Privacy Policy

1. Who We Are

Grace is a daily devotional app designed to help new believers grow in their faith. References to "Grace," "we," "us," or "our" in this policy refer to the service and its operator.

As a UK-based business, we are subject to UK data protection law (UK GDPR and the Data Protection Act 2018). We also aim to meet the standards of the EU General Data Protection Regulation (GDPR) where applicable to our users.

2. What Data We Collect

Account information

When you create an account using Sign in with Apple, Apple shares with us your name (if you choose to share it) and an email address. If you select "Hide My Email," Apple provides a private relay address rather than your real email. We store whichever email address Apple gives us so we can identify your account and send you important messages about your account.

App usage data

As you use Grace, we record activity that helps the app work and helps you track your progress in faith:

• Which daily verses and devotions you've read
• Your reading streak (consecutive days of engagement)
• Highlights you've applied to scripture text
• Reflections you've saved on individual devotions
• Journal notes you've written inside the app

This data is tied to your account so it persists across devices and reinstalls.

Ask Grace conversations

When you use Ask Grace, your messages are sent to Anthropic's API to generate a response. They're private to your account and aren't shared with other users. See Section 5 for more detail on how Anthropic handles this data.

Saved conversations

Your Ask Grace conversations are saved to your account so you can revisit them. They're private to you, and you can view or delete them any time in the app, under Grace's Memory in Settings.

Grace's Memory

To make conversations feel more personal, Grace keeps a short private note about what you've shared — your situation, what you're praying about, what you're studying. It's on by default, stays private to your account, and you can view it, turn it off, or clear it any time in the app.

Subscription and purchase data

If you subscribe to Grace Premium, purchase records and subscription status are managed by RevenueCat and processed through the Apple App Store. We receive confirmation of your subscription status but do not store your payment card details — those remain with Apple.

Push notification preferences

If you opt in to push notifications, your device token is shared with OneSignal so we can deliver daily devotion reminders. You can withdraw consent at any time in your device's notification settings.

Technical and diagnostic data

We may collect basic technical information such as app version, device type, and crash reports. This data is used only to diagnose and fix problems with the app.

3. Why We Collect It (Our Legal Bases)

To fulfil our contract with you

Most data we collect is necessary to provide the app at all. Without your account details and usage data, features like streaks, journals, and reading history simply cannot function. Processing this data is necessary to perform the service you signed up for.

With your consent

We send push notifications only if you explicitly opt in. You can withdraw that consent at any time in iOS Settings.

For our legitimate interests

We may use aggregated, anonymised usage data (for example, which devotions are read most) to understand how to improve the app. This doesn't involve identifying individual users.

To comply with legal obligations

We may retain certain records where required to do so by law.

4. How We Store Your Data

Your data is stored in Supabase, a managed database and authentication platform. Supabase hosts data in the European Union (specifically AWS eu-west regions). All data in transit is encrypted via TLS. Data at rest is encrypted using AES-256.

Access to the database is restricted to authorised personnel (currently, the sole developer) and is protected by strong authentication controls.

5. Third-Party Processors

We use a small number of trusted third-party companies to operate Grace. Each acts as a data processor — meaning they handle data on our behalf and only for the purposes we specify.

We do not sell your personal data. We do not share your data with advertisers or data brokers.

6. How Long We Keep Your Data

Active accounts

We retain your account data and all content you've created (journals, highlights, reflections) for as long as your account is active. This allows you to return to Grace at any time, even after a long absence, without losing your history.

Deleted accounts

When you request account deletion, we delete your personal data within 30 days. Some anonymised or aggregated records (for example, a count of total devotions read) may be retained in a form that cannot be linked back to you.

Ask Grace conversations and Grace's Memory

Saved conversations and Grace's Memory are retained for as long as your account is active, and are deleted when your account is deleted. You can also view, clear or turn these off yourself at any time in the app, under Grace's Memory in Settings. Data sent to Anthropic's API is subject to Anthropic's own retention practices.

Push notification tokens

Device tokens held by OneSignal are removed when you disable notifications or delete your account.

Legal holds

In rare circumstances we may be required by law to retain certain records for longer than the periods described above.

7. Your Rights

Under UK GDPR and EU GDPR, you have the following rights in relation to your personal data. To exercise any of them, contact us at the address in Section 11.

• AccessYou can request a copy of the personal data we hold about you.
• CorrectionYou can ask us to correct inaccurate or incomplete data. Some data (like your name or email) can be updated directly in the app.
• ExportYou can request an export of your data in a portable, machine-readable format (for example, your journal entries as a JSON or CSV file).
• DeletionYou can request deletion of your account and all associated personal data. You can initiate this in the app via Settings → Account → Delete Account, or by emailing us. We will action this within 30 days.
• ObjectYou can object to processing we carry out on the basis of legitimate interests. We will stop unless we have compelling grounds to continue.
• Withdraw consentWhere processing is based on consent (such as push notifications), you can withdraw that consent at any time without affecting the lawfulness of prior processing.
• RestrictionIn certain circumstances you can ask us to restrict the processing of your data while a dispute is resolved.
• ComplaintIf you're unhappy with how we've handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or, if you are in the EU, with the data protection authority in your country of residence.

We will respond to all data rights requests within one calendar month.

8. Children's Privacy

Grace is rated 4+ on the Apple App Store, meaning it contains no content that is inappropriate for young audiences. However, Grace is not specifically designed for or marketed to children, and we do not knowingly collect personal data from anyone under the age of 13.

If you are a parent or guardian and believe your child has created an account or provided us with personal information, please contact us at the address in Section 11 and we will delete that information promptly.

If you are between 13 and 17, we encourage you to review this policy with a parent or guardian before using the app.

9. International Data Transfers

Your data is primarily stored in the EU (via Supabase). Some of our third-party processors, including Anthropic and RevenueCat, are based in the United States. Where data is transferred outside the UK or EU, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses (SCCs), or adequacy decisions — to ensure your data remains protected to the standards required by UK and EU law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we'll let you know via a notification in the app or via email before the change takes effect. The "Last updated" date at the top of this page always shows when the policy was most recently revised.

Continuing to use Grace after a change takes effect means you accept the revised policy.

11. Contact Us

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how we've handled your information, please get in touch.