Privacy Policy

Prayla is a Catholic prayer app. Your prayer life is personal, and we treat it that way. • We don’t sell your data, and there are no ads in Prayla. • Prayla has no advertising trackers, and we never collect your device’s advertising ID. • What we keep is there to make Prayla work for you: your prayers, your routines and what you choose to share. • You can delete your account in the app at any time, and it is removed from our live systems within 24 hours. The rest of this page explains, in plain words, what we collect and why, who helps us run Prayla, how long we keep things, and the choices you have.

Prayla is run by Justyn Jóźwiak, ul. Dunikowskiego 11, 02-793 Warszawa, Poland (“Prayla”, “we”, “us”). We are responsible for your personal data (the “controller”) when you use the Prayla app or our website, prayla.app. You can write to us about anything in this policy at [email protected].

Prayla is for people aged 13 and over. If we learn that someone under 13 has an account, we delete the account and its data. If you are a parent or guardian and think your child under 13 is using Prayla, please write to [email protected].

Your account • How you sign in: your Apple or Google account ID, or the email address you use to receive sign-in codes. • Your email address, when your sign-in method gives us one. Sign in with Apple may give us a private relay address instead of your real one. • Your name, username, profile picture, bio, link and country. If you sign in with Google, we use your Google profile picture until you choose another. Your prayer life • The prayers you pray, your routines and habits, the novenas you follow, your reminders, streaks and prayer history. • Your notes, highlights and bookmarks in the Bible and the library, and your settings. What you write and share • The posts, replies, polls and photos you share, and when you pray for, like, bookmark or share a post. • The groups you start or join, and your circle: its members, the prayers and habits you keep together and the small gestures you send each other. • Direct messages, the pictures you send in them and your reactions to them. • Your conversations with Catholic AI. • Feedback you send us (as a guest, you can give us an email address so we can reply), reports you make, and corrections you suggest about churches on the map. • If you sign up for our newsletter on the website: your email address and language. Purchases • Whether you have Premium, which plan, when it renews or ends, and whether you belong to a family plan. Payment is handled by Apple or Google; we never see your card details. Your device • A notification token, so we can send you notifications. • Your app version, whether you use iOS or Android on a phone or a tablet, your language and your time zone. • When you last opened the app, and your answers when we ask whether you are enjoying Prayla. • If you use Prayla as a guest: an ID that Prayla creates and keeps on your phone (on iPhone also in your iCloud storage, so it survives reinstalling the app), and your phone’s vendor ID (iPhone) or Android ID. We use them to give you your guest account back, and they stay with your account if you later sign in. • Your IP address, which reaches our servers with every request. Usage statistics and crash reports • What happens in the app, such as which screens are opened and which features are used, and reports when the app crashes. See section 11. What stays on your phone • Your location. The map uses it on your phone to show the churches near you, and we never receive it. • Your examination of conscience. What you tick stays on your phone and is never sent to us. What we don’t collect • Payment card details, your contacts, your date of birth or your device’s advertising ID.

Because Prayla is a Catholic app, much of what we hold shows that you are Catholic and how you live your faith: your prayers, your posts, your groups, your circle and your conversations with Catholic AI. Posts and messages can also mention your health or other personal matters, if you choose to write about them. Data protection law treats religious beliefs and health as especially sensitive, and so do we. We use this information only to give you Prayla’s features. We never use it for advertising, and we never sell it. We hold it because you choose to give it to us by creating an account and using these features, and, for what you post publicly, because you have chosen to make it public. You can change your mind at any time by deleting your account (section 14).

We use your data for these purposes, each with the legal basis we rely on: • To run your account and give you Prayla’s features: prayer tracking, the community, groups, circles, messages, Catholic AI and syncing between your devices. (Our agreement with you under the Terms of Use, and your choice to share sensitive information, see section 5.) • To translate posts and replies, so people can read each other in their own language. (Our agreement with you.) • To keep the community safe: checking posts and pictures before they appear, handling reports, blocking and banning. (Our legitimate interest in a safe community, and our duties as a service that hosts what people post.) • To send you the notifications you allow. (Your consent, which you can change in the app or in your phone’s settings.) • To manage Premium and family plans. (Our agreement with you.) • To keep Prayla secure and working: preventing abuse, limiting repeated requests and fixing crashes and errors. (Our legitimate interest in a secure, reliable app.) • To understand how Prayla is used, so we can improve it. (Our legitimate interest in improving Prayla.) • To answer your feedback and support requests. (Our legitimate interest in helping you.) • To ask you now and then whether you would like to rate the app. (Our legitimate interest.) • To send occasional emails to people who sign up for our newsletter. (Your consent.) • When the law requires it, for example to answer a valid request from the authorities. (Legal obligation.) Where we rely on our legitimate interests, you can object, see section 15.

Prayla uses Google’s Gemini AI, through Google’s paid Gemini API, for three things: • Catholic AI: your message, the recent conversation and a short summary of earlier messages are sent to Google to write each answer. • Safety checks: the text and photos of posts, the text of replies, group names and descriptions, profile pictures and the pictures you send in messages are checked automatically before they appear or are delivered. • Translation: posts, replies, polls, and group names and descriptions are translated into Prayla’s languages. We don’t add your name or email address to what we send. Under Google’s terms for the paid Gemini API, Google processes this data on our behalf and does not use it to improve its products. Google may keep it for a limited time to detect misuse and to meet legal obligations. The text of your direct messages is never sent to any AI. We keep your Catholic AI conversations on our servers so you can come back to them, until you delete the chat or your account. The app asks for your consent before your first conversation. Catholic AI’s answers are written by a computer and can be wrong. They are not official Church teaching or pastoral advice. If an automatic check stops your post, reply or picture and you think it got it wrong, write to [email protected] and a person will look at it.

• Your name, username, profile picture, bio, link and country flag can be seen by everyone who uses Prayla, and people can find you by your name or username. • Your public posts and replies can be seen by everyone using Prayla, and you or others can share them outside Prayla with a link. Your username, profile picture and country can appear beside your public posts on the prayer globe. • When you pray for, like or reply to a post, its author is told. • Posts in a private group can only be seen by its members. Posts in a public group can be seen by everyone using Prayla. • The members of your circle see the prayers and habits you keep together, and can be notified when you pray one of them. • Your direct messages can only be seen by you and the person you write to. If a message is reported, our moderators can read it.

Notifications are delivered through Apple (on iPhone) and Google (on Android). So that they make sense on your lock screen, they can include the name of the person who wrote to you or prayed for you, and a short preview of what they wrote, including the beginning of a direct message. You can turn notifications off in the app or in your phone’s settings.

We use a few companies to run Prayla. They handle your data only on our instructions and under data protection agreements: • OVHcloud: our servers and database, in Canada. • Cloudflare: protects and speeds up the connection to our servers. • Backblaze: stores photos and pictures, and our backups. • Google: Firebase (usage statistics, crash reports and the delivery of notifications), the Gemini API (section 7), Google Sign-In and, on our website, Google Analytics. • Apple: Sign in with Apple and notifications on iPhone. • RevenueCat: keeps track of Premium purchases made through Apple or Google. • Sentry: tells us when something goes wrong on our servers or our website. • Resend: sends your sign-in codes by email. • Mapbox: draws the map. It receives the part of the map you are looking at and your IP address. We don’t send it your location. Some of these companies are in the United States or process data there. Where they do, your data is protected by the safeguards in their data protection terms, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework. Canada, where our servers are, is recognised by the European Commission as protecting personal data adequately. Apart from these companies, we share your data only when the law requires it or to protect someone’s safety. We do not sell your personal data, and we do not share it with anyone for advertising.

In the app, we use Google’s Firebase Analytics to count how Prayla is used: which screens are opened and which features are used (for example, that a prayer was finished or a novena day was completed), along with your language, country, Premium status and theme. It recognises your installation of the app by a random ID. We don’t connect these statistics to your Prayla account, your name or your email address. Firebase Crashlytics sends us a report when the app crashes or something goes wrong, with details about your device and what the app was doing at the time. We don’t use advertising trackers, we don’t collect your device’s advertising ID, and we don’t track you across other apps or websites. That is why Prayla never asks for permission to track you. Google keeps detailed usage statistics for up to 14 months and crash reports for 90 days.

Our website, prayla.app, uses: • A cookie that remembers your language, and your browser’s storage to remember your theme and reading settings. These are needed for the site to work the way you asked. • Google Analytics, which uses cookies to count visits and see which pages are read and how people find us. • Sentry, which reports errors on the page so we can fix them. It does not use cookies. You can delete or block cookies in your browser’s settings.

• Your account and what is in it: until you delete your account. • Posts, replies and photos: until you delete them or your account. • Catholic AI conversations: until you delete the chat or your account. • Direct messages: messages older than 7 days are deleted, except the 50 most recent in each conversation, which stay until newer messages replace them, both of you delete the conversation or one of you deletes their account. Pictures are deleted with their message. • Notifications: deleted after 30 days, except your 60 most recent, which stay until newer ones replace them. • Signing in: you stay signed in on a device until you sign out or delete your account. Sign-in codes stop working after 10 minutes and are deleted after about a week. • Reports: until our moderators close them. A copy of the reported message or post is kept with the report, encrypted, so it can be reviewed. • Feedback: until you delete your account. • Newsletter sign-ups: until you ask us to remove you. • Guest accounts: until you delete them, or until you sign in and they become part of your account. • IP addresses: records used to limit repeated requests last about a day, and our server logs are overwritten as new ones are written. • Error reports from our servers, which can include your account ID: up to 90 days. • Usage statistics: up to 14 months. Crash reports: 90 days. • Backups: we back up our database every week and keep each backup for up to 12 weeks. Data you delete is removed from our live systems within 24 hours, but can stay in a backup until that backup is replaced.

You can delete your account at any time in Settings > Account > Delete account, or by writing to [email protected]. When you do: • You are signed out on every device, and your sign-in details are unlinked straight away, so signing in again starts a brand-new account. • Within 24 hours we delete your account and everything in it: your profile and picture, your prayer history and settings, your posts, replies and photos, your prayers, likes and bookmarks, your Catholic AI conversations, your feedback and reports, and your direct messages. Deleting a conversation removes it for the other person too. • If you own a circle, it is closed for everyone in it. If you own a group, it is handed to another member, or closed if nobody else is in it. • When you delete in the app, your guest ID is removed from your phone and from iCloud. A few things are not part of your account and so remain for a while: • Copies in our weekly backups, for up to 12 weeks. • Notifications other people have already received about something you did, until they are cleared out with their older notifications. • Usage statistics and crash reports, which are not linked to your account, and error reports from our servers, for the periods in section 13. • The purchase history RevenueCat keeps for us, and the records Apple and Google keep of your purchases under their own policies. If we have banned an account for breaking our Terms of Use and it is then deleted, we keep only what is needed to stop it being opened again: the Apple, Google, email and device identifiers it signed in with, and the reason for the ban.

You can ask us to: • give you a copy of your data, • correct it (you can change most of it yourself in the app), • delete it (section 14), • limit how we use it, or stop a use that relies on our legitimate interests, • give it to you in a commonly used format, so you can take it to another service. You can withdraw your consent at any time, without affecting what happened before: notifications in the app or in your phone’s settings, location in your phone’s settings, and Catholic AI or anything else by writing to us. Automatic safety checks can stop a post or picture from appearing. You can ask for a person to review that decision. To use any of these rights, write to [email protected] from the email address on your account, or tell us your username. We may ask you to confirm that the account is yours. We reply within one month. If you are unhappy with how we handle your data, please tell us first. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority where you live. We don’t sell your personal information or share it for targeted advertising, so there is nothing you need to opt out of.

• Everything between the app and our servers travels encrypted (HTTPS). • Direct messages and the pictures in them are encrypted when we store them (AES-256-GCM), with keys we manage. This is not end-to-end encryption: we can read a message when we need to, for example when it is reported or when the law requires it. • Copies of reported messages and posts are encrypted the same way. • We store only a scrambled (hashed) form of your sign-in token, and we limit repeated attempts to sign in with an email code. • Only the people who run Prayla can see account details, and only to support you and keep the community safe. No system is perfectly secure. If something happens that puts your data at risk, we will tell the data protection authority and, where the law requires it, you.

When we change this policy, we update the date at the top of this page. If a change affects you in an important way, we will also tell you in the app.

For questions or requests about your privacy: Email: [email protected] Post: Prayla, Justyn Jóźwiak, ul. Dunikowskiego 11, 02-793 Warszawa, Poland Website: https://prayla.app/support