Candil Privacy Policy

Effective date: [EFFECTIVE DATE]
Version: [VERSION]

The Portuguese version of this policy is the reference text. If the versions differ, the Portuguese version applies, unless the law of your country requires otherwise.

1. Who we are

Candil is a Bible companion app. It is offered by [COMPANY LEGAL NAME], a Brazilian company with CNPJ [CNPJ] and its registered office at [ADDRESS]. In this policy, "Candil", "we", "us", and "our" mean this company.

We are the controller of your personal data under the Brazilian General Data Protection Law (Law No. 13,709/2018, the "LGPD"). For people in the European Union, we are also the controller under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").

This policy explains what data we process, why, where it is kept, for how long, and what your rights are. It applies to the app, the website, and the Candil WhatsApp channel.

2. Summary

• Your journal is stored on your device. Finding prayer requests needs specific consent to send the selected entry (section 4.4).
• Faith and prayer are sensitive data. We process this content only with your specific, explicit consent.
• We do not sell your data. We show no ads. We do not share your data for advertising.
• The language model never writes Bible text. The app shows the stored text of each verse.
• Before any search or AI answer, we check for signs of risk. That text is not stored or logged.
• You can export and delete your account and your journal in the app.
• Language and reminders sync with your account. Church, tradition, and reasons go to your account only with a separate consent, which you can withdraw.

3. Sensitive data: faith and prayer

The LGPD treats religious belief as sensitive personal data (art. 5, II). The GDPR treats religious beliefs as a special category of data (art. 9). US state privacy laws also treat religious belief as sensitive data.

Questions about the Bible, prayer requests, journal text, and messages you send to Candil can reveal your faith. They can also reveal health data or data about other people. So:

• We ask for your specific, explicit consent before we process this content on our servers (LGPD, art. 11, I; GDPR, art. 9(2)(a)).
• Keeping church, tradition, and reasons in your account has its own consent, separate from the consent for the device (section 4.10).
• We use this content only for the purpose you asked for, such as answering a question.
• We do not use this content for advertising, marketing profiles, or sale.
• You can withdraw consent at any time in the app settings or through the contact in section 14. Withdrawal is free. It does not affect processing done before it. Without consent, some features stop working.

4. What data we process

4.1 Account

Candil uses no passwords. You sign in with Apple, Google, or a code sent by email. Where available, you can link WhatsApp from your signed-in account.

We keep:

• An internal account ID and the date it was created.
• The ID that Apple or Google gives us for your account.
• Your email address, only when the provider confirms it is verified. If you use Apple's "Hide My Email", we keep Apple's relay address and a flag that it is private.
• Your phone number, encrypted, if you link WhatsApp to your account.
• For Sign in with Apple, an encrypted Apple refresh token. We use it to revoke access at Apple when you delete your account.
• Session records: the dates each session was created, used, expired, and revoked. We store session tokens only as a hash, never as plain text.

We do not keep your name, your photo, or your password for another service.

4.2 Sign-in security

• Email codes: we keep only a hash of the code, for up to 10 minutes, with the number of attempts.
• Attempt limits: to stop abuse, we count attempts per email address and per IP address. The email and the IP enter this count only as a code (HMAC) that does not reveal the original value. Each count lasts 10 minutes and is then deleted.
• Replay protection: we keep a hash of each Apple or Google sign-in token already used, until the token expires. This hash is not linked to the account. It stays until it expires even after the account is deleted, so an old token cannot open a new account.

4.3 Search, questions, and AI answers

When you search or ask a question, the text goes to our server. First it passes the risk check in section 6. Then:

• For search by meaning, we send the text to Voyage AI to create a numeric vector (an embedding). The vector helps find similar passages.
• For AI answers, when this feature is available, we send your question and the passages found to Anthropic. The model picks verse references from the passages found. The app shows the stored text of each verse. The model never writes Bible text.

We do not keep the text of your searches and questions in our database. [CONFIRM before AI answers launch: whether question history will be kept in the account. If so, state the period and how to delete it here.]

4.4 Prayer journal

The journal keeps your entries, prayer requests, names of people you pray for, reminder dates, and answers to prayer.

The journal is stored on your device:

• It is kept in an encrypted database (SQLCipher) with a random 256-bit key.
• The key is kept in the iOS Keychain or the Android Keystore. It does not leave the device.
• The journal is not stored on our servers. Only the entry selected to find prayer requests may be sent, with specific consent. A WhatsApp reminder sends only the day and a short title that you write (section 4.6).
• The journal is not included in Android backup or in transfer to a new device. On iOS, a backup copy does not open without the key, which does not leave the original device. So if you lose or change your device without exporting, the journal is lost.
• Reminders are local notifications with a generic text, such as "A reminder from your journal". They do not show what the request says.

You can export the journal as a JSON file through the system share sheet. The app deletes its temporary copy after 15 minutes. The exported file is not encrypted. After you send it, it is under the control of the app or person that received it.

You can delete the whole journal in the app. This deletes the file, the key, and all reminders on the device.

Entry dictation uses the microphone only when you tap the microphone button. Your device's own system turns your voice into text on the device. Dictation sends no audio or text to Candil. You can withdraw the microphone permission in your device settings. You can later choose to send the entry to find prayer requests, with specific consent. You withdraw that permission in the app's Settings.

Journal sync between devices does not exist yet. Before it starts, we will update this policy and ask for your consent.

If you ask to find prayer requests and give specific consent, the selected entry text goes to Candil's server. After the first risk check, Anthropic processes this text as our processor, to check risks and suggest requests. This can involve sensitive data about faith, health, and other people.

Neither Candil nor Anthropic stores this text. Candil does not log the text, suggestions, or provider error details, including in Sentry. You confirm each request before it is saved, only on your phone. This does not sync the journal.

Launch note: this feature stays off until legal review of this policy and the specific consent. Before enabling it, we must confirm Anthropic's zero data retention, as required for AI answers.

4.5 Share images

Verse images are made on your device. The link that goes with an image holds only the translation and the verse reference. It holds no data about you. To save an image to your gallery, the app asks for permission to add photos. It does not read your photos.

4.6 WhatsApp

WhatsApp is optional. The app works without it. This feature appears only in supported app regions after launch.
A valid code sent by the number connects that number to the code owner, even if it was linked to another account.
Phase 1 checks text with Bible references or quotations. Other text receives a short scope reply. In phase 1, media is not downloaded or transcribed.
We process your message text and available media captions in memory for crisis screening and verse checks. Phase 1 does not store or log content or replies.
When model screening is configured, text that passes the local risk matcher goes to Anthropic. Meaning-based checks can send screened text to Voyage AI.
A crisis reply uses contacts selected from your phone's calling code, or the global help directory when the country is unclear.

If you link WhatsApp from your signed-in account, we keep your linked number encrypted, a keyed number hash, and the link date.
You can unlink it in the app. Account export includes the linked number, and account deletion removes it and pending link codes.
One-time linking codes expire after ten minutes and are stored only as hashes. Sender attempt counters use keyed hashes.
We keep keyed message ID hashes for 48 hours to prevent duplicate processing. Expired codes, counters, and message hashes are removed during periodic cleanup.
These security hashes contain no message content. Message hashes have no account link and can remain until cleanup after account deletion.

Meta is the processor for the optional WhatsApp channel and receives inbound messages, phone numbers, and our replies.
Meta also processes conversation data under its own WhatsApp privacy policy.
Phase 1 includes no WhatsApp inbox, media storage, audio transcription, or provisional account.

The daily verse on WhatsApp needs separate consent. We keep the decision, date, the version of the consent text you accepted, time, time zone, language, and translation. You can turn it off in the app or reply STOP or UNSUBSCRIBE. We keep the date and time of the last inbound message for a linked number to choose a message within the free window or an approved template. We keep delivery status by date for 30 days, never the message text. Meta receives your number and the message.

[CONFIRM in legal review: the consent basis, since choosing this channel may reveal religious practice.]

Prayer reminders on WhatsApp need their own separate consent. For each reminder, you write a short title of up to 80 characters. The prayer request, the names of people, and the entries stay on the device. We keep the day, the encrypted title, the time zone, the language, and the consent record. The message goes at 10:00 on the chosen day, in your time zone.

We delete the title after sending, after the last attempt, or when reminders pause. Periodic cleanup also deletes titles of reminders more than two hours late, even when sending is disabled. We keep the day and the delivery status for 30 days, for the export. Meta receives your number and the message with the title.

You can remove one reminder on its request, or all of them in Settings. Replying STOP pauses the reminders and the daily verse together. Deleting the whole journal or withdrawing journal consent also removes all WhatsApp prayer reminders of the signed-in account and their consent, when this device created a reminder that it has not removed yet. The account export includes the reminders and the titles that still exist. Unlinking the number or deleting the account deletes the reminders and the consent.

[CONFIRM in legal review: the legal basis for prayer reminders, since the title may reveal faith or health.]

We ask for audio consent before processing any audio. Groq transcribes it. Images need no consent step. Anthropic reads them for the verse check; we keep neither images nor image text. Temporary files are deleted after processing; bucket cleanup removes files older than one day.

STOP withdraws audio consent and deletes notes not yet connected to an account. Notes already in an account stay for review. You can discard them or save them in the app. Inbox notes expire 30 days after receipt and are pruned. We never log religious content, transcripts, image text, phone numbers, or messages.

4.7 Subscription

The subscription is sold through the Apple App Store or Google Play. The store handles payment. We do not receive your card number. We receive purchase data from the store, such as the product, the subscription status, the dates, and a transaction ID. [CONFIRM the exact list after the payments integration.]

4.8 Technical data

• IP address, date, and time of access. Brazilian law requires us to keep these access records for 6 months, in confidence (Marco Civil da Internet, Law No. 12,965/2014, art. 15).
• Device language and region, to pick the Bible translation, help lines, and prices.
• Error reports (Sentry), with device, system, and error data. We configure these reports to leave out search text, questions, journal text, and tokens.
• Notification token (Firebase Cloud Messaging), if you allow notifications.

The app and site send anonymous event counts for feature use, onboarding, offers, purchases, shared page visits, and store badge clicks. We keep only daily UTC totals by event, platform, supported region, and app language. We store or log no account ID, device ID, IP address, user agent, verse, question, prayer, journal text, or other content with an event. We use our own counters, with no third-party analytics provider. Periodic cleanup removes totals older than 400 days.

To stop abuse, we keep a scrambled code made from your IP address for one hour. It is not linked to the counts. Periodic cleanup deletes expired codes. You can turn the app counts off in Settings.

Platform request logs are configured not to keep the text of searches and questions.

4.9 Support

If you write to us, we keep your message, your contact details, and our reply.

4.10 Account personalization

When you are signed in, we store your language, reminder setting, and local reminder times in your account. These choices then apply on another device, on the home screen, and in notifications.

Church, tradition, and reasons for using Candil can reveal religious belief. They go to your account only with a specific, separate consent: "Keep my faith answers in my account, to use on another phone." This consent applies to each account. It is different from the consent to keep data only on the device. Without it, these answers never leave the device, but language and reminders still sync.

We record the decision, its time, and the version of the text shown to you. If you choose "Not now" on a device, the account keeps what it already had, and that device neither sends nor uses these answers. To remove the answers from the account, use "Remove from my account" and confirm. Removal needs an internet connection. When devices sync after removal, they delete answers received from the account. Answers entered on each device stay. If another account signs in on the same device, it asks for its own consent. When you sign out, the device deletes the answers that came from the account and keeps the ones you entered on it.

Preferences stay until you replace them, remove them, or delete your account. Account export includes the saved preferences and consent record. Account deletion removes them with the other linked data. We never write the preferences document to logs.

4.11. Groups

Joining a group requires specific consent to store your display name and show your shared content to its members. We record the consent time and policy version. Group membership may reveal religious belief. Group studies use the selected source and retrieved passages through the crisis gate and AI providers described above. Prayer requests never go to Anthropic or Voyage.

Prayer requests need separate consent in each group and confirmation for each post. The app shows how many people can read the request. Do not include another person's health data without their permission. Requests are encrypted at rest and expire after 90 days. You can delete your requests at any time. Withdrawing prayer consent or leaving the group deletes your requests.

The leader can remove members and delete requests. Invite links expire after seven days and allow up to 50 joins. Public study links expire after 60 days. Anyone with a live study link can read the study and group name. Public pages show no member list or prayer requests. The leader controls publication and can delete the study to remove access.

Account export includes your groups, memberships, studies you created, and your decrypted prayer requests. Account deletion removes your memberships and requests. Deleting a leader account also deletes the leader's groups, studies, and all requests in those groups. Normal database backups follow the retention described in this policy.

5. Why we use data and on what legal basis

When we rely on legitimate interest, we first check that it does not override your rights. You can ask for this assessment through the contact in section 14.

6. Risk check

Every search and every question for the AI passes a risk check before any other step. It looks for signs of danger, such as thoughts of suicide or violence. If it finds them, the app shows the help lines for your country, such as 988 in the US, and does not run the search. If the check fails, the app also shows the help contacts.

• The checked text is not stored or logged.
• The result of the check is not linked to your account.
• Today the check runs on our server. In the future it may also use an AI provider from section 8, under the same rules.

The check is a safeguard. It is not health care and it can be wrong. If you are in danger, call your local emergency number.

7. Where data is kept

• Database: Postgres on Neon, in the São Paulo region (AWS sa-east-1).
• Server: Google Cloud Run, in the São Paulo region (southamerica-east1).
• Files: Google Cloud Storage, in the São Paulo region (southamerica-east1).
• Audio: Google Cloud Storage, in the São Paulo region (southamerica-east1). Contains only public Bible text.
• Journal: only on your device.

When you play audio, your device sends normal connection data to Google. This feature does not record your voice.

Some providers process data outside Brazil (section 9).

8. Who we share data with

We share data only with processors that help us provide the service. They may use the data only on our instructions.

AI providers: we configure Voyage AI and Anthropic not to use your data to train models. Voyage AI must keep data for the shortest period it offers. [VOYAGE AI RETENTION PERIOD]

Anthropic must retain no data for AI answers or finding prayer requests. We must confirm this before enabling these features. We will verify these settings before launch and whenever the providers change their terms.

We may also share data when the law or a court order requires it, to defend rights, or in a sale or merger of the company. In that last case, the new company must follow this policy.

We do not sell your data. We do not share your data for cross-context behavioral advertising.

9. International transfers

Some processors are located or process data outside Brazil, mainly in the United States. In these cases we use one of the grounds in art. 33 of the LGPD. For processors outside countries recognized as adequate, we adopt the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024). [CONFIRM, for each processor, the country and the instrument used.]

For people in the European Union, data comes to Brazil. The European Commission recognized Brazil as offering an adequate level of protection in January 2026. [CONFIRM the reference of the decision in the Official Journal of the EU.] For processors outside the EU and Brazil, we use the European Commission's standard contractual clauses, or the EU-U.S. Data Privacy Framework when the processor takes part in it.

10. How long we keep data

After these periods we delete or anonymize the data. We may keep data longer only when the law requires it or to defend rights (LGPD, art. 16).

11. Export and delete

• Export your account: in the app, under [PATH IN APP], you download your account, identity, session, pending code, preferences, and consent record data as JSON.
• Export your journal: in the app, under Journal, "Export my journal".
• Delete your account: in the app, under [PATH IN APP]. We delete the account, identities, sessions, and linked data at once. If you signed in with Apple, we ask Apple to revoke access. Backup copies are deleted in their normal cycle, within [NEON BACKUP PERIOD].
• Delete your journal: in the app, under Journal, "Delete the whole journal".

Deleting your account does not delete the journal on your device, and deleting the journal does not delete your account. Uninstalling the app also deletes the journal.

If you subscribe through a store, deleting your account does not cancel the subscription. Cancel it in the App Store or Google Play (see the Terms of Use).

12. Your rights

12.1 Brazil (LGPD)

You can ask at any time (art. 18) for:

• confirmation that we process your data;
• access to the data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed against the law;
• portability of the data;
• deletion of data processed with your consent;
• information about who we share data with;
• information about the option not to consent and its consequences;
• withdrawal of consent.

You can also object to processing done without consent if it breaks the law. You can ask for review of decisions made only by automated means. We reply within 15 days where the law sets that period. You can also complain to the Brazilian National Data Protection Authority (ANPD) at https://www.gov.br/anpd.

12.2 European Union and European Economic Area (GDPR)

You have the right of access, rectification, erasure, restriction of processing, portability, and objection (arts. 15 to 21). You can withdraw consent at any time (art. 7(3)). You can complain to the data protection authority of your country (art. 77). We reply within one month, which the law allows us to extend in some cases.

EU representative: [EU REPRESENTATIVE, if required by GDPR art. 27].

12.3 United States

Residents of states with a privacy law, such as California (the CCPA, as amended by the CPRA), may have the right to:

• know what data we collect, where it comes from, why we use it, and who we share it with;
• access and get a copy of the data;
• correct and delete data;
• opt out of sale, sharing for advertising, and profiling;
• limit the use of sensitive data;
• not be discriminated against for using these rights;
• appeal our refusal, where the state law provides an appeal.

What we do:

• We do not sell personal information and do not share it for cross-context behavioral advertising. We have not done so in the last 12 months.
• We treat religious belief as sensitive data. We process sensitive data only with your prior opt-in consent and only to provide the service you asked for.
• We honor the Global Privacy Control signal as an opt-out request.
• CCPA categories we collect: identifiers (account, email, IP), commercial information (purchases), internet activity (app use and error reports), and sensitive personal information (religious beliefs, account login data). We do not use this information to infer characteristics about you.
• You can make a request through the contact in section 14. An authorized agent can also ask for you. We will verify your identity first. We reply within 45 days, which the law allows us to extend.

13. Children and teens

Candil is not made for children. It must not be used by anyone under 13, or under 16 in the European Union (or the lower age set by the member state), without the consent of a parent or legal guardian.

[CONFIRM the mechanism before launch.] When an account is created, we ask the person to confirm their age. Below the minimum age, the app asks for the consent of a parent or guardian, under art. 14 of the LGPD, art. 8 of the GDPR, and the US COPPA law. If we learn that we collected data from a child without this consent, we delete the data. Parents and guardians can ask us to do this through the contact in section 14.

14. Data protection officer and contact

Data protection officer (encarregado, LGPD art. 41): [DPO NAME]
Email: [DPO EMAIL]
Address: [ADDRESS]

Use this contact to exercise your rights, withdraw consent, or ask questions.

15. Security

We use encryption in transit and at rest, tokens stored only as hashes, keys separated by purpose, attempt limits, and restricted access to systems. Logs do not keep tokens, codes, email addresses, or the text of searches and questions. No system is fully secure. If a security incident may cause relevant risk or harm, we will tell you and the ANPD, as LGPD art. 48 requires, and the authorities of other countries when their law requires it.

16. Changes to this policy

We may change this policy. When a change is material, we will tell you in the app before it takes effect. If a change needs new consent, such as journal sync, we will ask first. The effective date at the top shows the current version.