Privacy Policy

1. Information We Collect

We collect strictly the minimum information required to deliver daily affirmations, cross-device synchronization, and an uninterrupted devotional experience:

• Account Information: When you register, we collect your email address, your first name, and a password. Passwords are never stored in plaintext; they are secured using industry-standard one-way cryptographic hashing (Argon2id).
• Your Private Journal: Journal entries, reflection prompts, theme tags, and entry timestamps are stored securely in your account so they sync across your devices. Your journal is strictly private: it is never viewed by other users, never used for advertising, and never processed for algorithmic profiling.
• Practice & Streak History: Your streak is kept by showing up — a day counts once you have opened Edifice on it. So when you open the app, open a confession, or mark a practice step complete, we record a timestamp, the ID of the item involved, and the calendar date in your device’s time zone, on our servers. That is what keeps your streak correct across your devices and across reinstalls. We do not record whether or what you actually said aloud; see section 2.
• Saved Affirmations & Goals: Your bookmarked affirmations and the spiritual focus goals you select during onboarding are saved to personalize your daily practice.
• Member-Authored Stories: If you write a story and explicitly choose to publish it, the story and your first name become visible to others who possess the link. Publishing is entirely optional; uncompleted drafts remain private to you.
• Subscription Status: If you purchase an optional Edifice Glory subscription, payments are processed directly by the Google Play Store or Apple App Store. We receive only cryptographic transaction tokens and status indicators to unlock your subscription across your devices. We never receive or store credit card numbers or billing addresses.
• Preferences: Your selected narration voice preference and interface language.
• Feedback You Send Us: If you use Settings → Send feedback, we store the message you write, the category you chose for it, and the app version and platform you are running, on our servers. The message is free text, so whatever you put in it — your name, a description of your circumstances, another person — is stored as you wrote it; please share only what you are comfortable for us to read. It is linked to your account, which is what allows us to follow up with you if we decide to, and what ensures it is erased when your account is. Messages are limited to 1,000 characters. They are read only by the Edifice team, are never published, never shown to other members, and are never used for advertising or profiling. You do not have to use the form: you can email us instead, at the address in section 10.

2. What We Deliberately Do NOT Collect

To protect your privacy and ensure compliance with Google Play and App Store standards:

• No Voice or Audio Recordings: Spoken confession practices are self-confirmed. The app does not record, capture, or transmit microphone audio.
• No Location Data: We do not request or track GPS, coarse, or fine location data.
• No Contacts or Address Book: We never access your contacts.
• No Photos or Files: We do not scan or upload your local media files.
• No Advertising Identifiers: We do not collect Google Advertising ID (AAID) or IDFA.
• No Third-Party Analytics / Crash Trackers: No external trackers or invasive monitoring SDKs are embedded.

3. Security & Encryption

We implement rigorous technical safeguards to protect your personal information:

• Transit Encryption: All data transmitted between the Edifice mobile/web apps and our backend infrastructure is encrypted using modern HTTPS / TLS 1.3. Cleartext network traffic is strictly disabled.
• Device-Level Security: Session authentication tokens are stored securely using platform hardware cryptography — the Android Keystore on Android devices and the iOS Keychain on Apple devices.
• Server Architecture: Our backend databases are isolated with strict role-based access controls and automated security auditing.

4. How We Use Information (Legal Bases)

5. Third-Party Infrastructure & Processors

We do not share your data with third parties for marketing or advertising. We engage reputable infrastructure providers solely to host and operate the platform:

• Hosting & Compute: Managed backend application servers running on secure cloud infrastructure (Render).
• Database: Managed PostgreSQL hosting with encryption at rest (Neon).
• Payment Gateways: Google Play Billing (Google LLC) and In-App Purchase (Apple Inc.), which process payments under their respective privacy policies.

6. Data Retention & Account Deletion

You maintain full control over your data. You may delete individual journal entries at any time directly in the app.

When you request complete account deletion (available in the app via Settings → Delete Account or via our Web Account Deletion Page):

1. Immediate Invalidation: Your account is immediately deactivated and all active authentication sessions are revoked across all devices.
2. 7-Day Safety Cool-off: To protect members against accidental deletion or unauthorized account takeover, data is scheduled for permanent purge after an approximate 7-day window. Signing in during this window cancels the pending deletion.
3. Permanent Erasure: Following the cool-off, your account, profile, private journal entries, streak records, goals, saved content, and any feedback you sent us through the app are permanently and irreversibly expunged from all production databases. Feedback is deleted rather than kept in anonymised form, because a message you wrote is your words whether or not your name is still attached to it.

7. Your Privacy Rights

Under regulations including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA), you have the right to access, rectify, port, or erase your personal data. You can perform deletion directly in the app or contact our privacy desk at supernaturalbrian@gmail.com.

8. Children's Privacy

Edifice is not directed toward children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that a user under 13 has provided personal data, we will promptly delete it.

9. Changes to This Policy

If we update this Privacy Policy, the revised version will be published here with an updated effective date. Material changes will also be notified within the Edifice app.

10. Contact Us

If you have any questions, inquiries, or privacy requests regarding this policy, please contact our support team:

Edifice Privacy Desk
Email: supernaturalbrian@gmail.com
Website: https://edificeapp.org