Privacy policy.

1. An overview of data protection

General information

The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term “personal data” comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which we have included beneath this copy.

Data recording on this website

Who is the responsible party for the recording of data on this website (i.e., the “controller”)?

The data on this website is processed by the operator of the website, whose contact information is available under section “Information about the responsible party (referred to as the “controller” in the GDPR)” in this Privacy Policy.

How do we record your data?

We collect your data as a result of your sharing of your data with us. This may, for instance, be information you send us by e-mail.

Other data shall be recorded by our IT systems automatically or after you consent to its recording during your website visit. This data comprises primarily technical information (e.g., web browser, operating system, or time the site was accessed). This information is recorded automatically when you access this website.

What are the purposes we use your data for?

A portion of the information is generated to guarantee the error free provision of the website. Other data may be used to analyze your user patterns. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders or other order enquiries.

What rights do you have as far as your information is concerned?

You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency.

Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues.

Analysis tools and tools provided by third parties

There is a possibility that your browsing patterns will be statistically analyzed when you visit this website. Such analyses are performed primarily with what we refer to as analysis programs.

For detailed information about these analysis programs please consult our Data Protection Declaration below.

2. Hosting and Content Delivery Networks (CDN)

We are hosting the content of our website at the following provider:

External Hosting

This website is hosted externally. Personal data collected on this website are stored on the servers of the host. These may include, but are not limited to, IP addresses, contact requests, metadata and communications, contract information, contact information, names, web page access, and other data generated through a web site.

The external hosting serves the purpose of fulfilling the contract with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfill its performance obligations and to follow our instructions with respect to such data.

We are using the following host(s):

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Cloudflare

We use the “Cloudflare” service provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter referred to as “Cloudflare”).

Cloudflare offers a content delivery network with DNS that is available worldwide. As a result, the information transfer that occurs between your browser and our website is technically routed via Cloudflare’s network. This enables Cloudflare to analyze data transactions between your browser and our website and to work as a filter between our servers and potentially malicious data traffic from the Internet. In this context, Cloudflare may also use cookies or other technologies deployed to recognize Internet users, which shall, however, only be used for the herein described purpose.

The use of Cloudflare is based on our legitimate interest in a provision of our website offerings that is as error free and secure as possible (Art. 6(1)(f) GDPR).

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details and further information on security and data protection at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/5666.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.

Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Data Protection Declaration explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected.

We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.

Information about the responsible party (referred to as the “controller” in the GDPR)

The data processing controller on this website is:

Phone: 0163 / 6858806
E-mail: hello@getbiblering.com

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).

Storage duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General information on the legal basis for the data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data are processed according to Art. 9(1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to the access to information in your end device (e.g., via device fingerprinting), the data processing is additionally based on § 25(1) TDDDG. The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.

Recipients of personal data

In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is required as part of the fulfillment of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of this data. When using processors, we only disclose personal data of our customers on the basis of a valid contract on data processing. In the case of joint processing, a joint processing agreement is concluded.

Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)

Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

Information about, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time.

Right to demand processing restrictions

You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time. The right to demand restriction of processing applies in the following cases:

• In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
• If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data instead of demanding the eradication of this data.
• If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
• If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line.

If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.

4. Recording of data on this website

Server log files

The provider of this website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• The type and version of browser used
• The used operating system
• Referrer URL
• The hostname of the accessing computer
• The time of the server inquiry
• The IP address

This data is not merged with other data sources.

This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.

Your choice of language

This website is available in English, under /de in German and under /es in Spanish. If you choose a language in the language switcher, the website remembers that choice in your browser’s local storage (localStorage, under the key “lang”, for example with the value “de”), so that it shows you the website in that language the next time. The value is set only when you use the switcher, it is never sent to us or to anyone else, and it is used for nothing else. On your first visit to an English page, the website reads your browser’s language setting and, if your browser prefers German or Spanish, shows you the page in that language instead; nothing is stored for that.

Storing and reading this value is strictly necessary to provide a service you have explicitly requested, the website in the language you chose, so no consent is required (§ 25(2) no. 2 TDDDG). Insofar as personal data is processed, this is based on our legitimate interest in showing you the website in your language (Art. 6(1)(f) GDPR). You can delete the value at any time by clearing the stored website data for this site in your browser.

Request by e-mail, telephone, or fax

If you contact us by e-mail, telephone or fax, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.

These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

5. Analysis tools

Umami

This website uses Umami, a privacy-friendly, open-source web analytics tool. Umami sets no cookies, stores no information in your browser and builds no profile of you.

For every visit, only the following anonymous usage data is recorded: the pages viewed, how long a visit lasts, the referrer (the page that linked here), the browser, operating system and type of device used, the screen size and language, and the approximate location of the visit (country and, where it can be determined, region and city). Your IP address is used only for a moment to work out that location and is not stored. None of this data can be attributed to an individual person.

Session replay and heatmaps

For a random sample of visits, Umami also records how the pages are used: mouse movements, clicks and scrolling, together with the page as it was shown on your screen. This lets us replay such a visit and see, across many visits, where people click and how far they scroll (heatmaps). Anything typed into a form field is masked in your browser before it is sent. A recording stops after a few minutes, and it is tied only to Umami’s anonymous visit, never to a name, an e-mail address or an account.

Umami runs on our own server (self-hosting). The data is not passed on to third parties.

Umami is used on the basis of our legitimate interest in the statistical analysis of how this website is used, in order to improve it (Art. 6(1)(f) GDPR). Because Umami sets no cookies and stores nothing in your browser, consent under § 25 TDDDG is not required.

6. Our social media profiles

This privacy policy applies to the following social media profiles, all under the name @bibleringapp:

• Instagram: https://www.instagram.com/bibleringapp
• TikTok: https://www.tiktok.com/@bibleringapp
• X: https://x.com/bibleringapp
• Threads: https://www.threads.com/@bibleringapp
• Facebook: https://www.facebook.com/bibleringapp

The imprint applies to these profiles too. This website only links to them and embeds nothing from the networks, so nothing reaches them from here unless you follow one of those links.

Data processing by social networks

We maintain publicly accessible profiles on social networks. The individual social networks we use are listed below.

Social networks such as Facebook, X and others can usually analyze your user behavior in detail when you visit their website or a website with integrated social media content (e.g., like buttons or advertising banners). Visiting our social media profiles triggers numerous processing operations relevant to data protection. In detail:

If you are logged into your social media account and visit our social media profile, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, your personal data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case, the data is collected, for example, through cookies stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are or were logged in.

Please also note that we cannot trace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. Details can be found in the terms of use and privacy policies of the respective social media portals.

What we see

We see what you make visible to us on the platform: your public name and profile picture, your comments, likes and shares, whether you follow us, and messages you send us. We use this to answer you and to talk with people about BibleRing. The networks also give us statistics about our profiles (such as Insights on Facebook, Instagram and Threads and Analytics on TikTok), for example how many people saw a post. These statistics are aggregated and do not tell us who anyone is.

Legal basis

Our social media profiles are intended to ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which are to be specified by the operators of the social networks (e.g., consent within the meaning of Art. 6(1)(a) GDPR).

Controller and exercising your rights

If you visit one of our social media profiles (e.g., Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can in principle exercise your rights (information, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g., against Facebook). How to reach us is under “Information about the responsible party”.

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options depend largely on the company policy of the respective provider. A request that only the operator can answer is passed on to them without delay.

Storage duration

The data collected directly by us via the social media presence will be deleted from our systems as soon as you ask us to delete it, you revoke your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory provisions, in particular retention periods, remain unaffected.

We have no influence on how long the operators of the social networks store your data for their own purposes. For details, please contact the operators of the social networks directly (e.g., in their privacy policies, see below).

Your rights

You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have a right to object, a right to data portability and a right to lodge a complaint with the competent supervisory authority. Furthermore, you can demand the rectification, blocking or erasure of your personal data and, under certain circumstances, the restriction of its processing.

The social networks in detail

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter Meta). According to Meta, the collected data is also transferred to the USA and to other third countries.

We have concluded an agreement with Meta on joint processing (Controller Addendum). This agreement sets out which data processing operations we or Meta are responsible for when you visit our Facebook page. Under it, Meta bears the primary responsibility for the statistics about our page (Page Insights), informs you about them and enables you to exercise your rights. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transfer to the USA is based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://www.facebook.com/help/566994660333381.

Details can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/4452.

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Data transfer to the USA is based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://www.facebook.com/help/566994660333381.

Details on how they handle your personal data can be found in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/participant/4452.

Threads

We have a profile on Threads. The provider of this service is also Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta’s privacy policy applies to Threads, supplemented by terms for Threads: https://www.facebook.com/privacy/policy/.

Data transfer to the USA is based on the Standard Contractual Clauses of the EU Commission (https://www.facebook.com/legal/EU_data_transfer_addendum), and Meta is certified under the “EU-US Data Privacy Framework” (https://www.dataprivacyframework.gov/participant/4452).

X (formerly Twitter)

We use the short message service X (formerly Twitter). The provider is the parent company X Corp. in the USA. Responsible for processing the data of people in the European Union, the EFTA states and the United Kingdom is its subsidiary X Internet Unlimited Company (until March 2025 Twitter International Unlimited Company), One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

You can adjust your X privacy settings yourself in your user account. To do so, click on the following link and log in: https://x.com/settings/account/personalization.

Data transfer to the USA is based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://gdpr.x.com/en/controller-to-controller-transfers.html.

Details can be found in the privacy policy of X (formerly Twitter): https://x.com/en/privacy.

TikTok

We have a profile on TikTok. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Details on how they handle your personal data can be found in TikTok’s privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=en.

We are jointly responsible with TikTok for the statistics about our profile (TikTok Analytics). Who does what is set out in the TikTok Analytics Joint Controller Addendum: https://www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en. Under it, TikTok enables you to exercise your rights.

Data transfer to non-secure third countries is based on the Standard Contractual Clauses of the EU Commission. Details can be found here: https://www.tiktok.com/legal/privacy-policy?lang=en.

This policy covers the BibleRing app for iPhone and iPad, including its widgets and its Control Center buttons. It explains what the app keeps on your device, what it sends and to whom, on what legal basis, and how to say no. It is written for the GDPR and the German TDDDG first. What the app sends depends on your country (section 5), and sections 18 to 23 add what the laws of other countries ask for.

1. Who is responsible

The controller for the app, as for this website, is:

E-mail: hello@getbiblering.com
Phone: 0163 / 6858806

Any question about your data, and any request under this policy, can go to that address.

2. Your reading record: on your device, and in your iCloud if you choose

On your device

Everything you put into BibleRing is stored on your iPhone or iPad, in storage that belongs to the app and its widgets and that no other app can read:

• your reading record: which chapters you marked as read, the day each reading is dated to, when you logged it, whether it was something you had read before you started using the app, and any notes you wrote;
• your settings: the Bible you track (its canon), your reading plan and goal, your reminder time, how Home is arranged, the look you chose, and the app’s other preferences;
• your display name and profile photo, if you add them. The photo is chosen through the iOS photo picker, which hands the app only the one photo you pick, and it is cropped and made smaller before it is saved;
• what the app works out from all of that: your progress, achievements and recaps.

For the widgets, the app also keeps a small summary there (the percentage, the day’s passage, the next passage, your current run).

Your record itself is never sent to us. There is no account, and we have no copy of your record and no way to read it, which also means we cannot restore it for you. What reaches us, where your country allows it (section 5), is the statistics in sections 3 and 4, which include a few values worked out from your record (such as your percentage, and, in the detailed analytics only, the canon you chose) but never the record itself, and a note you choose to send us (section 6). The record leaves the device in only three other ways, all Apple’s and all under your control: in your own iCloud if you turn that on (below), in what Siri or Apple Intelligence handles when you ask them about your reading (below), and in a backup of your device (iCloud Backup, or a computer), which includes it like any other app’s data, under Apple’s terms and your own settings.

Storing this on your device is what the app is for, so § 25(2) no. 2 TDDDG allows it without consent: it is strictly necessary to provide the service you asked for. The same applies to the app remembering your answers about analytics (sections 3 and 4): when you decided and which version of the question you answered. That record stays even when you erase your reading data, because it is about what the app may send, not about your reading.

In your iCloud, only if you choose

The app asks whether to keep your record in iCloud as well: once while you set it up (or with “Bring my reading from iCloud” on its first screen), or later from a suggestion on Home or the Keep in iCloud switch in Settings › iCloud. It is off until you say yes, and saying no changes nothing else in the app.

If you say yes, everything in the list above — your reading record, notes, name, photo, settings and achievements — is also kept in your own iCloud, using Apple’s CloudKit: in the private database of the Apple Account you are signed in with, inside a container that belongs to BibleRing. That is what brings it back on a new device and keeps it the same on your other iPhones and iPads signed in to the same account. Changes travel between your devices through Apple’s servers, encrypted in transit and stored encrypted.

We cannot see any of it. CloudKit’s private database is readable only with your Apple Account; the tools Apple gives developers show us neither what is in it nor whose it is, and the app never sends it, or anything about it, anywhere else. Apple stores it under its own iCloud terms and privacy policy, as it does the rest of your iCloud data, and it counts toward your iCloud storage.

The parts that say what you read and who you are — the book, chapter and day of each reading, your notes, your name and photo, the Bible and the plan you chose, and your achievements — are kept in CloudKit’s encrypted fields. What that protects against depends on your Apple Account, not on the app. With Advanced Data Protection turned on, those fields are end-to-end encrypted: only your own devices hold the keys, and not even Apple can read them. Without it, Apple holds the keys, as it does for most iCloud data. The rest — your settings, and how long a reading took — is always stored with keys Apple holds. If you ever reset your end-to-end encrypted data, which iOS offers when you can no longer reach any of your devices or their passcodes, the encrypted fields in iCloud may be lost with it; the copy on any device that still has your record is not.

Legal basis: your consent, Art. 6(1)(a) GDPR. Which chapters you read and what you write beside them can say what you believe, so your yes is also your explicit consent under Art. 9(2)(a) GDPR. Storing and reading the record on your device to keep it in step with iCloud is part of the service you asked for by saying yes (§ 25(2) no. 2 TDDDG). You can take the consent back at any time, for the future, by turning off Keep in iCloud: syncing stops at once, and everything stays on the device. The copy already in iCloud stays there, not updated any more, until you delete it.

If you sign out of iCloud on a device, iOS may take the iCloud copy of your record off that device; it comes back when you sign in again.

Siri, Shortcuts and Spotlight

Unless you turn it off, the app adds the books of the Bible you chose and the readings you log — the passage and the day, never your notes — to the Spotlight index on your device, and tells iOS when you log a reading in the app. That is what lets a search for “Genesis” or “what I read in August” find them, and lets Siri suggest logging your reading around the time you usually do. iOS keeps the index and these signals on your device, and the app sends none of it to us. Turn it off in Settings › Privacy › Siri & Spotlight: the app removes what it added to the index and the signals it gave, and adds nothing more.

When you ask Siri, run a shortcut or press the Action button to log a reading or hear how far you are, the app does the work on your device and hands back the answer. A reading is logged only after you have seen it and confirmed it. Siri, and Apple Intelligence where you use it, handle your request under Apple’s own terms and privacy policy, on your device or, where Apple says so, on Apple’s Private Cloud Compute; nothing of it reaches us.

Like the record itself, the index stays on your device, so § 25(2) no. 2 TDDDG covers keeping it there: it is part of features of the app you use. Nothing is transferred to us or to anyone else through it.

Deleting it

Settings › Reading data › Delete all reading data removes every reading, with its notes, the achievements it earned, your name, photo and settings, and starts the app over. While Keep in iCloud is on, the deletion reaches iCloud too, and your other devices as they sync. To delete the copy in iCloud while the switch is off, turn it back on first, or remove it in iOS Settings › your name › iCloud › Storage › BibleRing. Deleting the app removes everything it stored on the device, but not the copy in iCloud.

3. Anonymous usage statistics (Aptabase)

To learn which parts of the app get used and where it goes wrong, the app counts what it is used for: that a screen was opened, a reading was logged, a setting was changed or an operation failed. Whether this runs depends on your country (section 5): in most countries it runs unless you switch it off, in some it waits for your yes, and in others it never starts.

What is sent

• The name of the event, with a few values the app already knows about itself: the reading plan you chose (a church’s own plan is never named), how far through the Bible you are as a percentage, your current run and how many days you have read, how many days ago the app was installed, whether reminders are on, whether you hold the Supporter unlock, your appearance choices, and, when you finish a book, which part of the Bible it belongs to and how long it is (never its name). Also how long a visit to the app lasted and how long it had been since the last one, and which of the app's widgets and Control Center controls you have added: their kind and size, never what they show.
• Technical details: the app version and build, the operating system and its version, the device model, the language setting, and whether this copy of the app came from the App Store, TestFlight or Xcode.
• A session number that the app keeps in memory only and replaces after an hour without use.

Never sent: the Bible (canon) you chose, the chapters you read, the names of books, your notes, your name, your photo, or anything you typed.

Your IP address reaches Aptabase with every request, because that is how the internet works. Aptabase combines it with the operating system, the language and a random value that is replaced every 24 hours into a one-way hash. That lets visits within one day be counted without anyone being recognized the next day. Aptabase also uses the IP address to determine an approximate location (country and region), and does not store the address itself.

Nothing is stored on your device for this, and nothing is read from it: no identifier, no file. Events wait in the app’s memory until they are sent and are lost if the app closes first. That is why no consent is needed under § 25 TDDDG. Section 5 says how this is handled in other countries.

Legal basis

Art. 6(1)(f) GDPR: our legitimate interest in knowing which features are used and which ones fail, so that the app can be improved. No identity is attached and nothing is linked from one day to the next, so we consider that your interests do not override ours, and you can object at any time. In the countries where these statistics wait for your yes, the basis is your consent instead (section 5).

How to switch it off

Settings › Privacy › Anonymous usage. Turning it off is your objection under Art. 21 GDPR, or, where the statistics ran on your consent, your withdrawal of it, and it takes effect immediately. Where it was an objection, the app sends one last event recording that the switch was turned off, then nothing more; where it was a withdrawal of consent, it sends nothing at all, not even that.

Who processes it

Aptabase, operated by Technov Solutions SRL, Str. Fabricii nr. 47, Bucharest, Romania, as our processor under a data processing agreement (Art. 28 GDPR). The data is stored in Frankfurt, Germany, with Aptabase’s subprocessors Tinybird Data S.L. (Spain) and Amazon Web Services EMEA SARL, and is processed only in the European Union. Aptabase keeps these statistics for up to five years.

4. Detailed analytics and crash reports (PostHog), only with your consent

After you have logged your first reading, the app asks once whether it may also keep detailed statistics. The question never appears on top of another screen, the two answers are the same size, and swiping the question away counts as no. If you say no, the app may ask one more time, no sooner than six months later, or sooner if what it is asking for changes. Depending on your country, the question is put only if the App Store says you are 16 or older, it covers the anonymous statistics of section 3 as well, or it is never asked at all (section 5).

What happens if you say yes

• The app stores a random identifier in its own storage on your device and sends the same events as in section 3 under that identifier, together with the Bible (canon) you chose, which the anonymous statistics leave out. That is what lets use be understood over weeks rather than a single sitting: whether people come back, which features they find, and where they give up.
• If the app crashes or an operation fails, a technical report is sent: what failed, the error, and where in the app’s code it happened. A crash is reported the next time the app starts.
• Technical log lines about the app’s own workings, such as a fallback the app had to take.
• The app asks PostHog which features are switched on for you (feature flags), for instance to try a new feature with some readers first.
• The PostHog software adds device details to each event: the device model, type and manufacturer, the operating system and its version, the app version and build, the screen size, the language, the time zone, whether you are on Wi-Fi or mobile data, and whether the app came from TestFlight.
• Your IP address reaches PostHog with every request, because that is how the internet works. The app asks PostHog not to work out a location from it, and PostHog does not store the IP address itself, so your detailed statistics carry no location at all.

Never sent: your name, an e-mail address or any account (the app has none), the chapters you read, book names, your notes or your photo. There is no screen recording or session replay. Your statistics are kept under the random identifier alone, and nothing connects it to who you are.

Legal basis

Your consent. Storing the identifier on your device requires it under § 25(1) TDDDG, and the processing rests on Art. 6(1)(a) GDPR. How someone uses a Bible-reading app, and which Bible they chose, can hint at their religious beliefs, and here that information is kept under one identifier over time. So far as it does, your consent is also your explicit consent under Art. 9(2)(a) GDPR.

How to take it back

Settings › Privacy › Detailed analytics. Turning it off stops the sending at once, without a restart, and deletes the identifier and anything still waiting to be sent from your device. Withdrawing does not affect the lawfulness of what happened before (Art. 7(3) GDPR). What PostHog has already received stays under an identifier that no longer exists anywhere on your device, so nothing can connect it to you any more. It is deleted at the end of the retention period in section 16, or sooner if you ask us.

Who processes it

PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA, as our processor under a data processing agreement (Art. 28 GDPR). The data is stored in PostHog’s EU cloud, on servers in Frankfurt, Germany. Because PostHog is a US company, access from the US (for example by its support staff) cannot be ruled out. Such transfers are covered by the EU Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, under which PostHog is certified (Art. 45 GDPR), and by the Standard Contractual Clauses in the data processing agreement (Art. 46(2)(c) GDPR).

5. Where analytics run, and on what basis

Which of the analytics in sections 3 and 4 run depends on two countries: the country of the App Store account your device uses, and the region set in iOS. The app reads both on your device. If the two lead to different rules, the stricter one applies, and if your App Store country changes, the app applies the new country’s rule at once.

Where the app sends nothing

If either country is one of the following, or the App Store country cannot be determined, neither the anonymous statistics nor the detailed analytics ever start, the question in section 4 is never asked, Settings › Privacy shows a note in place of the two switches, and feedback from the app is written as an e-mail in your own mail app (section 6): Afghanistan, Albania, Algeria, Angola, Anguilla, Azerbaijan, Bahrain, Barbados, Belarus, Belize, Benin, Bhutan, Bosnia and Herzegovina, Botswana, British Virgin Islands, Brunei, Burkina Faso, Cameroon, Cape Verde, Cayman Islands, Chad, China, Colombia, Côte d’Ivoire, Democratic Republic of the Congo, Dominica, Ecuador, Egypt, El Salvador, Eswatini, Gabon, Ghana, Grenada, Guyana, India, Indonesia, Iraq, Jamaica, Jordan, Kazakhstan, Kosovo, Kuwait, Kyrgyzstan, Laos, Libya, Macao, Madagascar, Malaysia, Maldives, Mali, Mauritania, Mauritius, Micronesia, Moldova, Mongolia, Montenegro, Montserrat, Morocco, Myanmar, Nauru, Nepal, Niger, Nigeria, North Macedonia, Oman, Pakistan, Palau, Papua New Guinea, Peru, Philippines, Qatar, Republic of the Congo, Russia, Rwanda, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, São Tomé and Príncipe, Saudi Arabia, Senegal, Serbia, Solomon Islands, South Korea, Sri Lanka, Tajikistan, Tanzania, Thailand, Tonga, Tunisia, Türkiye, Turkmenistan, Turks and Caicos Islands, Uganda, United Arab Emirates, United Kingdom, Uruguay, Uzbekistan, Vanuatu, Vietnam, Yemen, Zambia, and Zimbabwe.

Where nothing is sent until you say yes

If either country is one of the following, nothing at all is sent, not even the anonymous statistics, until you say yes to the question in section 4 or turn on a switch in Settings › Privacy: Austria, Belgium, Bulgaria, Canada, Costa Rica, Croatia, Cyprus, Czechia, Denmark, Dominican Republic, Estonia, Finland, France, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden. A yes to the question turns on both the anonymous statistics and the detailed analytics; each switch can then be turned off on its own.

Legal basis there: your consent, Art. 6(1)(a) GDPR, together with the national rule that implements Art. 5(3) of the ePrivacy Directive, which, as the European Data Protection Board reads it (Guidelines 2/2023), also covers an app sending information it has produced on your device. So far as the statistics hint at your religious beliefs, your yes is also your explicit consent under Art. 9(2)(a) GDPR. In Canada, Costa Rica and the Dominican Republic, the same yes is the consent their laws ask for (sections 20 and 21).

Everywhere else

Everywhere else, the anonymous statistics run unless you switch them off, and the detailed analytics only with your yes, as sections 3 and 4 describe. The basis for the anonymous statistics is:

• Germany: our legitimate interest (Art. 6(1)(f) GDPR). Nothing is stored on your device for them and nothing is read from it, so § 25 TDDDG is not engaged (section 3).
• The Netherlands: our legitimate interest, together with Art. 11.7a(3)(b) of the Telecommunicatiewet, under which information about the quality or effectiveness of a service needs no consent where it has little or no effect on your privacy. Aptabase is bound by contract to use the data only for us, never for its own purposes.
• Switzerland: Swiss law asks no consent for these statistics. You are told about them here and can refuse them at any time with the switch (section 19).
• Every other country: our legitimate interest (Art. 6(1)(f) GDPR; the GDPR governs everything we process, because we are based in Germany), and the corresponding basis where a country’s own law applies as well (sections 18 to 23).

If you are under 16

In the EU/EEA, Canada, Chile and Brazil, the question in section 4 is put only to someone the App Store says is 16 or older. Before putting it, the app asks iOS for your age range, with one dividing line at 16 (Apple's Declared Age Range). Unless the law of your region has the App Store answer by itself, iOS asks you — or, for a child in Family Sharing, a parent — whether to share it. The app never asks your age itself. If iOS says you are under 16, or you don't share it, the analytics question is not put, and that is recorded as a no to analytics, to be asked again at most once, no sooner than six months later. The answer is read on your device, used only for this, kept only while the app is open, and never stored or sent. Turning on detailed analytics in Settings there checks the same way first, and so does turning on the anonymous statistics where they wait for your yes.

Data is kept for the same time in every country (section 16).

6. Feedback you send us

If you write to us from the app (Settings › Send feedback, or “Something’s off” when the app asks how it is going), the app sends the kind of note (idea, problem or praise), your text of up to 1,000 characters, the app version, and whether this copy came from the App Store, TestFlight or Xcode.

Above the Send button, the app tells you where the note goes: to us, through PostHog, which stores it in Germany but is a US company. It asks you to leave out anything you would rather keep private, and links to this policy.

The note goes directly to the same PostHog project as in section 4, where it is stored as a survey response, and it goes whatever you answered about analytics. It carries a random number made for that one note, so it is not connected to your analytics or to any other note you sent. Your IP address reaches PostHog with the note, but no location is looked up from it, it is not stored, and no profile is created. The app does not keep the note once it has been sent.

A note has no way back to you, so if you would like an answer, write to hello@getbiblering.com instead. Please put only what you are happy for us to read into a note.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in reading and acting on what you tell us, which you asked for by pressing Send. A note can say something about your faith. Because the app tells you where it goes before you send it, sending it is your explicit consent to our reading that too (Art. 9(2)(a) GDPR). Access from the US is covered as in section 4. Since a note is not connected to you, tell us what it said if you want it deleted.

In the countries where the app sends nothing (section 5), writing to us from the app opens an e-mail to hello@getbiblering.com in your own mail app instead, and nothing goes through PostHog. Whether you send it is up to you. If you do, we receive it like any other e-mail, with your e-mail address, and handle it as “Request by e-mail, telephone, or fax” in the website policy above describes.

When the app asks how it is going, your answer is counted as described in sections 3 and 4. If you are happy with the app, it may then show Apple’s own rating prompt. Apple decides whether that appears, and a rating you give goes to Apple.

7. Purchases

The Supporter unlock and tips are sold through Apple’s App Store. Apple handles the payment, and we never see your payment details, your name or your Apple Account. On your device, the app asks Apple’s StoreKit which of its purchases your Apple Account holds, and unlocks what they include. Apple keeps that purchase history. The statistics in sections 3 and 4 record that a purchase was started, completed or cancelled, and which one it was.

At launch the app also asks StoreKit whether this copy came from the App Store, TestFlight or Xcode, and uses the answer only to label its statistics.

Legal basis: Art. 6(1)(b) GDPR, providing what you bought.

8. Reminders

If you turn on the daily reminder, the app schedules it on your device, as a notification iOS delivers without any server. The time is worked out on the device from when you usually open the app to read, or is one you set yourself. The times you read never leave the device. The statistics in sections 3 and 4 record when reminders are turned on or off and, if you set the time yourself, the hour you chose.

The app asks iOS for permission to notify you only when you choose to turn reminders on: during setup, in Settings, or from the suggestion on Home. A reminder names the day’s passage, so it can appear on your Lock Screen; what is shown there is up to your iOS notification settings.

With Discreet reminders on (Settings › Privacy), a reminder names neither the passage nor a book, only that the day’s reading is ready, and when notification previews are hidden, iOS shows a neutral line in its place. It is off until you turn it on. None of this collects anything new.

9. The daily note

The one-line note on Home is written by the app on your device. Where Apple Intelligence is turned on and supports your language, Apple’s on-device model may reword it, and the card then shows the Apple Intelligence symbol. That model runs on the device, and nothing about your reading is sent to us or to Apple for it.

10. Widgets and Control Center

The widgets and Control Center buttons show the summary described in section 2 and open the app when tapped. They send nothing. A widget on the Lock Screen shows your progress and the day’s passage without the phone being unlocked, so choose widgets with that in mind.

The “Keep this private” page in Settings goes through what keeps your reading to yourself on the phone: iOS’s Require Face ID and Hide app, Lock Screen widgets, notification previews, and the app’s Siri & Spotlight switch (section 2). It collects nothing.

11. Sharing

When you share a finished book, a recap or the app itself, the iOS share sheet opens with a picture, a sentence or a link. You choose where it goes, and the app you choose delivers it under its own terms. We receive none of it. The statistics in sections 3 and 4 record that something was shared and what kind of thing it was. When you share the app itself, they also record which app you picked (for example Messages), never to whom. The first share also opens Emmaus, the look the app gives as a thank-you: the statistics note that once, with where in the app the share began, and the app keeps a note on your device that Emmaus is open.

If you choose Save Image, iOS first asks whether the app may add to your photo library. That permission lets it add the picture and nothing else: the app cannot see your photos.

Circles is not live yet and sends nothing. Before it does, this policy will say so.

12. Beta versions (TestFlight)

If you test a beta through Apple’s TestFlight, Apple’s TestFlight terms apply as well. Apple gives us what TestFlight collects: your name and e-mail address if you were invited by e-mail, details about your device, crash reports, and any feedback and screenshots you send through TestFlight. We use them only to fix the beta. The app shows a welcome page once for each beta build and remembers on your device which builds it has shown.

13. What Apple processes

Apple is responsible for its own processing when you download and update the app, buy something in it, test a beta, or back up your device. If you have turned on sharing with app developers (iOS Settings › Privacy & Security › Analytics & Improvements), Apple may also give us crash reports and usage statistics. See Apple’s privacy policy.

14. What the app does not do

• No advertising, and no advertising identifier. The app does not track you across other companies’ apps and websites.
• No selling or renting of data, and no data brokers.
• No account, and no access to your location, contacts, camera, microphone or health data.
• No automated decisions about you with legal or similarly significant effects (Art. 22 GDPR).

15. Who receives data, and where

• Aptabase (Technov Solutions SRL, Romania): anonymous usage statistics, where they run (section 5), as our processor. Stored in the EU (Frankfurt), and only there.
• PostHog (PostHog, Inc., USA): detailed analytics, crash reports and feedback, as our processor. Stored in the EU (Frankfurt); US access safeguarded by the Data Privacy Framework and Standard Contractual Clauses.
• Apple: the App Store, purchases, TestFlight and device backups, as a controller in its own right; and, only if you turn on Keep in iCloud, iCloud, which keeps your record in your own private iCloud database (section 2).
• Your e-mail provider and ours: a feedback e-mail you send from your own mail app, where the app hands feedback to it (section 6).

Nobody else receives data from the app.

16. How long data is kept

• On your device: until you delete it or delete the app.
• In your iCloud, if you turned that on: until you delete it (section 2).
• Anonymous usage statistics: up to five years.
• Detailed analytics, crash reports and feedback: up to one year, or less if you ask us to delete them sooner.
• A feedback e-mail: until your request has been dealt with, unless the law requires us to keep it longer.

17. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15), have it corrected (Art. 16) or deleted (Art. 17), and have its processing restricted (Art. 18);
• receive it in a common, machine-readable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21). For the app, that is the Anonymous usage switch, where those statistics run without asking;
• withdraw your consent at any time, for the future (Art. 7(3)). For the app, that is the Detailed analytics switch, and the Anonymous usage switch where those statistics waited for your yes (section 5);
• complain to a supervisory authority (Art. 77), in particular in the EU country where you live or work. Ours is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.

Write to hello@getbiblering.com and we will answer within one month. Because the app holds your reading record only on your device and in your own iCloud, neither of which we can see, and sends us nothing that says who you are, we can usually find data only from details you give us (Art. 11 GDPR), such as the text of a note you sent. Your record itself is in your hands: you can delete it as section 2 describes. Sections 18 to 23 add the rights and the authority some other countries’ laws give you.

18. If you live in the United States

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as the California Consumer Privacy Act (CCPA/CPRA) and similar state laws define those terms. There is no targeted advertising, and no profiling that produces legal or similarly significant effects.

Over the past twelve months, the app has collected these categories of personal information, in the ways described above:

• Identifiers: the random analytics identifier, only with your consent (section 4).
• Internet or other electronic network activity: how the app is used (sections 3 and 4).
• Approximate geolocation derived from your IP address: country and region, in the anonymous usage statistics (section 3). Never your precise location.
• Commercial information: that a purchase was started, completed or cancelled (section 7).
• Sensitive personal information: the Bible canon you choose can suggest a religious tradition, and a note you send us may say something about your faith. The canon reaches us only with your consent, in the detailed analytics (section 4), never in the anonymous statistics; a note only when you send it, after the app has told you where it goes (section 6). Neither is used to infer anything about you.

The source of this information is the app on your device. It is used to run, fix and improve the app, and it is disclosed only to the service providers in section 15. We keep it as section 16 describes.

The anonymous usage statistics (section 3) are de-identified: they carry no identifier and cannot reasonably be linked to you or your device. We commit to keeping and using them only in that form and not to attempt to re-identify anyone from them, and Aptabase is bound by contract to process them only on our instructions and only for our statistics. We process sensitive personal information only with your consent, and we keep an internal data protection assessment for that processing.

Do Not Track: the app does not track you over time or across other companies’ websites and apps, and no one else collects such information through it, so a Do Not Track signal changes nothing in what it does.

You may ask to know what we have collected about you, and to have it deleted or corrected. You may also limit the use of sensitive personal information, which we already use only as described here. Write to hello@getbiblering.com, or have an authorized agent write for you; e-mail is the way to make any of these requests. Because we hold no name, e-mail address or account, we can verify a request only from details you give us. We will not treat you differently for using any of these rights. If we decline a request, you can appeal by replying to our answer; if the appeal is declined too, you may contact your state attorney general.

19. If you live in Switzerland

The revised Federal Act on Data Protection (FADP) applies as well, and the controller is the one in section 1. Data about religious views is sensitive data under the FADP, so the canon reaches us only with your consent (section 4), and a note only when you send it (section 6). Swiss law asks no consent for the anonymous statistics: they run as section 3 describes, and you can refuse them at any time with the Anonymous usage switch.

Data from the app goes to recipients in these countries:

• The EU: Germany, where PostHog and Aptabase store the data (in Frankfurt), and Romania and Spain, where Aptabase and its database provider are based. The Federal Council recognizes the EU’s countries as protecting data adequately (Annex 1 to the Data Protection Ordinance).
• The United States: PostHog, Inc. may access the detailed analytics, crash reports and feedback from there, for example for support. PostHog is certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognized as adequate since 15 September 2024, and the Standard Contractual Clauses in our data processing agreement apply as well, with the amendments Swiss law requires.

You have the right to know what data we hold about you (Art. 25 FADP), to have it corrected or deleted, and to receive it in a common electronic format (Art. 28 FADP). Write to hello@getbiblering.com. The authority is the Federal Data Protection and Information Commissioner (FDPIC; EDÖB in German, PFPDT in French, IFPDT in Italian), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.

20. If you live in Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and in Quebec the Act respecting the protection of personal information in the private sector, as amended by Law 25. Jonathan Müller, owner of JTechPro, is accountable for your personal information and is the person in charge of its protection (responsable de la protection des renseignements personnels), at hello@getbiblering.com.

In Canada, nothing is sent until you say yes, and the question is put only to someone the App Store says is 16 or older (section 5). Your yes is your express consent, including for what can hint at your religion, such as the canon in the detailed analytics. A note is sent only when you choose to send it, after the app has told you where it goes (section 6).

What the app sends is processed in the EU and stored in Germany, and PostHog may access it from the United States. While it is there, it may be accessed by the courts, law enforcement and national security authorities of those countries. Before personal information about people in Quebec leaves the province, we assessed whether it will be adequately protected, and our data processing agreements with Aptabase and PostHog are the written agreements that protection rests on.

You can ask for access to your personal information and for its correction, and withdraw your consent at any time with the switches in Settings › Privacy. If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

21. If you live in Latin America

In every country below, the anonymous statistics are stored only in the EU, and PostHog may access the detailed analytics, crash reports and feedback from the United States, as the question in the app says too (section 4). Both act only on our behalf, under data processing agreements, and nobody else receives your data (section 15).

Mexico

This policy is our full privacy notice (aviso de privacidad integral) under the Federal Law on the Protection of Personal Data Held by Private Parties of 2025:

• Who we are: the controller and address in section 1.
• The data: the statistics in sections 3 and 4 and the feedback in section 6. Sensitive among them: the Bible (canon) you chose, which can hint at your religious beliefs and is sent only in the detailed analytics, with your express consent; and anything about your faith you write in a note you send.
• Purposes that need no consent: providing the app and what you buy in it (section 7), reading and acting on your feedback (section 6), and the anonymous statistics, to fix and improve the app (section 3).
• Purposes that need your consent: the detailed analytics and crash reports (section 4), including the canon in them.
• Who handles it for us: Aptabase (a Romanian company) and PostHog (a US company), which both store the data in Germany, only on our behalf. We make no transfers to third parties that would need your consent.
• Your ARCO rights (access, rectification, cancellation and opposition): write to hello@getbiblering.com, saying which right you are exercising and which data it concerns (for a note, what it said). We answer within 20 days.
• Limiting use and revoking consent: the switches in Settings › Privacy, at any time, or an e-mail to us.
• Changes: published on this page with the date at the top; if detailed analytics are ever used for a new purpose, the app asks you first (section 26).

The authority is the Secretaría Anticorrupción y Buen Gobierno.

Chile

From the day Law 21.719 takes effect (set for 1 December 2026), Law 19.628 as amended by it applies to us. You have the rights of access, rectification, deletion, objection, portability and blocking. Write to hello@getbiblering.com, which is also our contact for the Agencia de Protección de Datos Personales, the authority you can complain to. The canon and anything about your faith in a note are sensitive data, processed only with your express consent (sections 4 and 6), and that consent is asked for only from someone the App Store says is 16 or older (section 5). Data is stored in Germany, in the EU, which applies the GDPR, and PostHog may access it from the United States, which rests on your consent. The Agency has not yet said which countries it considers to protect data adequately.

Argentina

Under Law 25.326 you can access your data free of charge at intervals of no less than six months, unless you show a legitimate interest, and have it rectified, updated or deleted; write to hello@getbiblering.com. The Agencia de Acceso a la Información Pública, as the supervisory body under Law 25.326, hears the complaints and claims of anyone whose rights under the data protection rules have been affected. Argentina recognizes the EU’s countries as protecting data adequately; the access from the United States rests on your express consent.

Panama

Law 81 of 2019 and Executive Decree 285 of 2021 give you the rights of access, rectification, cancellation, opposition and portability; write to hello@getbiblering.com. You can complain to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI). Data goes to the EU, whose protection is at least equivalent to Panama’s, and the access from the United States rests on your consent.

Dominican Republic

Under Law 172-13 on the protection of personal data, nothing is sent from the app until you say yes (section 5), and your yes is also your express authorization for the data to go abroad: to the EU and, for PostHog, possibly to the United States. You have the rights of access, rectification and deletion; write to hello@getbiblering.com. There is no data protection authority for private companies yet; the courts hear claims, including by habeas data.

Costa Rica

Under Law 8968 on the protection of the person with regard to the processing of their personal data, nothing is sent from the app until you say yes (section 5), and your yes is your express consent, including for the canon, which can say something about your religious convictions, and for the data going to the EU and possibly the United States. You have the rights of access, rectification and deletion; write to hello@getbiblering.com. The authority is the Agencia de Protección de Datos de los Habitantes (PRODHAB).

22. If you live in Japan, Singapore or New Zealand

Japan

Under the Act on the Protection of Personal Information (APPI), these are the matters we make public. The business operator, and its representative, is Jonathan Müller (sole proprietor), Frankreichstr. 5, 66663 Merzig, Germany. We use the data the app sends to run, fix and improve the app and to read your feedback (sections 3, 4 and 6). To ask for disclosure, correction, deletion or a stop to the use of your data, or to make a complaint, write to hello@getbiblering.com. How the data is protected is in section 25.

The data goes abroad: to Germany, where PostHog and Aptabase store it (in Frankfurt), and to Romania and Spain, where Aptabase and its database provider are based, all in the EU, which Japan’s Personal Information Protection Commission (PPC) recognizes as having a system equivalent to Japan’s; and to the United States, where PostHog, Inc. may access it. The United States has no comprehensive federal law on personal information, only laws for particular sectors and states; the PPC describes its system on its website (in Japanese). PostHog protects the data under our data processing agreement and the EU-U.S. Data Privacy Framework. The question in the app names these countries too, before anything goes to PostHog.

Singapore

Under the Personal Data Protection Act 2012, our Data Protection Officer is Jonathan Müller, at hello@getbiblering.com or the address in section 1. Aptabase and PostHog are bound by our data processing agreements to protect the data to a standard comparable to Singapore’s. You can complain to the Personal Data Protection Commission (pdpc.gov.sg).

New Zealand

Under the Privacy Act 2020, our privacy officer is Jonathan Müller, at hello@getbiblering.com. Write to us first with any request or concern; if our answer does not satisfy you, you can complain to the Privacy Commissioner (privacy.org.nz). Aptabase and PostHog hold the data only on our behalf, so it is not disclosed overseas in the sense of information privacy principle 12, and our data processing agreements bind them to protect it.

23. If you live in Kenya, South Africa, Malawi or The Gambia

In these countries the anonymous statistics run as section 3 describes, without the canon, and the detailed analytics only with your yes. The canon, which can reveal religious belief, reaches us only with that yes (section 4), and a note only when you send it (section 6). Your yes is also your consent to the data going abroad, after the app has told you where: to the EU and, for PostHog, possibly to the United States.

Kenya

Under the Data Protection Act 2019 you have the rights to be informed, to access your data, to object, and to have it corrected or deleted; write to hello@getbiblering.com. Sensitive data such as the canon leaves Kenya only with your consent. You can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

South Africa

Under the Protection of Personal Information Act (POPIA), religious beliefs are special personal information, processed only with your consent. Data goes abroad under section 72: to recipients bound by the GDPR and by our data processing agreements, which give protection substantially similar to POPIA’s, and, for the detailed analytics, with your consent too. You can ask for access, correction or deletion and object; write to hello@getbiblering.com. You can complain to the Information Regulator (inforegulator.org.za).

Malawi

Under the Data Protection Act 2024 you have the rights of access, correction, deletion and objection; write to hello@getbiblering.com. Data goes to the EU, which protects it adequately, and possibly to the United States, which rests on your consent. The authority is the Malawi Communications Regulatory Authority (MACRA).

The Gambia

Under the Personal Data Protection and Privacy Act 2025, religious beliefs are a special category of data, processed only with your explicit consent, and data goes abroad only where it is protected appropriately: in the EU under the GDPR, and with PostHog under our data processing agreement. You have the rights of access, correction, erasure, restriction and objection; write to hello@getbiblering.com. The Act names the Information Commission as the authority.

24. Children

The app is not directed at children under 13, and we do not knowingly collect personal information from them. In the EU/EEA, Canada, Chile and Brazil, the app asks for consent to analytics only from readers aged 16 or over (in the EU, see Art. 8 GDPR): there it asks only someone the App Store says is 16 or older, and otherwise does not ask about analytics at all (section 5). If you think a child’s data has reached us, write to us and we will delete what we can find.

Some laws have the App Store tell an app how old its reader is: Texas’s App Store Accountability Act, and similar laws elsewhere. Where iOS says such a law applies to you, the app asks iOS for your age range for that law’s sake too. iOS answers with a band (in Texas: under 13, 13 to 15, 16 to 17, or 18 and over), never a birthday. The app reads it on your device and keeps only whether you are under 18, and only while the app is open. It is never stored, and never sent to us, to PostHog, to Aptabase or anywhere else. It changes two things. A reader under 18 is never asked about detailed analytics. And if the app’s age rating on the App Store changes, a reader under 18 waits for a parent’s OK, which Apple asks for, before the app opens again, while an adult may be shown a notice by iOS. For that the app keeps on your device the age rating it last saw (such as 4+), which says nothing about you.

25. Security

Everything the app sends travels encrypted (HTTPS). Your reading record is protected on the device by iOS’s own data protection, and a copy you keep in iCloud is protected by Apple. There is no server of ours holding a copy that could be breached.

26. Changes to this policy

When the app changes what it does with data, this policy changes with it, and the date at the top of the page moves. If detailed analytics are ever used for a purpose you have not agreed to, the app asks you again before doing so.