Privacy

Taala Bible Study stores what it needs to show you your own reading, and nothing else. There is no analytics, no tracking, and no advertising anywhere in this app. Your data is never sold or shared for marketing, and there are no third-party cookies.

• Your account. Email address, display name, and either a password (stored only as a bcrypt hash — we never hold the password itself) or a link to the Google or Apple account you signed in with. If that provider supplies a profile picture, its address is stored.
• Your preferences. Preferred Bible translation, and your time zone — which is used only to decide when your day ends, so a reading streak counts correctly.
• What you write. Highlights, notes, and posts in a group discussion, each attached to the passage it belongs to.
• Prayers you write. The words of any prayer you keep, which of the eight themes you wrote it under, and whether and when you marked it answered. Nobody else can see these — there is no way in the app to share a prayer with a group or with anyone else, and nothing reads them but you. A prayer written before you sign in stays on that device until you do.
• What you have read. Which readings in a plan you marked complete, and a per-day record that a reading happened, kept so streaks work.
• Your groups. Which groups you belong to, your role in each, and invitations you created or accepted.
• Live study. While a study session is running: that you joined, when you were last active, and the passage the group is looking at.
• Security records. Refresh tokens, stored only as hashes, so a signed-in device can be signed out. Counters against your IP address and email address, to limit sign-in attempts and how many emails anyone can make us send.

• No analytics or tracking. No page-view tracking, no session recording, no behavioural profiling, no third-party analytics of any kind.
• No advertising. No ad networks, no advertising identifiers, no data sold or shared with advertisers.
• No location. Beyond the coarse time zone your device reports, which is used only for the day boundary.
• No contacts, photos, microphone or camera. The app never asks for these. A group video call happens in a separate service you choose — see below.

Running the app means some data passes through other companies. These are all of them.

• Neon. Hosts the database. All of the above is stored there.
• Fly.io. Runs the application servers.
• Resend. Sends the two emails this app sends: address verification and password reset. It receives your email address.
• API.Bible. Supplies the text of the three licensed translations (NIV, NLT, NASB). Requests say which passage is wanted; they do not say who asked. The other translations are stored on our own servers and involve nobody.
• Jitsi Meet. The default for a group's video call. A group may instead paste a link to Google Meet, Zoom, Microsoft Teams or anything else — in that case the call happens entirely in that service, under its terms and its privacy policy, and this app stores only the link.

You can delete your account from your account page, at any time, without asking anyone. It happens immediately and cannot be undone.

Your highlights, notes, prayers, reading history, plan subscriptions and group memberships are erased with it. Posts you wrote in a group discussion are not erased — they are detached from you and remain visible to that group with no author. A conversation other people took part in is partly theirs, and removing one side of it would damage the record for everyone else. If you want a specific post gone, delete the post before deleting your account.

Deletion is refused in one case: if you are the only administrator of a group that still has members. Make someone else an administrator, or delete the group, and then try again.

The app works without a connection, so what you write is saved on the device first and sent to the server afterwards. Your highlights, notes and prayers therefore also exist in the app’s own storage on each device you use.

Signing out erases that copy. So does signing in as a different person. Nothing you wrote is left behind for the next person to use the device, whether or not it had reached the server.

Your account content is kept until you delete it. Security records expire on their own — sign-in counters within the hour, refresh tokens within thirty days of last use, and email verification and password-reset links within twenty-four hours and one hour respectively.

This app is not directed at children under 13, and accounts are not knowingly created for them.

If what is collected ever changes, this page changes in the same release. Questions, or a request to see or remove your data, can go to the address on the home page.