Privacy Notice

Operator and contact

Felipe Mamud · Germany

privacy@bibleit.app

Data we process

Account data includes your name, email address, public username, profile, preferences and sign-in provider identity. Passwords are stored as salted hashes. Authentication tokens and sessions use random values with hashes stored on the server. We also process device and IP information for security, organization memberships, invitations, presentations, uploaded media, support messages and review records.

Purposes and legal bases

We process data necessary to provide the account and features you request on the basis of contractual necessity. Necessary security and abuse prevention may rely on legitimate interests, taking account of your rights. Legal obligations and any separate consent apply only to the purposes for which they are relevant. Agreeing to the Terms does not provide blanket consent to personal-data processing.

Sensitive information and sharing

Religious activity and material such as prayer requests can reveal particularly sensitive information. Only share information about other people when you have the necessary rights and a lawful basis, including any required condition for sensitive data. Do not upload unnecessary sensitive personal information. Public profiles, public Lives and material you deliberately share may be visible to others; organization members may access workspace content according to their permissions.

An adult uploader cannot consent for everyone mentioned in a presentation. Religious or health information and images of children require particular care, a valid basis and any necessary authority or explicit consent. Choosing public sharing is separate from private storage. Where consent is used, withdrawal must stop the affected future use where required; terms acceptance is not that consent.

Church workspaces and responsibilities

The church determines the purposes, people and audience for content it instructs Bibleit to host; Bibleit processes that content under the agreed church processing terms. Our own account, security and legal responsibilities remain separate. Church administrators must document a lawful basis and any necessary sensitive-data condition, manage permissions and handle requests concerning their instructed content. Contact privacy@bibleit.app if you need help identifying the responsible party.

Service providers and locations

Bibleit uses hosting, database, storage and email services. Depending on configuration and your choices, these include Fly hosting, Resend email delivery, Google or GitHub sign-in, and Cloudflare human verification. Those providers receive information needed for their function and may also process data under their own terms. Provider processing or support access may occur outside the European Economic Area. Contact us for information about the providers and transfer arrangements relevant to your use.

Resend also receives and stores privacy@bibleit.app correspondence. Message data is stored in the United States, including when email is sent from an EU region.

When you activate an optional external video player, your browser connects to that provider and can disclose connection/device information. Loading controls do not authorize uploading or publishing other people's personal information.

Cookies and browser storage

Cookies support sign-in, security, invitations, language choices and a remembered sign-in shortcut. The shortcut does not authenticate you on its own. Browser storage may retain display preferences, translation catalogues, your last reading reference and temporary form drafts. You can clear this storage in your browser; this may remove preferences or require signing in again.

We request browser-storage clearing after successful sign-in and logout, including account deletion's logout path. Browser support and copies you download or keep offline can limit what the service can clear. The remembered-login shortcut has separate expiry and forgetting controls.

Retention and deletion

We keep account and workspace data for the purposes described here. You can delete your personal account in settings or request help by email. Account deletion removes many related records. Organization-owned shared work, necessary security or dispute records, provider copies and backups may require separate handling or justified retention. We minimize retained review evidence. We do not promise that deleting an account immediately erases every backup, shared document or copy downloaded by another person. Ask us for the retention details applicable to a particular record.

Eligible abandoned, unverified email signups are considered for removal after seven days of inactivity. Routine security audit records and eligible closed support/application records are considered for cleanup after 90 days, subject to their eligibility rules and specific reviewed exceptions. Account deletion is a separate operation and does not wait for those routine windows.

New Fly snapshots retain three days for application files and the separate erasure ledger, and five days for the shared database. Older snapshots keep their original expiry. Minimal finalized erasure markers remain 30 days to keep deleted data deleted after recovery; unresolved intents block recovery until reconciled. These settings do not promise immediate physical erasure of provider residual copies. Restored data is quarantined and erasure effects must be reapplied before access.

Your choices and rights

Contact privacy@bibleit.app to request access, correction, deletion, restriction, objection or portability where applicable. We may verify your identity proportionately before responding. If a purpose relies on consent, you may withdraw that consent without affecting earlier lawful processing. You may complain to a competent data protection supervisory authority, including one in your country of habitual residence, workplace or the place of an alleged infringement.

Berlin Commissioner for Data Protection and Freedom of Information

Adults and public viewing

Accounts are intended for people aged 18 or older. We record an adult self-declaration, the agreed Terms version, time, language and signup channel; we do not collect a date of birth for that declaration. Public viewing does not require an account. Contact us if you believe a child has created an account or personal information should be removed.

Contact and updates

Bibleit is operated by Felipe Mamud in Berlin, Germany. For privacy requests and questions, use privacy@bibleit.app. The version shown on this page identifies this notice; material changes will be explained through the service where appropriate.