Privacy Policy

Last updated: November 5, 2026

In short

• No account, no login, no ads, and we don’t sell data.
• What you write in the app (notes, prayers, highlights, and saved verses) stays on your phone.
• We never ask your age.
• What leaves your phone is the minimum the app needs to work, and each case is explained below. Error reports only go out if you turn them on.

Who handles your data

Fervor is published by the seller shown on the app’s page in the App Store and on Google Play, who decides how the data described here is handled (the “controller” under Brazil’s General Data Protection Law, the LGPD).

What stays on your phone

Settings (language, theme, and times), notes, the prayers you write, highlights, saved verses, your progress, and your medals are stored on the device. We don’t have a copy. If you delete the app, they’re deleted with it; your iCloud or Google backup may keep a copy, depending on your phone’s settings.

The reminders you choose are scheduled on the phone itself and don’t go through our server.

What leaves your phone, and why

App content

To download readings, episodes, audio, images, and the app’s settings, your phone sends requests to our server, on Cloudflare. These requests don’t include your name or any code tied to you. When you open a chapter from a Bible translation that isn’t built into the app, the request includes only the chapter reference.

As with any internet connection, Cloudflare receives your device’s IP address to deliver the response and protect the server. We don’t store IP addresses in our database. The server’s technical logs may contain the IP and are deleted within 7 days.

App updates

The app checks Expo’s update service, in the United States, to download fixes. The request includes the app version, your device’s operating system, and a random installation code created by that service. It doesn’t include your name.

Subscription

The subscription is bought through the App Store (Apple) or Google Play. We don’t receive your card details or your email.

To know whether your subscription is active, the app uses RevenueCat, in the United States. It receives from the store the purchase history of this store account, tied to a random code created in the app by RevenueCat (not to your name), plus technical details such as the device’s operating system, the app version, and the store country.

When there’s a billing problem, RevenueCat notifies our server. The notice includes the subscription’s random code and purchase details; our server uses only the type and the time, so we know about the problem, and stores nothing.

If you open the app through a content creator’s link or type in their code, that code stays on the device and is sent along to RevenueCat, so we know how many subscriptions came from each creator.

Error reports (only if you turn them on)

They’re off by default. If you turn on “Send error reports” (on the “Your privacy” screen right after you subscribe, or in Me › Settings), when the app crashes it sends a technical report to Sentry, in the United States: the error, the app version, the device model and operating system, the last screens opened, the last web addresses the app called, and a random installation code created by Sentry. The report doesn’t include your name, what you write, or screenshots. Sentry receives the IP address when the report arrives and doesn’t store it. Reports are kept for up to 90 days.

You can turn them off anytime, in the same place. If your phone’s system shows you’re under 18, nothing is sent.

Usage statistics

The “Your privacy” screen has a “Send usage statistics to improve the app” switch, which is off by default. In this version, the app doesn’t send statistics: even with the switch on, the records stay on the device. We’ll update this policy before we start sending them.

Report a problem

If you use “Report a problem” (under ⋯ in a study, the session, or an episode), the app sends the following to our server: what was reported (its type and reference), the language, the reason, the text you write (optional, up to 280 characters), the app version, and two random codes, one for the reported content and one that changes every day. They let us count different devices and limit abuse without identifying anyone. The report doesn’t include your name or a device code, and the IP isn’t stored.

Our team reads reports through our work tools on GitHub, in the United States. We delete a report 12 months after it’s resolved; if it’s never resolved, we delete the text you wrote 12 months after you sent it. Backup copies are gone within another 8 weeks, and copies in our GitHub tools within 90 days.

Images you save

If you save an image from the app, the only permission requested is to add photos. The app doesn’t read your photos.

Community features (only if you use them)

When they’re available on your device, the features below only send data if you use them.

Challenges

When you tap “I’m in” during the app’s introduction, or “Join the challenge”, the app adds 1 to the total number of participants, without sending any code or identifier. You can turn this off in Me › Settings, under “Count me in the total”. People the system shows as under 18 aren’t counted. Your medal and progress stay on the device.

Prayer network

If you ask for prayer, your request leaves your phone. Before that, we ask for your consent, because a prayer request reveals your faith and may mention your health, and the law treats that as sensitive information.

• What we send: the text of your request, your first name (if you add it), the flag of your store account’s country, a random code for this device used only for the network (not your name or number) and, if you allow network notifications, your notification token and time zone. This is kept on our server, on Cloudflare. To check your subscription, the app also sends the random RevenueCat code (the same one described under Subscription), which we check on the spot and don’t store.
• AI check: the text and the name are read by Anthropic’s artificial intelligence, in the United States, which takes out names, contact details, links, and requests for money, blocks offensive content, and translates between Portuguese and English. Anthropic deletes this text within 30 days and doesn’t use it to train models; if its safety systems flag the text as violating its rules, it may keep it for up to 2 years.
• Who sees it: up to three people who use the app, with your first name and the flag. Requests that the check marks as suitable for everyone may also be read by people under 18. No one sees the device code. Our team only reads a request when it’s reported.
• How long: your request is deleted 30 days after it’s sent, or sooner, when you delete it. It disappears from our backups within another 30 days.
• If a request mentions a risk to someone’s life: it isn’t posted or stored (it only goes through the check), and we show crisis lines right away.
• Report and block: when you report a request, the app sends the reason and the request’s identifier; when you block, an opaque code for the person who asked, without a name. We keep the report, with the reporter’s code (so each person counts only once), for 30 days. If someone is banned for breaking the rules, we keep a digest of their code for 12 months, even after “Delete all”, only to keep the ban in place; that digest also stays in our backups for up to another 8 weeks.
• Automated decisions: if the check blocks your request, you can ask for a person to review it, through our contact email, which is being set up and will appear at the end of this page.
• Network notifications: they’re sent through Expo and Apple, in the United States, and never include the text of your request or names.
• If you only pray for others, you don’t get a community code. To check your subscription, the app sends the random RevenueCat code (the same one described under Subscription). We check it on the spot and don’t store it. For people 18 and older, we keep a one-day digest of that code, which changes every day, only to enforce the limit of requests each person receives to pray for. The app also sends whether you’re an adult or not (see Age) and the list of people you’ve blocked (opaque codes, without names). The list of requests you’ve already seen never leaves your phone.
• Your controls: in Me › Prayer network you can see what’s stored, delete a request, leave the network and delete everything (“Leave the network and delete my data”), or delete all community data, including the code stored on the device (“Delete all community data”). Withdrawing consent means leaving the network. That screen also has the “Code for privacy requests”, for a privacy request when you don’t have your phone (see Your rights).
• Minors: people the phone’s system shows as under 18, or whose age the system doesn’t share, can only pray: they don’t send requests, names, or a community code.

This device’s code stays on the iPhone even if you delete the app, and it’s included in backups. To delete it, use “Delete all community data” before removing the app. On our server, the code is deleted within 45 days after it was last used.

Age

We never ask your age. The app may ask your phone’s system (on an iPhone with iOS 26 or later, or through Google Play) for just one thing: whether you’re 18 or older. The answer stays on the device. If you use the prayer network, the app tells our server only whether you’re an adult or not (never your age range), to choose which requests you can receive; that mark is stored with the request you received to pray for and deleted along with it.

If the system shows you’re under 18, the app doesn’t send statistics or error reports, doesn’t show the text box in “Report a problem”, doesn’t let you post in the community, and uses protected quiet hours for notifications. If the system doesn’t share your age, the app also doesn’t let you post in the community and uses protected quiet hours.

What we don’t do

• We don’t show ads, use an advertising identifier, or track you across apps or websites.
• We don’t sell or share data for advertising.
• We don’t access your location, contacts, camera, or microphone.
• Nothing you write in the app goes to artificial intelligence, except the text of a prayer network request, if you use the network.

Where your data is kept

The services we use are outside Brazil, mostly in the United States:

• Cloudflare: our server, our database (in North America), and the app’s content.
• Expo: app updates and, in the prayer network, notifications.
• RevenueCat: your subscription.
• Apple and Google: the stores, payments and, on iPhone, notification delivery.
• Sentry: error reports, only if you turn them on.
• Anthropic: the check of prayer network requests, only if you use the network.
• GitHub: our work tools, where the team reads reports.

These services handle the data to provide their service to us, and we require each of them, by contract, to protect your data at least as well as this policy describes. International transfers follow the LGPD (articles 33 to 36); in the prayer network, we also ask for your specific consent.

Your rights

You can ask us to confirm whether we handle data about you and give you access to it, correct it, anonymize, block, or delete what isn’t needed, give you a portable copy, delete what we handle based on your consent, tell you who we share it with, and have a person review an automated decision. You can also withdraw your consent at any time. If you’re in Brazil, you can also complain to the National Data Protection Authority (ANPD).

Since there’s no account, the most direct way is the app itself: the switches in Me › Settings and the controls in Me › Prayer network. Without your phone and without a code, we have no way to find your data, and it’s deleted automatically within the time limits in this policy.

The email for privacy requests is being set up and will appear at the end of this page.

How to delete

• On your phone: deleting the app deletes everything in it, except the community code (see Prayer network).
• Error reports: turn off the switch; reports already sent are gone within 90 days.
• Reports of problems: they aren’t tied to you; a report is deleted 12 months after it’s resolved, and the text of an unresolved report, 12 months after it was sent.
• Prayer network and challenges: with the controls in Me › Prayer network and in Me › Settings.
• Subscription: the purchase history stays with Apple or Google, under their rules. At RevenueCat, it’s tied to a random code, without your name.

Security

All of the app’s communication uses an encrypted connection (HTTPS). Access to our systems is limited to our team. We keep the minimum and delete it within the time limits above.

Changes to this policy

When we change this policy, the date at the top changes. If the change is important, we’ll let you know in the app before it takes effect.

Contact and data protection officer

The contact address for our data protection officer (LGPD, article 41) is being set up and will appear here and on the Contact page. Until then, for a mistake in the content, use “Report a problem” in the app.