Privacy Policy — SpiritPal

SpiritPal Privacy Policy

Effective date: 20 August 2026 Last updated: 7 September 2026

SpiritPal ("SpiritPal", "the app", "we", "us") is a Christian pastoral companion for iPhone, iPad and Android. This policy explains, in plain language, exactly what the app does with what you write, where each piece of information lives, and what you can do about it.

Controller / publisher: Fevzi Emre Karahan Country of establishment: Türkiye Electronic service and privacy contact: support@spiritpal.online

SpiritPal is operated independently from Türkiye. A postal service address will be supplied to a verified requester or competent authority where applicable law requires postal service. No EU or UK representative has been appointed because SpiritPal does not currently have an establishment, office or representative in those territories.

1. The short version

You do not need an account to use SpiritPal. Sign-in is optional and exists for one reason only: to sync your saved verses between your devices.
Your journal entries, guidance answers and conversation history are stored only on your phone. We do not keep a copy on any server.
The text you write in Guide is sent to OpenAI to produce the answer. This is the most important disclosure in this policy and it is explained in full in section 3. If you choose to write about anxiety, symptoms or another aspect of your mental or physical health, that health information is included in the text sent for the answer.
Your first Free AI guidance answer on an installation is free and ad-free. From the second AI request onward, before your text is sent or any AI request begins, you choose either one rewarded Google AdMob ad for that answer or SpiritPal Plus. Ads never start automatically. Closing the choice, or closing or skipping the ad, keeps your draft on your device and grants no answer credit. Refusing personalised ads or Apple tracking permission does not remove a completed ad's reward.
Your writing and spiritual choices are never sent to Google or an advertiser. The ad request does not include your message, journal, AI answer, Christian tradition, Bible translation, crisis signal or health or religious information. Google Mobile Ads processes the limited device and ad interaction data described in section 8.
We never see your payment details. SpiritPal Plus is an optional subscription bought through Apple or Google. They take the payment; we use RevenueCat to check subscription status. When the subscription SDK is configured, it creates a random app-specific identifier and contacts RevenueCat even before a purchase. If you sign in, the app connects that RevenueCat record to your Supabase user ID so Plus works across sessions and devices. Purchases and restores also send receipt information. RevenueCat uses these records to provide and restore access and to produce subscription analytics. No card number, billing address or name ever reaches us.

2. What SpiritPal stores on your device only

The following never leaves your phone unless you deliberately share it (for example with the system share sheet):

What	Where it is kept
Your spiritual journal entries and the guidance answers prepared for them	Local app database (Hive; protected by the operating system, without a separate app encryption key)
Your conversation history in Guide (most recent messages)	Local app database
Your guided-plan progress and daily rhythm history (steps taken, evening examen)	Local app database
Your chosen Christian tradition, language, theme, text size and reminder time	Local app database / local preferences
Saved verses, when you are signed out	Local app database
Downloaded Bible chapters and translation bundles	Local cache (clearable in Settings → Storage)

Deleting an entry removes the current local copy. Uninstalling normally removes the app’s local data, but existing operating-system backups may keep an older copy and restore it later (see section 15). SpiritPal does not synchronize this local writing to its servers; text submitted for guidance or reporting is handled as described in section 3.

3. What you write in Guide, and the role of OpenAI

This is the part that matters most, so it is stated plainly.

When you write something in Guide — a burden, a question, a journal entry, a reflection on a guided-plan day — and ask for guidance, the app sends that text over an encrypted connection (HTTPS) to our backend function hosted on Supabase, which immediately forwards it to the OpenAI API to generate the pastoral answer.

You decide what to write. The text may reveal mental or physical health information, such as anxiety, distress or symptoms, if you choose to include it. SpiritPal does not ask for a medical record, build a health profile, or read data from health services, device sensors or health permissions. The health information in your message is used only to prepare the guidance you requested.

Alongside your text, the request includes only what the model needs to answer well:

the Christian tradition you selected (Catholic, Orthodox, Protestant or General);
your app language;
the identifier of the Bible translation you are reading (for example EN-BSB), so the answer links to a translation you actually have;
whether the request is a conversation turn or a journal reflection;
up to the last few turns of the current conversation, so the answer follows what you already said.

What we do not do with it: our backend does not write the text of your message, your journal entry or the model's answer into any database. It is held in memory for the length of the request and then discarded. The finished answer is returned to your phone and stored there.

OpenAI's role: OpenAI processes this text on our instructions as a sub-processor in order to produce the answer. Under OpenAI's API terms, content submitted through the API is not used to train its models by default. OpenAI may retain API request data in abuse-monitoring logs for up to 30 days before deleting it, unless law or a security investigation requires longer retention. OpenAI's own policies govern that processing; see <https://platform.openai.com/docs/models/default-usage-policies-by-endpoint> and <https://openai.com/enterprise-privacy/>.

Please write accordingly. Because your words are transmitted for processing, do not include information you would not want to leave your phone at all — other people's names and identifying details, financial or medical record numbers, or anything you are not free to disclose. SpiritPal works perfectly well if you describe a situation without naming the people in it.

3.1 What our backend does record

For rate limiting (SpiritPal allows 20 guidance requests per hour) and for basic reliability monitoring, our backend writes a short technical event for each request. That event contains:

a SHA-256 hash derived from your verified user ID when signed in, or your network address when signed out. This is a pseudonymous rate-limit identifier; the raw token and network address are not written to this log;
the HTTP status code, the model name, and how long the request took;
non-content flags such as "was the answer repaired", "how many prior turns were included", and whether a rate limit was hit.

It does not contain your message, your journal text, or the model's answer. These diagnostic events are retained for up to 90 days and then deleted, except where a particular event must be preserved for an active security investigation or legal obligation.

For a Free rewarded-ad answer, the backend also creates a short-lived opaque challenge and validates the ad reward before issuing a one-use answer ticket. The related anti-fraud record contains a network hash, random identifiers and technical reward details such as the ad unit, reward amount, transaction identifier and time. It does not contain the raw network address, anything you wrote, your tradition, the AI answer or an advertising profile. These records are kept for up to 90 days to prevent the same reward being used twice and to investigate delivery failures.

To keep the first Free answer to one per installation, Supabase also stores a small durable claim marker: a SHA-256 hash derived only from SpiritPal's random installation ID, together with a challenge link and timestamps. It contains no writing, answer, advertising ID, account ID, raw installation ID or network hash, and the same marker applies across sign-in, sign-out and account changes. The hashed marker remains while this one-time offer operates because removing it would let the same installation repeatedly claim the first answer.

3.2 When you report a response

Every AI answer in SpiritPal carries a Report action, and the same action sits in Settings. Reporting is the one place where guidance text is deliberately sent to us, so it is worth being exact about what a report contains:

the reason you picked and any note you wrote;
the answer you are reporting, so we can see what you saw;
the language, app version and platform. New reports do not include a separate Christian-tradition identifier; the text you choose to send may still reveal religious beliefs;
your user ID, only if you were signed in. Reporting works signed out, and an anonymous report carries no user ID at all.

What you wrote is not included unless you tick the box for it. Your journal stays on your device by default, and a report does not change that on its own.

Reports are readable only by us — they are not visible to other users, and the app cannot read back reports at all. Open reports are kept while they are being investigated. Closed reports are deleted or anonymised within 24 months, unless we must keep a particular report longer to establish, exercise or defend a legal claim or to answer a regulator.

4. Optional account and saved-verse sync

You can use every feature of SpiritPal without an account.

If you choose to sign in, we use Supabase Auth with an email address and a password. In that case:

We store your email address, a user ID, and standard authentication timestamps on Supabase.
Your password is stored only as a salted hash. We never see it.
Only your saved verses sync. A synced saved verse consists of the reference, the verse text of a public-domain or open-licensed translation, the translation, the date you saved it and any short commentary attached to it.
Signing in does not upload your journal entries, your conversation history, your rhythm history or your plan progress. Those stay on the device.
Email is also used to send you transactional messages you asked for: the sign-up confirmation link and the password-reset link. There is no marketing email.

5. Bible text and the verse of the day

SpiritPal reads Scripture from public-domain and open-licensed translations that are downloaded as bundles from our content host, and it fetches a verse of the day from our Supabase project. These requests carry the translation identifier and the language you are reading in, together with the technical information any internet request carries (such as your IP address, which the hosting providers process to deliver the response). They do not carry anything you wrote.

Translation licences and attributions are listed in the app under Settings → Translation licenses.

6. Crash reports

Release builds of SpiritPal include Sentry crash reporting, and only when a Sentry key has been configured for the build. When the app hits an unexpected error, Sentry receives a crash or error report containing the error and stack trace, the app version, the device model, the operating system version, and a technical breadcrumb trail of the actions that led to the error. A small, sampled share of performance traces (response times of app operations) is sent for the same purpose.

Crash reports are used only to find and fix bugs. No journal text, no conversation text and no guidance answers are attached to them.

7. Notifications

If you turn on the daily reminder, SpiritPal schedules a local notification on your device at the time you choose. It is created and fired by your phone. There is no push server, no push token, and no third-party push service — we cannot see whether it fired or whether you opened it. Turning the reminder off in Settings, or revoking the notification permission in your system settings, cancels it.

8. Rewarded ads, privacy choices and Google Mobile Ads

The first Free AI guidance answer on an installation is free and ad-free. From the second request onward, before your text is sent or any AI request begins, SpiritPal shows a clearly labelled choice between watching one rewarded ad for that answer and opening SpiritPal Plus. Ads never start automatically. The reward is granted only after the ad provider confirms completion. Closing the choice, or closing or skipping the ad, gives no answer credit and keeps the text you drafted on your device. Plus users receive AI guidance without ads. Scripture, journaling, saved verses, local plan content, settings and crisis resources do not require an ad.

SpiritPal uses the Google Mobile Ads SDK (AdMob) and Google's User Messaging Platform. When the SDK is used, Google may process:

an IP address and an approximate location inferred from it;
device and app identifiers, including the iOS advertising identifier (IDFA) only when Apple permits access;
ad impressions, views, clicks and other product interactions;
advertising data, crash data, performance data and other diagnostics.

Google uses this information to deliver ads, limit fraud and invalid traffic, measure ad performance and, only where the user has allowed it, personalise advertising. Its handling is described in the Google Privacy Policy and How Google uses information from sites or apps that use its services.

We do not use your private content to choose ads. SpiritPal does not send Google or any advertiser your message, journal, guidance answer, conversation, chosen Christian tradition, Bible translation, plan reflection, crisis result, health information or religious beliefs. The reward-validation value sent with an ad is an opaque, short-lived random challenge and contains no user content.

Where required, SpiritPal shows Google's consent choices before requesting an ad. On iOS it may also show Apple's App Tracking Transparency prompt. You receive the same ad reward if you refuse personalised advertising, choose "Do not consent", or deny tracking permission; those choices affect ad data use, not access to the reward. You can reopen Settings → Privacy → Ad privacy choices to change the Google choice. Apple tracking permission can be changed in iOS Settings. Users in applicable US states can choose Do not sell or share my data in the same privacy options.

If an ad appears inappropriate, use Report this ad after the ad or under Settings → Support. Include only the ad details needed for investigation; do not include private journal text.

SpiritPal does not import precise GPS location, contacts, calendar entries, photos, microphone recordings, camera data or structured medical records from your device or another service, and it does not collect payment-card or billing details. Health information you voluntarily include in Guide text is handled as described in sections 3 and 9. Store payments stay with Apple or Google. We do not sell or rent your journal, guidance text, account data or religious information, and we do not make automated decisions with legal or similarly significant effects.

9. Sensitive information

By its nature, SpiritPal handles information that reveals religious or philosophical beliefs, and what you write may also touch on your mental or physical health, including symptoms, your relationships or your sexuality. Under the GDPR this can be "special category" data; Google Play also classifies voluntarily submitted health or symptom details as Health info.

We process it only on the basis of your explicit consent, given by choosing a tradition and by sending text to be answered, and only for the single purpose of preparing the guidance you asked for. You can withdraw that consent at any time by stopping use of the Guide feature; it does not affect processing that already happened.

This sensitive information is kept separate from advertising. It is never sent to Google Mobile Ads, put into an ad reward token, or used to personalise or select an ad.

10. Legal bases (GDPR / UK GDPR)

Processing	Legal basis
Producing guidance from the text you wrote (including transfer to OpenAI)	Explicit consent for special-category data (Art. 9(2)(a)); performance of a contract for the service you requested (Art. 6(1)(b))
Storing your chosen tradition and preferences on the device	Art. 6(1)(b) and Art. 9(2)(a)
Account creation, sign-in, password reset, saved-verse sync	Performance of a contract (Art. 6(1)(b))
Rate-limiting hashes and technical event logs	Legitimate interests in keeping the service available and preventing abuse (Art. 6(1)(f))
Crash and error reports	Legitimate interests in a working, secure app (Art. 6(1)(f))
Subscription validation, restoration and aggregate subscription analytics through RevenueCat	Performance of a contract (Art. 6(1)(b)); legitimate interests in operating and understanding the paid service (Art. 6(1)(f))
Enforcing the one-time initial answer, showing a rewarded ad at your request and granting one Free answer	Performance of the service you requested (Art. 6(1)(b)); legitimate interests in preventing reward fraud and keeping the Free service available (Art. 6(1)(f))
Personalised advertising, advertising identifiers and consent storage where applicable	Consent (Art. 6(1)(a)). Refusal does not prevent the rewarded answer, and consent can be withdrawn in the privacy controls described in section 8
Reviewing a response you reported	Legitimate interests in detecting and correcting harmful AI output, and compliance with app-store safety obligations (Art. 6(1)(f)); explicit consent where you choose to attach what you wrote (Art. 9(2)(a))
Daily reminder notification	Consent (Art. 6(1)(a)), given by turning it on

10.1 Türkiye — KVKK

For users in Türkiye, Fevzi Emre Karahan is the veri sorumlusu under Law No. 6698 on the Protection of Personal Data (KVKK).

Ordinary account and service data is processed under the legal grounds in KVKK Article 5, including establishing or performing the service relationship, complying with legal duties, and the controller's legitimate interests where your fundamental rights and freedoms are not harmed.
Religious denomination, belief and similar information is özel nitelikli kişisel veri under KVKK Article 6. SpiritPal processes this data only when it is necessary to provide the guidance you specifically request and on the basis of your explicit consent. You may use the local Scripture, plan and rhythm features without sending Guide text.
Data sent to OpenAI and data processed by international infrastructure may be transferred abroad under KVKK Article 9. We rely on an applicable adequacy decision where available, otherwise on an appropriate safeguard permitted by Article 9 (including standard contractual clauses), and obtain explicit consent where an additional lawful basis is required.
Advertising data handled by Google is kept separate from the religious and health-related text used for guidance. Personalised advertising and access to an advertising identifier rely on the user's choice where consent is required; rejecting that choice does not remove the earned answer.
Under KVKK Article 11 you may ask whether we process your personal data; request information about processing and its purpose; learn recipients in Türkiye or abroad; request correction, deletion or destruction and notification of those steps to recipients; object to a result produced exclusively by automated processing; and claim compensation if unlawful processing causes damage.

Send a KVKK request to support@spiritpal.online from the email address linked to your account. Include your name, the right you want to exercise, enough detail to locate the relevant account, and a reply address. Do not send identity documents unless we ask for a narrowly necessary verification step. We answer valid applications as soon as possible and no later than 30 days. You may also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) after completing the statutory controller-application process.

11. Your rights

Wherever you live, you may contact us at support@spiritpal.online to ask for any of the following. If you are in the EEA, the UK or Switzerland, these are rights under the GDPR; if you are in California, the equivalents under the CCPA/CPRA apply, including the right not to be discriminated against for exercising them.

Access — a copy of the personal data we hold (in practice: your account record, synced saved verses, and the subscription record processed through RevenueCat when Plus is configured).
Rectification — correction of inaccurate data.
Erasure — deletion of your account and synced data (see section 12).
Restriction and objection — including objection to processing based on legitimate interests.
Portability — a machine-readable export of the data you provided.
Withdrawal of consent — at any time, without affecting past processing.
Complaint — you may lodge a complaint with your local data protection supervisory authority.

We answer requests within 30 days. Please write from the email address on the account so we can verify the request; we do not collect any other identifier that would let us verify it.

Because journal entries, chat history and rhythm data exist only on your device, we cannot access, export, correct or delete them for you — but you can, at any moment, by deleting the entry or the app.

California privacy rights

If the CCPA/CPRA applies to you, you may request to know, correct or delete the personal information we hold and may receive it in a portable format. You may also limit the use or disclosure of sensitive personal information where the law provides that right, and you will not be discriminated against for exercising a privacy right. SpiritPal does not sell your journal, guidance text, account data or religious information. Google Mobile Ads may use or disclose device and ad-interaction data for advertising where permitted by your choice. The in-app Ad privacy choices screen therefore includes Do not sell or share my data for users in applicable US states. Choosing it does not reduce the rewarded answer. We do not knowingly sell or share the personal information of users under 16.

12. Deleting your account

In the app: Settings → Account → Delete account, then confirm.

This permanently deletes your Supabase authentication account and every saved verse that had been synced to it. It cannot be undone. Journals and other data stored on your device are not affected by it — delete them in the app or remove the app to clear them. Account deletion does not remove or reset the hashed first-Free-answer marker: it is derived only from the app's random installation ID and is not linked to the optional account, as described in sections 3 and 13.

Deleting your SpiritPal account does not cancel an App Store or Google Play subscription. Cancel or manage Plus in your store account. To request deletion of the app-specific subscription record processed through RevenueCat, email support@spiritpal.online; store transaction records may still be retained by Apple or Google under their own legal and accounting obligations.

Deleting the SpiritPal account also does not by itself reset advertising choices or data held by Google. Use Settings → Privacy → Ad privacy choices, your device's tracking/privacy controls, and Google's own privacy controls for those records.

If you cannot reach the in-app control (for example you lost the device), email support@spiritpal.online from the address on the account and we will delete it for you.

One thing survives deletion, in anonymised form: if you had reported an AI answer (section 3.2), the report itself is kept, but the link to your account is severed at deletion — it is left with no user ID, exactly like an anonymous report. We keep it because it is a record of *our* output being wrong or harmful, and we may need to show a reviewer or regulator how it was handled.

13. Retention

Data	Kept for
Account record (email, user ID)	Until you delete your account
Synced saved verses	Until you unsave the verse or delete your account
Text sent for guidance	Not stored by us; held only for the duration of the request. OpenAI's limited abuse-monitoring retention applies on its side
Backend technical events (hashed key, status, latency)	Up to 90 days, unless preserved for an active security or legal matter
Reward challenges, one-use answer tickets and AdMob reward transaction metadata	Up to 90 days, unless preserved for an active fraud, security or legal matter; no user writing is included
Hashed marker that the one-time initial Free answer was claimed	While the one-time offer operates, as a minimal abuse-prevention record across sign-in, sign-out and account changes. It is derived only from SpiritPal's random installation ID and contains no writing, raw installation ID, account ID, network hash or advertising identifier
Reports you file about an AI answer	While open; closed reports deleted or anonymised within 24 months unless legally needed longer
Crash and error reports	Up to 90 days when Sentry is configured, subject to the active Sentry project settings
RevenueCat app-user ID and purchase history	While needed to validate, restore and administer Plus, then deleted or anonymised when no longer required; you may request deletion through support, subject to transaction records Apple or Google must retain
Google Mobile Ads device, consent and ad-interaction data	According to Google's retention controls and legal obligations; manage consent in SpiritPal and tracking in device settings
Current local app data	Until erased from this device; existing OS backups may retain an older copy (section 15)

14. Processors and international transfers

We use these processors, and no others:

Processor	What it handles	Where
Supabase	Authentication, saved-verse sync, verse-of-the-day, the backend function that relays your text	European Union (Ireland)
OpenAI	Generates the pastoral answer from your text (sub-processor, section 3)	United States
Sentry (only when configured)	Crash and error reports	The region configured for the active Sentry project
Cloudflare	Serves downloadable Bible translation bundles and protects/delivers web content	Global edge network
RevenueCat (when the subscription SDK is configured)	Validates and restores App Store or Google Play access and provides aggregate subscription analytics; receives a random app-specific identifier, connects it to the Supabase user ID if you sign in, and processes receipt information for purchases and restores; never your card details or your writing	United States
Google (AdMob / User Messaging Platform)	Shows rewarded ads to Free users, records privacy choices, measures ads and validates rewards; may process approximate location, device identifiers, ad interactions and diagnostics, but never receives the user's writing, tradition or guidance answer from SpiritPal	Global infrastructure; transfers may include the United States
Have I Been Pwned (only when you set a password)	Receives the first five characters of your password's SHA-1 hash so the app can warn you if that password appears in a known breach. It is a shared prefix, not your password: tens of thousands of different passwords produce it, the matching happens on your device, and HIBP is never told whether a match was found	United Kingdom

If you are in the EEA, the UK or Switzerland, some of this processing takes place in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) in our agreements with each processor.

15. Security

All traffic between the app and our services uses HTTPS/TLS. App data on your device is stored in the operating system's app sandbox. Device encryption protection depends on your device and security settings. Hive does not use a separate encryption key managed by SpiritPal. Access to our backend is limited to the maintainers of the project. Device backups or transfers may include local app data according to your operating system and backup settings; SpiritPal does not currently exclude its local writing from those backups. Erasing writing removes the current device's copy, not copies already present in a device backup. A restored backup may bring that older writing back. Manage or delete those backups through your device provider's controls.

Passwords are stored only as salted hashes by Supabase Auth. No system is perfectly secure, and we do not claim otherwise; if a breach ever affects your personal data we will notify you and the relevant supervisory authority as required by law.

16. Children

SpiritPal is not directed to children. You must be at least 13 years old to use it, or at least 16 if you are in a country where local law sets that as the minimum age for consenting to online services. We do not knowingly collect personal data from children below that age. If you believe a child has created an account, write to support@spiritpal.online and we will delete it.

The AdMob account is limited to PG ad content, and sensitive categories such as dating, sexual references, sensational ads, social casino games, alcohol and gambling are blocked. SpiritPal is not enrolled in a children-directed ads programme and does not knowingly request personalised ads for a child.

17. SpiritPal is not counselling, medicine or church authority

SpiritPal offers spiritual companionship and reflection. It is not a medical device and does not diagnose, treat, cure or prevent any medical condition. It is not therapy or medical care, and it is not a substitute for a qualified healthcare professional or for your priest, pastor or church. The guidance you read is generated by an AI model and can be wrong.

In an emergency, or if you are in danger or thinking of harming yourself, contact your local emergency services or a trusted person near you immediately.

18. Changes to this policy

If we change what SpiritPal does with your data, we will update this page and move the effective date at the top. Material changes will also be described in the release notes of the version that introduces them.

19. Contact

Questions, requests or complaints: support@spiritpal.online

For a privacy request, use the subject “SpiritPal Privacy Request” and state your country, the account email (if any), and the right you want to exercise. We will request only the minimum additional information needed to verify the request.

Optional product measurement

In builds that include this setting, product measurement is off until you enable it in Settings. With consent, SpiritPal sends app openings, a random measurement-only token, a session identifier, platform and app version to our existing Supabase infrastructure. This token is separate from accounts, advertising identifiers and AI access identifiers. No reading, chat, journal, religious preference, health information or content is included. Records are retained for at most 90 days. Consent expires and must be granted again; it is not silently renewed. Turning the setting off stops collection immediately and requests deletion of the associated records. Offline deletion is retried when the application reconnects. These optional measurements let us count consenting active installations, sessions, versions and return visits. Declining has no effect on reading, guidance, accounts or subscriptions.