Last updated: 17 October 2026 · OmniAlera Technologies Holdings Inc. · support@omnialera.com
Religious belief is sensitive personal data. FaithScroll is designed so that the company holds as little of it as possible.
Data inventory
| Data | Where it is kept | Who can see it | Retention |
|---|---|---|---|
| Highlights, bookmarks, notes, prayers, plan progress, reading history, settings | The reader's browser (localStorage) |
Only the reader | Until the reader deletes it (Settings → Delete all my data) |
| Offline Bible packs | The reader's browser (Cache Storage) | Only the reader | Until removed |
| AI questions and the passage | Sent to Anthropic to generate one answer; not stored by FaithScroll | Anthropic (processor) | Per Anthropic's API data policy; FaithScroll logs only the question length |
| Community posts | Neon Postgres | Everyone in that circle; moderators | Until the author deletes it or a moderator removes it |
| Community author identity | A salted hash of a random device id | Not reversible | With the post |
| Text-issue reports | Neon Postgres | Editors | Until resolved, then kept for the correction history |
| Feature ideas and “I want this too” requests | Neon Postgres: the idea text, category, interface language, and a salted hash of the device id per request | The idea text is public on the board; who asked is never shown | Kept while the idea is on the board; hidden or merged ideas are kept for the audit history |
| Study groups | Neon Postgres: group name and description, each member's chosen display name, role and plan progress | Members of that group only | Until the group is closed; leaving removes you from the member list |
| Group membership | A random secret on the member's device; the server stores only its salted hash | Not reversible | With the membership |
| Group posts, prayer requests, photos, voice notes, videos | Neon Postgres (text) and Cloudflare R2 (files). Photos are re-encoded on the device first, which strips location and camera details | Members of that group only; files are served through links that expire after about 2 hours | Until the author or a leader removes the post, or the group closes |
| Video rooms | Nothing is recorded. The server briefly relays connection details (WebRTC offers, answers and network candidates, kept up to 10 minutes) so devices can find each other; audio, video, chat and the shared passage go directly between participants | Room participants | Not stored |
| Synced copy of notes, highlights, prayers and progress (opt-in) | Neon Postgres, end-to-end encrypted on the device (AES-GCM) with a key derived from a 120-bit recovery code that never leaves the reader's devices | Nobody else, including OmniAlera | Until the reader deletes it from Settings |
| Daily reminder | A calendar event in the reader's own calendar app | Only the reader | Until deleted in the calendar |
| Audio Bible playback (if enabled) | The chapter request passes through our server to Bible Brain; the audio streams from Bible Brain | Bible Brain (processor) | Per Bible Brain |
| Visit statistics | Cloudflare Web Analytics: page views, country, browser type and load speed, with no cookies, no fingerprinting and no personal identifiers | OmniAlera (aggregate counts only) | Per Cloudflare |
| Rate-limit counters | Hashed address (IPv6: hashed /64 network) or hashed device id, with a count and the window start | Not reversible | Window length (up to a day); swept after 3 days |
| Donations | Stripe | Stripe and the account owner | Per Stripe |
| FaithScroll Plus / Church | Stripe (card, email, receipts); FaithScroll stores only a salted hash of a code derived from your sync code, your Stripe customer and subscription ids, plan, status and renewal date | Stripe and the account owner | While subscribed, then kept for tax and refund records as Stripe requires |
| Accessibility choices (profiles, braille, sizes) | The reader's browser | Only the reader | Until reset or deleted |
| Voice commands (opt-in) | Processed by the browser's speech service (for example Google in Chrome, Apple in Safari); FaithScroll receives only the recognised words on the device | The browser vendor | Per the browser vendor; FaithScroll stores nothing |
Deletion is real deletion. Removing a group post deletes its text and any photo, voice note or video from storage. "Leave and delete my posts" erases everything that person posted or uploaded in the group; removing a member does the same. Closing a group erases all posts, files, member records and room data, keeping only an empty placeholder with no names or content. Files uploaded but never posted are erased after a day. A community post removed by its author has its words wiped. Synced data is erased from Settings → Sync → Turn off and delete.
FaithScroll has no accounts, no advertising, no tracking cookies and no fingerprinting. Visit counts use cookie-free Cloudflare Web Analytics. The third parties the app contacts are Cloudflare (hosting, Turnstile human check and analytics), Neon (database), Google Fonts (typefaces), and, only when you use those features, Anthropic (AI explanations), Bible Brain (audio Bible) and Stripe (gifts and subscriptions).
Consent ledger
The first AI explanation and joining a community circle each ask for explicit consent. The date of each consent is stored on the device and listed under Settings → Consents, where it can be withdrawn.
Disability data
Accessibility profiles describe needs, not diagnoses, and they never leave the device. FaithScroll does not ask why a profile is chosen and does not send profile choices to any server.
Minors
Community circles require readers to confirm they are 13 or older. Posts containing contact details or links are held for review, which limits grooming and doxxing routes. Self-harm reports hide a post immediately and go to a moderator. The app offers emergency guidance in the report sheet but makes no claims about crisis response.
Reader rights
- Export: Settings → Copy my data (JSON).
- Delete: Settings → Delete all my data (also removes offline packs).
- Community: authors delete their own posts at any time.
Contact
Questions or requests: support@omnialera.com. See also our Terms of use.