

ONLY if you enable “Emotional Wellbeing Support”:

  • Emotional patterns and mood
  • Mental health challenges (anxiety, depression, stress)
  • Coping strategies
  • Therapy or counseling discussions
  • Support needs and progress

Legal Basis: Your explicit consent (GDPR Article 9.2(a))

This feature is OFF by default. We will never track detailed mental health information without your explicit permission.

Important Note: This is separate from prayer ministry. If you mention feeling sad and request prayer, that’s spiritual support (covered by our ministry exception). Detailed mental health tracking requires your consent.

D) Critical Safety Information (Always Processed)

We automatically detect life-threatening situations:

  • Suicide risk or self-harm indicators
  • Severe emotional crisis
  • Persecution or immediate danger
  • Emergency situations

Legal Basis: Vital interests (GDPR Article 6.1(d) and 9.2(c))

GDPR explicitly allows processing to protect human life, even without consent. In emergencies, protecting your safety is our priority.

Automated Detection Notice (Article 22 GDPR):

This detection is performed automatically without human review of each individual message. When risk indicators are detected above a confidence threshold, our system may automatically:

  • Provide crisis resources within the app
  • Flag the session for review by our safety team
  • In confirmed imminent risk situations: share information with emergency services

You have the right to request human review of any automated assessment that significantly affects you. Contact [email protected]. See also §6.9 for your full rights regarding automated processing.

2.3 Technical Information

Automatically collected:

  • Device model and manufacturer
  • Operating system name and version
  • App version and build number
  • IP address (for security and rate limiting; retained on our servers only)
  • Session duration and timestamps
  • Error logs (for debugging)

Persistent device identifier:

A randomly generated unique identifier is stored on your device at first launch.

  • Purpose: Link anonymous sessions to a single device; detect reinstalls; maintain session continuity
  • This identifier is NOT linked to your identity unless you create an account
  • On account creation, your prior anonymous session history may be linked to your account
  • You can reset this by clearing app data or reinstalling the app

Push notification token:

When you grant permission to receive notifications, your device registers a push notification token with our push notification provider (Google Firebase Cloud Messaging).

  • Purpose: Route notifications to your specific device
  • This token is device-specific and does not identify you personally unless linked to your account
  • It is shared only with our push notification provider for the purpose of delivery
  • You can withdraw consent at any time via your device notification settings (iOS: Settings → Notifications → Kairos Chat; Android: Settings → Apps → Kairos Chat → Notifications)

Clipboard access:

The mobile app may read your clipboard once when you open the email verification screen, to auto-fill a verification code you have copied. We do not read clipboard contents at any other time or for any other purpose.

Analytics consent (consent_analytics):

The app stores a separate analytics consent flag. When enabled, this allows aggregate (non-personal) usage data to be collected to help us understand how the service is used and improve it. This is OFF by default. See §2.4 for details.

2.4 Cookies and Web Tracking

The mobile app does not use tracking cookies. The following applies to the web platform only.

Cookie / Storage Type Purpose Duration
Language preference Functional Remember your language setting Session
Theme preference (kairos-theme) Functional Remember light/dark mode Persistent (localStorage)
_ga, _ga_* Analytics (Google Analytics 4) Aggregate usage statistics Up to 2 years

Google Analytics 4 (Web only):

We may use Google Analytics 4 on the web platform to understand aggregate usage patterns (e.g., which pages are visited most). This is provided by Google LLC and may set cookies on your browser.

  • Google’s Privacy Policy: https://policies.google.com/privacy
  • Opt-out: Install the Google Analytics Opt-out browser add-on at https://tools.google.com/dlpage/gaoptout
  • You will be asked for consent before analytics cookies are placed.

Legal Basis: Your consent (Article 6.1(a)) for analytics cookies. Functional cookies are based on legitimate interest (Article 6.1(f)) as they are strictly necessary for the service to work as you expect.

We do NOT use advertising cookies, tracking pixels, or behavioral profiling cookies.

3. How We Use Your Information

3.1 To Provide Our Service

Essential uses (necessary for service delivery):

  • Generate AI responses to your questions
  • Maintain conversation context during sessions
  • Authenticate your account
  • Deliver notifications
  • Provide spiritual guidance and support

Legal Basis: Contract performance (Article 6.1(b))

3.2 To Personalize Your Experience

When “Memorize Conversations” is enabled:

  • Remember your faith journey and provide relevant guidance
  • Avoid asking repetitive questions
  • Tailor Scripture recommendations to your tradition
  • Provide contextual spiritual support
  • Remember prayer requests to follow up

Legal Basis:

  • Religious data: Religious organization exception (9.2(d))
  • Basic data: Legitimate interest (6.1(f))
  • Health data: Your consent (9.2(a), if enabled)

3.3 To Protect Your Safety

Critical alert processing:

  • Detect suicide risk or self-harm
  • Identify severe emotional crisis
  • Recognize persecution or danger
  • Provide immediate crisis resources
  • Alert our support team in emergencies
  • Share with emergency services when necessary

Legal Basis: Vital interests (6.1(d) and 9.2(c))

3.4 To Send You Notifications

Transactional notifications (legitimate interest — Article 6.1(f)):

  • Reminders you have explicitly set
  • Responses received in your conversations
  • Account security alerts (e.g., new sign-in)

We do not currently send personalised notifications based on your profile or faith data. All notifications are transactional in nature.

Legal Basis: Legitimate interest (6.1(f))

3.5 To Improve Our Service

  • Analyze aggregated usage patterns (no individual tracking)
  • Fix bugs and technical issues
  • Improve AI response quality
  • Develop new features

Legal Basis: Legitimate interest (6.1(f))

What we DON’T do:

  • ❌ We don’t use your data for advertising
  • ❌ We don’t sell your data to third parties
  • ❌ We don’t share data with analytics companies for their own purposes
  • ❌ We don’t train AI models on your conversations for third parties

3.6 Web Analytics (Aggregate Only)

On the web platform, we may analyze aggregate, anonymized web traffic to understand usage patterns and improve the service.

What we collect: Page views, navigation paths, browser type — no personal identification

Legal Basis: Your consent (Article 6.1(a))

Opt-out: See §2.4 above

Note: Notifications are only sent to users who grant notification permission on their device. This permission can be revoked at any time in device settings.

4. How We Share Your Information

4.1 We Generally Do NOT Share Your Data

Your personal information, conversations, and profile data stay private within Kairos Chat. We do not:

  • ❌ Sell your data
  • ❌ Share with advertisers
  • ❌ Provide to marketing companies
  • ❌ Give to analytics platforms (beyond the aggregate web analytics in §3.5)
  • ❌ Share with other users
4.2 Emergency Situations (Vital Interests)

We WILL share information in life-threatening emergencies:

When:

  • Imminent suicide risk
  • Active self-harm
  • Immediate physical danger
  • Severe crisis requiring intervention

With Whom:

  • Emergency services (police, medical responders)
  • Crisis hotlines
  • Mental health crisis teams
  • Emergency contacts (if you’ve designated them)

What We Share:

  • Your name and contact information
  • Nature of the crisis
  • Relevant context for responders
  • Location information (if available)

Legal Basis: Vital interests (Article 6.1(d) and 9.2(c))

Why: Protecting your life is more important than privacy. GDPR explicitly permits this.

4.3 Legal Requirements

We may disclose information when required by law:

  • Court orders or subpoenas
  • Legal investigations
  • National security requirements
  • Prevention of fraud or illegal activity
  • Protection of our legal rights

Legal Basis: Legal obligation (Article 6.1(c))

4.4 Service Providers (Data Processors)

We use trusted service providers who process data on our behalf:

AI Service:

  • Provider: A third-party AI language model provider
  • Purpose: Generate spiritual guidance responses to your messages
  • Data sent: Your messages; and (when Memory is enabled) your extracted profile attributes
  • Location: May be processed outside the EEA/UK
  • Safeguards: Data Processing Agreement; Standard Contractual Clauses (SCCs) for international transfers; provider is contractually prohibited from using your data for its own purposes
  • Note: We may change AI providers over time; this policy will reflect the current category of provider

Important: Every conversation message you send is processed by a third-party AI language model to generate the response. When Memory is enabled, your extracted profile attributes are also included to personalise the response.

Cloud Infrastructure:

  • Provider: Amazon Web Services (AWS)
  • Purpose: Store and process data securely
  • Location: European Union
  • Safeguards: Data Processing Agreement, strict access controls (only authorized personnel can access data)

Content Delivery Network (CDN):

  • Provider: CDN provider(s)
  • Purpose: Deliver the service reliably and securely worldwide; DDoS protection
  • Location: Global edge network; data origin remains in the UK
  • Safeguards: Data Processing Agreement

Email Service:

  • Provider: Transactional email provider
  • Purpose: Send account verification, notifications, and privacy-related communications
  • Safeguards: Data Processing Agreement

Push Notifications:

  • Provider: Google LLC (Firebase Cloud Messaging) — mobile apps
  • Purpose: Deliver push notifications to your device
  • Data sent: Device push notification token; notification content
  • Location: USA (with Standard Contractual Clauses)
  • Safeguards: Data Processing Agreement; token used only for delivery
  • Note: You control this via your device notification settings

Web Analytics:

  • Provider: Google LLC (Google Analytics 4) — web platform only, if enabled
  • Purpose: Aggregate usage statistics
  • Location: USA (with Standard Contractual Clauses)
  • Safeguards: Data Processing Agreement, consent-gated

Full sub-processor list: A detailed list of our current sub-processors is available on request at [email protected].

All providers are contractually bound to:

  • Process data only for our purposes
  • Not use data for their own purposes
  • Maintain strict security measures
  • Delete data when we request it
  • Comply with applicable data protection law
4.5 International Data Transfers

Our servers are located in the European Union (Amazon Web Services). The following providers may process data outside the EEA: our third-party AI language model provider; Google LLC (Firebase Cloud Messaging, Google Analytics 4). We ensure adequate protection for all international transfers through:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Contractual prohibitions on the provider using your data for its own purposes
  • Additional technical and organizational security measures

5. How Long We Keep Your Information

5.1 Account Active

While your account is active:

  • Chat messages: Stored indefinitely (until you delete them)
  • Profile data: Stored until you disable memory or delete attributes
  • Session data: Current session + 30 days
  • Critical alerts: 90 days or until resolved
  • Audit logs: 7 years (legal/regulatory requirement)
5.2 After Disabling Memory

When you toggle OFF “Memorize Conversations”:

  • We stop extracting new attributes immediately
  • Existing attributes are retained (in case you re-enable)
  • To delete existing data, use “Delete Profile Data”
5.3 After Withdrawing Emotional Wellbeing Consent

When you toggle OFF “Emotional Wellbeing Support”:

  • Emotional/mental health data deleted within 30 days
  • Other data (religious, basic) remains (different legal basis)
5.4 After Account Deletion

When you request account deletion:

  • 30-day grace period (you can cancel deletion)
  • After 30 days: All personal data is irreversibly removed. Specifically:
  • Deleted: All chat messages, chat sessions, conversation memory (attributes), push notification tokens, authentication tokens, and password reset tokens
  • Deleted: All audit log entries linked to your account (these contain IP addresses and device information — they are removed in full)
  • Anonymized: Your account record has all personal identifiers irreversibly replaced (email replaced with an unrecoverable anonymous identifier; password hash and Google account ID set to null). The anonymized shell is retained only to preserve referential integrity of any content you created as an admin, and is excluded from all user-facing queries
  • Preserved: A single internal audit record (containing no personal data — only a timestamp and an anonymization event flag) is kept for internal accountability purposes
  • Cannot be recovered after anonymization is complete
  • This process satisfies GDPR Article 17 (right to erasure). Irreversible anonymization is recognized as equivalent to deletion under GDPR guidance.
5.5 Anonymous Usage Data

If you use Kairos Chat without creating an account:

  • Your conversation data is linked to a device identifier
  • Anonymous session data is retained for at least 180 days (6 months) of inactivity, then automatically deleted
  • If you create an account and claim your anonymous sessions, your data transitions to your account retention schedule
  • Your device identifier persists on your device until you clear app data; the associated server-side data is deleted after the inactivity period above

6. Your Rights Under GDPR

As an individual in the EU/EEA, you have the following rights:

6.1 Right of Access (Article 15)

You can access your data anytime:

  • Go to: Settings → My Profile Data
  • View all information we’ve stored about you
  • See in organized categories
6.2 Right to Rectification (Article 16)

You can correct inaccurate information:

6.3 Right to Erasure / “Right to be Forgotten” (Article 17)

You can delete your data:

Option 1: Delete specific attributes

  • Settings → My Profile Data → Remove individual items

Option 2: Delete all profile data

  • Settings → Privacy → Delete Profile Data
  • Effect: All memory reset, chat history preserved

Option 3: Delete entire account

  • Settings → Account → Request Account Deletion
  • Effect: All personal data irreversibly removed after 30-day grace period via anonymization (see §5.4 for full details). This satisfies your right to erasure under GDPR Article 17.
6.4 Right to Data Portability (Article 20)

You can export your data:

  • Go to: Settings → Privacy → Export My Data
  • Format: JSON (machine-readable)
  • Includes: Profile, chat history, consents
6.5 Right to Object (Article 21) — Including Profiling

You can object to processing based on legitimate interest or for profiling:

The extraction and storage of your personal attributes (faith background, life context, emotional patterns) from your conversations constitutes profiling under GDPR Article 4(4). You have the right to object to this profiling at any time.

How to exercise this right:

  • Immediately: Toggle OFF “Memorize Conversations” in Settings → Privacy
  • For emotional/health profiling: Toggle OFF “Emotional Wellbeing Support”
  • Delete existing profile data: Settings → Privacy → Delete Profile Data
  • Or contact us: [email protected]

When you object, we will stop profiling immediately. We will only override this objection if we can demonstrate compelling legitimate grounds that override your interests.

For critical alerts:

  • Cannot object (protecting your life overrides this right)
6.6 Right to Restrict Processing (Article 18)

You can restrict how we use your data:

  • Disable memory (restricts attribute extraction)
  • Withdraw emotional wellbeing consent (restricts health data)
  • Delete specific attributes
6.7 Right to Withdraw Consent (Article 7.3)

For emotional wellbeing tracking:

  • Settings → Privacy → Toggle OFF “Emotional Wellbeing Support”
  • Effect: Data deleted within 30 days
  • No impact on your account or other features

For web analytics:

  • Withdraw via the cookie consent banner or browser opt-out tools (see §2.4)
6.8 Right to Lodge a Complaint

If you believe we’ve violated your privacy rights:

Contact us first: [email protected]

Or file complaint with supervisory authority:

  • Find your national data protection authority: https://edpb.europa.eu/about-edpb/board/members_en
  • They will investigate your complaint
  • This is a free service
6.9 Rights Regarding Automated Processing (Article 22)

We perform automated analysis of your conversations to detect safety risks (suicide, self-harm, persecution, emotional crisis). When this detection may result in emergency services being contacted or other significant action, you have the right to:

  • Request human review of the automated assessment
  • Understand the logic involved in the detection
  • Express your point of view before action is taken (where this does not endanger you)

Exception: The right to object does not apply when processing is necessary to protect vital interests (your life or safety). We will always attempt to notify you when emergency services are contacted, unless doing so would endanger you further.

To exercise this right: [email protected]

6.10 Additional Rights for UK Users (UK GDPR)

If you are in the United Kingdom, the UK GDPR applies separately from EU GDPR. Your rights are substantially the same as listed above (§6.1–6.8). You can reach us directly at [email protected]. The relevant supervisory authority is:

Information Commissioner’s Office (ICO)

Website: https://ico.org.uk

Helpline: 0303 123 1113

6.11 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: Request disclosure of the personal information we have collected about you in the past 12 months
  • Right to Delete: Request deletion of your personal information (subject to legal exceptions)
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: We do NOT sell or share your personal information for cross-context behavioral advertising
  • Right to Limit Use of Sensitive Information: Religious beliefs and health-related data are “sensitive personal information” under CPRA. You can limit our use to what is necessary to provide the service (use the “Disable Memory” and “Emotional Wellbeing Support” toggles)
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

Do Not Sell or Share My Personal Information: We do not sell your personal information. We do not share it for advertising purposes.

To exercise these rights, contact us at [email protected]. We will respond within 45 days.

7. How We Protect Your Information

7.1 Technical Security Measures

We implement the following security measures:

  • Encryption in transit: TLS/SSL for all data transmission
  • Data at rest: Data is stored on Amazon Web Services infrastructure. While data at rest is not independently encrypted at the application layer, access to the database and server environment is strictly restricted to verified and authorized personnel only. AWS infrastructure-level security controls are applied.
  • Secure authentication: Industry-standard password hashing (bcrypt)
  • Access controls: Role-based access, principle of least privilege; only authorized team members can access production data
  • Regular security audits: Vulnerability scanning and penetration testing
  • Secure infrastructure: Hardened servers, firewalls, monitoring
7.2 Organizational Security Measures

Internal policies and training:

  • Background checks for team members with data access
  • GDPR compliance training
  • Data minimization principles
  • Regular security awareness training
  • Incident response procedures
7.3 Data Breach Response

If a data breach occurs:

  1. We will contain and remediate immediately
  2. Notify supervisory authority within 72 hours (if high risk)
  3. Notify affected users without undue delay (if high risk to rights)
  4. Provide information on steps taken and how to protect yourself
7.4 Our Data Quality Commitments (GDPR Article 5)
  • Data minimization: We collect only what is necessary for each specific purpose
  • Purpose limitation: We will not use your data for purposes incompatible with those described here
  • Accuracy: We take reasonable steps to keep your data accurate; you can correct it anytime via Settings or by contacting us
  • Storage limitation: We apply the retention periods in §5 and do not keep data longer than necessary
  • Accountability: We maintain internal records of all processing activities (Record of Processing Activities per Article 30) and can demonstrate compliance on request

8. Children’s Privacy

Age Requirement: You must be at least 16 years old to use Kairos Chat. We do not offer a consent pathway for users under 16 and do not knowingly collect data from anyone under this age.

If we discover we have inadvertently collected data from a user under 16, we will delete it promptly.

Parents/Guardians: If you believe your child has used Kairos Chat, contact us at [email protected].

9. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

  • Changes in our practices
  • New features
  • Legal requirements
  • User feedback

How we notify you:

  • Email notification for significant changes
  • In-app notification
  • “Last Updated” date at top of policy

For minor changes (corrections, clarifications), continued use after the effective date constitutes acceptance.

For significant changes that affect how we process your personal data or that introduce new processing purposes, we will seek fresh consent or provide a meaningful opportunity to object before the change takes effect.

Version History: We maintain a complete version history of all policy versions. Previous versions are available upon request at [email protected].

10. Special Note: Religious Organization Exception

Why we process religious data differently:

Stichting 222 Ministry, operating as part of the Transform Iran ministry, is a registered non-profit Christian organization in The Netherlands. Under GDPR Article 9.2(d), religious organizations can process information about members’ religious beliefs as part of legitimate religious activities, with appropriate safeguards.

What this means:

  • We can remember your faith journey to provide spiritual guidance
  • This is necessary for our core mission
  • You voluntarily seek our religious services
  • We don’t share your religious data commercially
  • You can still opt-out via “Disable Memory”

This exception recognizes that:

  • We cannot provide Christian spiritual guidance without knowing about your faith
  • You specifically chose a Christian spiritual support service
  • Religious counseling inherently involves religious data
  • Our processing benefits your spiritual growth

Your control remains paramount:

Even though we can process religious data under this exception, we provide the “Disable Memory” toggle so you have complete control.

11. Contact & Questions

Privacy Questions:

Data Subject Rights Requests:

General Support:

  • Email: [email protected]
  • Help Center: https://info.kairoschat.ai/read-before-you-start/

Postal Address:

Stichting 222 Ministry

Palmpolstraat 43

1327CB, Almere

The Netherlands

12. Legal Information

Governing Law: This Privacy Policy is governed by the laws of The Netherlands and, where applicable, the EU General Data Protection Regulation (GDPR).

Data Controller: Stichting 222 Ministry, registered in The Netherlands (KvK: 39082906, RSIN: 816373711). ANBI-registered public benefit organization.

Lead Supervisory Authority: Autoriteit Persoonsgegevens (AP) — the Dutch Data Protection Authority, being the supervisory authority in the EU member state where we are established.

Website: https://autoriteitpersoonsgegevens.nl

GDPR Compliance: We are established in The Netherlands and comply with the EU General Data Protection Regulation (GDPR). GDPR applies directly to our operations.

UK GDPR Compliance: We comply with the UK GDPR for users in the United Kingdom.

13. Definitions

Personal Data: Any information relating to an identified or identifiable individual.

Special Category Data: Sensitive data including religious beliefs, health information, racial origin, etc. (GDPR Article 9).

Profiling: Any form of automated processing of personal data to evaluate, analyse, or predict personal aspects (GDPR Article 4(4)). Our attribute extraction constitutes profiling.

Data Controller: Entity that determines purposes and means of processing (Stichting 222 Ministry).

Data Processor: Entity that processes data on behalf of controller (our service providers, including our third-party AI language model provider).

Processing: Any operation performed on data (collection, storage, use, sharing, deletion).

Consent: Freely given, specific, informed, unambiguous indication of agreement.

Legitimate Interest: Legal basis for processing when controller has valid interest that doesn’t override individual’s rights.

Summary

In Plain Language:

✅ We remember your faith journey to provide better spiritual guidance (you can disable this)

✅ We don’t sell your data or use it for advertising

✅ We share data only in emergencies to protect your life

✅ You control your data – view, export, or delete anytime

✅ Detailed mental health tracking requires your consent (off by default)

✅ We’re a Christian ministry, not a surveillance company

✅ Your conversations are processed by a third-party AI language model to generate responses — never for advertising

✅ Your privacy matters to us – we’re transparent and give you control

Questions? Contact us at [email protected]

End of Privacy Policy

Last Updated: February 26, 2026

Version: 1.1

Appendix: Data Processing Summary Table

Data Type Examples Legal Basis User Control Retention
Account Info Email, password Contract (6.1b) Delete account Until anonymization (PII replaced on deletion)
Google OAuth Data Email, Google ID Contract (6.1b) Delete account Until anonymization (Google ID nulled on deletion)
Chat Messages Your questions, AI responses Contract (6.1b) Delete chats Until deletion
Religious Data Faith, beliefs, prayers Religious org (9.2d) Disable Memory Until disabled/deleted
Basic Personal Name, interests, context Legitimate interest (6.1f) Disable Memory Until disabled/deleted
Mental Health (with consent) Emotional patterns, mental health Consent (9.2a) Toggle OFF consent Until withdrawn + 30 days
Critical Alerts Suicide risk, crisis Vital interests (9.2c) Cannot disable 90 days
Technical Data IP, device type, app version Legitimate interest (6.1f) None (necessary) Session + 30 days
Device Identifier Persistent device identifier Legitimate interest (6.1f) Clear app data Until app uninstall
Web Analytics Page views (aggregate, GA4) Consent (6.1a) Cookie opt-out Up to 2 years
Push Notification Token Device delivery token Consent / Legitimate interest (6.1a/f) Device notification settings Until notifications disabled
Anonymous Session Data Device-linked conversations Legitimate interest (6.1f) Clear app data At least 180 days (6 months) inactivity

Floating Back Button
Back