Privacy Policy

1. Scope and controller

This policy applies when you use the ScriptureHub Android application, visit scripturehub.cc, create an account, contact support, or otherwise interact with the service. The data controller and service operator is Inkal OÜ, Keemia 11, Tallinn, Estonia. “ScriptureHub,” “we,” “us,” and “our” refer to Inkal OÜ when operating the ScriptureHub service.

Privacy enquiries and requests may be sent to privacy@scripturehub.cc or by post to the address above. Please do not send passwords, prayer text, sermon notes, or identity documents unless we specifically request information necessary to verify a rights request.

2. Personal data we process

Depending on the features you use, we may process:

• Account data: email address, display name, internal account identifiers, authentication records, and security events.
• User content: sermon notes, prayer entries, answers and updates, saved passages, highlights, study notes, and Scripture references you choose to store or synchronise.
• Activity and preference data: reading position, plan and memory progress, reminder choices, Bible translation, reader appearance, theme, and language preference.
• Device and service data: app version, device platform, request metadata, timestamps, error information, and limited logs required to operate and secure the service.
• Communications: messages and related information you provide when contacting support, privacy, or account-deletion channels.

The public website stores the language you select in local browser storage. It does not currently use advertising cookies or behavioural advertising.

3. Religious and other sensitive content

Prayer entries, sermon notes, and reading activity may reveal religious or philosophical beliefs and may therefore constitute special-category personal data under Article 9 GDPR. We do not require you to enter sensitive details and do not use this content to infer a belief profile, target advertising, or make decisions about you.

Where special-category data is processed, we do so only for the feature you deliberately request and on a lawful Article 9 condition, including your explicit consent where consent is required. You may withdraw consent and delete the relevant content at any time; withdrawal does not affect processing already carried out lawfully. Avoid entering another person’s sensitive information unless you have a lawful basis and authority to do so.

4. Purposes and legal bases

• Contract: to create and secure your account; provide reading, notes, prayer, study, synchronisation, offline recovery, and support features; and administer any service you request.
• Legitimate interests: to keep the service reliable and secure, prevent abuse, diagnose faults, protect users, and understand aggregate service performance, provided those interests are not overridden by your rights.
• Consent: where you choose optional processing that requires consent, including special-category processing or non-essential browser storage. You may withdraw consent prospectively.
• Legal obligation: to comply with applicable Estonian and EU law, respond to lawful authority requests, keep required records, and establish or defend legal claims.
• Vital interests: only in an exceptional emergency where processing is necessary to protect a person and another lawful basis is unavailable.

5. On-device and third-party content processing

Some preferences, downloaded Bible content, cached account information, notification schedules, offline notes, and pending sync operations are stored on your device. Authentication tokens are stored using the device’s secure credential storage where supported. Removing the app or clearing its data may delete local-only content.

Reminders are presently scheduled locally on the device. Scripture cards are generated on the device and leave the app only when you save or share them. External Bible and study-content providers may receive network metadata and the passage or search request needed to return content; they do not receive your ScriptureHub password from us.

6. Recipients and international transfers

We disclose personal data only as necessary to service providers that support hosting, infrastructure, authentication, security, communications, customer support, and licensed content delivery; to professional advisers under duties of confidentiality; in a corporate transaction subject to appropriate safeguards; or where required by law. Processors may act only on documented instructions and must protect the data.

We do not sell personal data. Advertising and supporter-subscription features are not currently enabled. If either is introduced, this policy and any required choices will be updated before the relevant processing begins.

If personal data is transferred outside the European Economic Area, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses with supplementary measures where necessary, or another mechanism permitted by Chapter V GDPR.

7. Retention

We retain account data while the account is active and for the limited period needed after closure to complete deletion, maintain security, meet legal obligations, and resolve disputes. Synced user content is retained until you delete it, delete the account, or the service is lawfully required to retain it. Local content remains on your device until you remove it or clear the app’s data.

Support correspondence and security records are retained for the period reasonably necessary to answer the request, prevent abuse, and establish or defend legal claims. Backups are isolated, access-restricted, and retired on a rolling schedule. When retention is no longer necessary, data is deleted or irreversibly anonymised.

8. Security

We use proportionate technical and organisational measures, including transport encryption, access controls, secure credential storage, minimisation, and restricted operational access. No networked service can guarantee absolute security. You are responsible for protecting your device and account credentials and should notify us promptly if you suspect unauthorised access.

9. Your data-protection rights

Subject to the GDPR and any applicable limitations, you may request access, correction, erasure, restriction, portability, or objection; withdraw consent; and object to processing based on legitimate interests. ScriptureHub does not currently make decisions producing legal or similarly significant effects solely by automated means.

Send a request to privacy@scripturehub.cc. We may request proportionate information to verify identity. We normally respond within one month and may extend by up to two further months for a complex or numerous request, with notice. You may also complain to the Estonian Data Protection Inspectorate or the supervisory authority in your habitual EU residence or place of work.

10. Children

The account service is not directed to children under 13. Where consent is the legal basis for offering an information-society service directly to a child in Estonia, a child under 13 requires authorisation from a parent or legal guardian. A parent or guardian may contact us about a child’s data. Additional contract-capacity and safeguarding rules may apply to users under 18.

11. Changes to this policy

We may update this policy when the service, vendors, or legal requirements change. Material changes will be presented in the app or on the website before they take effect where required. The date at the top identifies the current version.