Privacy Policy

Ian Marco ("we," "us," or "our") operates Sacred: Bible & Daily Devotion ("Sacred" or "the App"), a Christian devotional mobile application, and the website thesacredapp.com ("the Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Sacred. By using Sacred, you agree to the collection and use of information in accordance with this policy.

Sacred collects information to operate the app, personalize content, manage subscriptions, diagnose problems and measure how people discover Sacred and how our advertising performs. We do not sell your personal data for money. The mobile attribution practices and permission choices are described below; the website has separate analytics and advertising choices in the "Website Analytics and Advertising" section.

1. Information We Collect

When you create an account, we collect your name, email address, and an encrypted password for authentication and communication purposes. We also collect your profile preferences such as language preference, devotional level, and theme preferences in order to personalize your content experience. If you use the Bible Chat feature, we process the questions and messages you enter in order to provide AI-powered responses.

We automatically collect usage data such as features used, content viewed, time spent in the App, and frequency of use. This helps us improve the App, curate content, and perform analytics. We also collect device information including device model, operating system version, and app version for technical support and compatibility purposes. Performance data such as crash logs and error reports are collected to maintain app stability.

Sacred does not access precise geolocation, photos or videos from your device, contacts, calendar data, other apps' messages, health, fitness or biometric data. Payment providers process payment details; Sacred and RevenueCat receive subscription status, products and transaction information needed to manage access and subscriptions. Mobile attribution may use technical device information and advertising identifiers subject to the permission choices described below.

When you choose to start a Matthew voice conversation, Sacred processes microphone audio and conversation text to provide the call. Sacred also processes call duration, connection status and technical errors to operate the feature.

2. How We Use Your Information

We use your information to provide, operate, and maintain the App and its features, to personalize your devotional experience based on your language and level preferences, to process and manage your subscription through Apple's In-App Purchase system, and to provide AI-powered Bible Chat responses. We also use your information to send service-related communications such as updates and security alerts, to analyze usage patterns to improve content and user experience, to diagnose technical issues and maintain app stability, and to comply with legal obligations.

3. Sharing of Your Information with Third Parties

We use the service providers described here to operate Sacred, manage subscriptions and measure usage and advertising. We request permission where required, including Apple's App Tracking Transparency permission before accessing IDFA or tracking across other companies' apps and websites.

Apple and Google process in-app transactions, and web payment providers process website purchases. RevenueCat receives subscriber and account identifiers, subscription and transaction information and, for account support, email addresses. Our AI providers, including OpenAI, process Bible Chat text to generate responses. Supabase stores account information, preferences and app data. Bible content providers deliver scripture and narrated audio. OneSignal processes push tokens and notification interactions; Google Sign-In processes email and basic profile information for authentication. Amplitude processes product usage events, device information and account identifiers for analytics and experiments. Sentry processes diagnostic information, errors, user IDs and, for support, account email addresses. ElevenLabs processes text for audio generation. Starting with version 3.6.2, the iOS app uses Meta's SDK and AppStack for mobile attribution and advertising measurement. They may process installation and opening events, app interactions, technical device information, attribution identifiers and, when permission allows, IDFA. AppStack also receives account and subscription conversion identifiers to connect attribution with subscription events. When its Meta integration is enabled, RevenueCat may send subscription conversion events and the identifiers required by that integration, subject to applicable permission settings. Earlier app versions may continue to use AppsFlyer for attribution under their permission settings; the AppsFlyer SDK is removed starting with 3.6.2. Referral links do not require access to your contacts. We do not send Bible Chat messages, prayer content or microphone audio to advertising providers.

We do not sell personal data for money. Advertising measurement through Meta and AppStack may involve sharing identifiers and app or subscription events, as described above. Such sharing may fall within privacy laws' definitions of advertising-related sharing. The iOS tracking choices are explained in section 9; the website's separate opt-out is available through "Do Not Sell or Share My Personal Information" in the footer. A website opt-out does not change your iOS permission settings.

4. Third-Party AI Data Processing

In accordance with Apple's App Store Review Guideline 5.1.2(i), we provide the following disclosure regarding AI data processing. When you use the Bible Chat feature, the text of your messages is transmitted to our third-party AI service provider to generate responses. Messages are processed in real-time and are not stored by the AI provider beyond the session duration unless you separately consent. By using Bible Chat, you explicitly consent to this data processing. You can choose not to use Bible Chat if you do not wish to share data with third-party AI services. Your personal data and chat interactions are not used to train AI models unless you provide separate, explicit, opt-in consent. All data transmitted to AI service providers is encrypted in transit using TLS 1.2 or higher.

For Matthew voice conversations, LiveKit transports the conversation and OpenAI processes audio and conversation text to generate responses. Sacred does not enable audio recordings of these calls. Provider processing is subject to their applicable terms and privacy practices. See the Matthew voice terms.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS/SSL protocols, encryption of sensitive data at rest, secure authentication mechanisms with encrypted password storage, regular security assessments and updates, and access controls limiting personnel access to personal data on a need-to-know basis. While we strive to use commercially reasonable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure and we cannot guarantee absolute security.

6. Data Retention and Deletion

Account information is retained for the duration of your active account plus 30 days after a deletion request. Usage and analytics data is retained for 24 months and then anonymized or deleted. Bible Chat conversation history is automatically deleted after 90 days. Performance and crash data is retained for 12 months. Subscription records are retained as required by tax and accounting laws, typically 7 years.

You may request deletion of your account and associated personal data at any time by navigating to Settings > Account > Delete Account within the App, or by contacting us at hi@thesacredapp.com. We will process the request within 30 days. All personal data associated with your account will be permanently deleted or anonymized. We will send a confirmation of deletion to your registered email address. Some data may be retained where required by law or for legitimate business purposes, but only for the minimum duration required.

Deleting your account does not automatically cancel your subscription. You must cancel your subscription separately through your Apple ID Account Settings to avoid future charges.

When Matthew memory is enabled with your consent, Sacred stores remembered details and summaries to personalize future conversations. Recent conversation text is encrypted and stored temporarily for continuity and summarization, with an expiry of no more than 24 hours. Remembered details and summaries follow a configured retention period of up to 90 days, which can be renewed as memory is updated. You can ask Matthew to forget a detail or its stored memory. Wait for confirmation; if the request fails, contact hi@thesacredapp.com. Deleting memory does not erase technical usage records.

7. Your Rights

Regardless of your location, you have the right to access and request a copy of the personal data we hold about you, to request correction of inaccurate personal data, to request deletion of your personal data, to withdraw consent for data processing at any time, and to request a copy of your data in a structured, commonly used, machine-readable format.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to request that we limit the processing of your personal data, to object to our processing of your personal data based on legitimate interests, and to file a complaint with your local Data Protection Authority.

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the right to request that we delete your personal information, and the right to non-discrimination for exercising your rights. We do not sell personal information for money. Some of the advertising tools on our website may qualify as "sharing" personal information for cross-context behavioral advertising under the CPRA; you have the right to opt out of that sharing at any time from our Your Privacy Choices page (the "Do Not Sell or Share My Personal Information" link in the Site footer), and we honor the Global Privacy Control signal as a valid opt-out request.

To exercise any of the above rights, please contact us at hi@thesacredapp.com. We will respond to your request within 30 days or within the timeframe required by applicable law.

8. Device Permissions

Sacred requires internet access for content delivery and subscription verification. The App may optionally request permission to send notifications for daily devotional reminders and verse of the day. We respect your device permission settings and will never attempt to manipulate, trick, or force you to consent to unnecessary data access.

Matthew requests microphone permission when you choose to start a voice call. You can stop the call or mute your microphone at any time.

9. App Tracking Transparency

On iOS, we request Apple's App Tracking Transparency (ATT) permission before using your advertising identifier (IDFA) or tracking across other companies' apps and websites. You can decline without losing access to app features, or change your decision in Settings > Privacy & Security > Tracking. Declining does not stop essential subscription management, diagnostics or measurement that does not track you across companies. A denial must not be bypassed using another identifier. Meta's iOS SDK and AppStack are used for attribution and advertising measurement starting with 3.6.2; earlier versions may use AppsFlyer. See section 3 for the data and providers involved.

10. Children's Privacy

Sacred contains faith-based devotional content. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we discover information collected from a child without appropriate consent, we will take steps to delete it. Advertising and analytics tools are intended for general audiences and are not directed at children. Parents or guardians with concerns can contact hi@thesacredapp.com.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including Argentina and the United States, where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and Data Processing Agreements with all third-party service providers.

12. Website Analytics and Advertising

This section is about our website, thesacredapp.com — including our blog and the Sacred quiz — rather than the App itself. Like most websites, ours uses a few tools that help us understand which content resonates and whether our advertising is working:

Meta (Facebook) Pixel and Conversions API. These measure how well our ads on Facebook and Instagram perform and help us reach people who may love Sacred. The Pixel uses cookies to note the pages you visit and the actions you take on our Site (like completing the quiz). If you create an account or subscribe on our Site, we may also send Meta a hashed (scrambled, not directly readable) version of your email address, along with technical details such as your IP address and browser type, through Meta's Conversions API so those conversions are counted accurately. Meta's privacy policy is available at facebook.com/privacy/policy, and you can manage your ad preferences at facebook.com/adpreferences.

Google Analytics 4. Tells us how visitors find and move through the Site (pages viewed, approximate location derived from IP address, device type) so we can improve it. Google's privacy policy is available at policies.google.com/privacy.

Pinterest Tag. Measures visits that come from our Pinterest content and ads. Pinterest's privacy policy is available at policy.pinterest.com/privacy-policy.

AppStack download links. The download buttons on our Site go through a link from AppStack, our app attribution provider, before taking you to the App Store or Google Play. When you tap one, AppStack records that click (your IP address, device and browser type, language, time zone, screen size and the page you came from) to match it with the app installation, so we know which part of the Site brought you to the App. AppStack's privacy policy is available at appstack.tech/privacy-policy.

OpenAI ads measurement. If you reach our Site by tapping one of our ads in an OpenAI product such as ChatGPT, the link carries a click reference from OpenAI. We store that reference in your browser and on our servers for up to 30 days. If you then make your first paid purchase on our Site, our server tells OpenAI that the ad led to a purchase: it sends that click reference, the amount, currency and time of the purchase, and the address of the page where you arrived. We do not send OpenAI your name, your email address or your quiz answers, and we do not load any OpenAI script, pixel or cookie on our Site. Turning off sharing under “Your choices” below, or using a browser that sends the Global Privacy Control signal, stops this and deletes the stored reference; we only keep a note that you opted out, so that we do not include you again. OpenAI’s privacy policy is available at openai.com/policies/privacy-policy.

Your choices. Under the California Consumer Privacy Act, the use of some of these advertising tools may be considered "sharing" personal information for cross-context behavioral advertising. We never sell your personal information for money — and you can turn this sharing off at any time: visit Your Privacy Choices (the "Do Not Sell or Share My Personal Information" link in the Site footer) and we will disable these tools for your browser. We also honor the Global Privacy Control (GPC) signal automatically: if your browser sends it, these tools stay off without you having to do anything.

13. Cookies and Similar Technologies

Sacred is a native mobile application and does not use browser cookies. However, we may use similar technologies such as local storage and device identifiers for maintaining your session and login status, remembering your preferences and settings, and analytics and performance measurement. If you access Sacred-related web content such as this Privacy Policy page, standard web cookies may be used — see the "Website Analytics and Advertising" section above for the tools involved and how to opt out.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email prior to the changes becoming effective. Your continued use of Sacred after the effective date of any modifications constitutes your acceptance of the revised policy. We encourage you to review this Privacy Policy periodically.

15. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at hi@thesacredapp.com.