Privacy Policy

Amos Standard is a Bible study and prayer app. It holds things people do not usually write down: questions they would not ask aloud, prayers, and private notes. This page explains what we keep, what we send elsewhere, and what we refuse to collect. It is written to be read, not to be survived.

Amos Standard is made and run by Viktar Danilchyk, one developer based in Poland. You can reach me at privacy@amosstandard.com — a real address, read by a person.

What we collect

Your account. You sign in with Google. We receive your email address and basic profile information from Google. We never receive your Google password.

What you create in the app. Your conversations — the questions you ask and the answers you receive — your prayer journal, your notes, your bookmarks, your reading progress, and your settings. This is stored so the app can show it back to you.

Unless you ask a question privately. Some questions are not ones you want kept anywhere, including here. The private chat — the eye icon beside New Chat — is not written down at all: no conversation, no question, no answer, nothing added to your history, and no record that you opened it. It lives in the browser tab you typed it in and ends when you leave the page; there is nothing to delete afterwards because nothing was stored. The one thing it cannot change is the section below — your question still has to reach the provider that answers it.

Basic technical data. Standard web server logs, and error reports when something breaks. The logs are kept by our host for seven days and record your IP address, your browser, and which address you opened — including which chapter you were reading. Error reporting is configured not to receive request bodies, cookies, authorization headers, account identifiers, or the text you write. It may receive technical diagnostics such as a stack trace, application route, browser type, and timing data.

If you report a problem with a text. The source cards carry a “Report a problem” button for when a passage in our library is damaged — a garbled word, a footnote spliced into a verse, a wrong author or date. What is sent is the reference of that passage and whatever you type into the box, and nothing from your conversation goes with it. These reports are read by a person, because that is the only way they get fixed.

What we do not collect

We do not sell your data. We do not share it with advertisers. There is no advertising in Amos Standard, and there are no advertising trackers on it.

We do not send your questions, answers, notes, or prayer journal to our analytics provider. The prayer journal and notes screens report nothing at all — not even the fact that you visited them.

There is no session recording and no heatmap tracking. The screen shows your question, the answer, your journal and your notes; a recording of it is not something we are willing to hold, or to hand to anyone else.

What is stored in your browser

There is no cookie banner on this site, and the reason is worth saying plainly rather than leaving you to wonder. Consent is required for storage that is not needed to provide what you actually asked for — tracking, advertising, profiling. There is none of that here. Everything below is either what keeps you signed in or a setting you chose yourself, and the law does not ask you to agree again to the thing you just did. You should still know what is there, which is what this section is for.

One cookie, so that you stay signed in. It is set by our sign-in provider and sent back to our own server, which is how a page knows it is you rather than a stranger. Without it you would sign in again on every screen. Signing out clears it.

Six settings, kept by the browser and never sent anywhere. Your light or dark theme (theme), your reading size (reading), your answer-depth preference (grace-guide.answer-depth.v1), whether you read prayers one at a time or as a whole (prayer-reader-mode), and two markers recording that you have already seen a one-time notice (onboarding-welcome-seen, tradition-onboarding-dismissed). These live in your browser’s own storage on the device you are using. They never reach us, they hold no identifier, and they say nothing about you beyond how you like the screen to look.

Unfinished prayers and listening preferences on this device. We keep unfinished guided-prayer sessions and journal drafts in browser storage so you can return after an interruption. These records can contain your own words and the passages you were praying with. They are separated by your account identifier; another signed-in account does not restore them. A draft is removed when you finish the prayer, save or discard the journal entry, or sign out. Signing out also clears this device's pinned prayers, choice to show prayer titles on Today, and audio position and continuation preference. Draft words are not sent to us until you choose to save them to your journal. Local drafts are not encrypted by the app, so sign out when you finish using a shared device.

None of this is analytics, and none of it is advertising. There is no advertising identifier on this site and nothing here follows you to another one. Analytics are a separate, optional thing described below, off unless you turn them on; even then, the analytics identity is held in the page’s memory for as long as the page is open and is not written to your browser’s storage.

One thing we do not control. The invisible check that keeps automated traffic off answer generation is a script loaded from Cloudflare, and it may keep short-lived technical data of its own to do its job. What that is belongs to Cloudflare to describe, and it does so in the Turnstile addendum linked under Who else handles your data below.

Clearing this site’s data in your browser removes all of it. Nothing in the list above is stored anywhere else, so clearing it costs you only the settings themselves, which you can set again.

How your questions are answered

This is the part most apps do not spell out, and it is the part you should know.

When you ask a question, the text of your question is sent to the AI providers we use to produce an answer. Here is exactly who gets what, and why:

The terms most relevant to this processing are OpenAI’s Services Agreement, Data Processing Addendum, and subprocessor list, and Mistral’s Commercial Terms and Data Processing Addendum.

We do not send your email address or your account number with the question. The provider receives the words you typed, not who typed them — unless you write something identifying into the question itself. The one exception is the name you may have set in Settings: if you have given one, it travels with the question, because that is what lets the answer address you. Leave it empty and nothing of the sort is sent.

How long they keep it, and what they do with it. OpenAI says API content is not used to train its models unless the customer opts in. Its abuse-monitoring logs normally retain API content for no more than 30 days, though OpenAI may keep it longer when legally required; its data-controls table lists no abuse-monitoring retention for the moderation endpoint. Mistral says API inputs and outputs may be retained for a rolling 30 days for abuse monitoring unless zero-data-retention terms apply. We have turned off Mistral’s separate training setting on our account, and Mistral receives a question only when the primary answer generator is unavailable.

Before a question leaves us, we strip the things people type by accident: email addresses, phone numbers, card-length runs of digits, and links carrying a token. We do not touch names — this library is made of them, and removing Paul or Jerusalem would make the question unanswerable.

Be clear about what that does and does not do. It removes what could tie a question back to a person; it cannot remove the substance of the question, because the substance is what we were asked to answer. So please treat anything you type into the question box as leaving our systems, and consider that when writing about something deeply private.

This applies to a private chat too. A private chat stops us from keeping your question; it does not stop the provider above from receiving it, because a question nobody reads cannot be answered. What it means in practice: nothing of it stays with us, and OpenAI may normally hold it in abuse-monitoring logs for up to 30 days, without your account identifier, unless a longer period is legally required.

One more check runs on your question. It goes to OpenAI’s moderation service — the same company, no one new. The service checks several safety categories; Amos Standard uses only its self-harm result, solely to decide whether to display a care note. Nothing is blocked or refused: the answer is written as it always would be, and the note suggests you also speak to someone who can be with you. We do not record that this happened, and it is not kept with your conversation.

Your prayer journal and your notes are not sent to any AI provider. They stay in our database.

Who else handles your data

Each of these holds data under its own privacy policy, linked so you can read it:

• Supabase (policy) — our database and sign-in provider. Everything you write is stored in Frankfurt, inside the European Union.
• Google (policy) — sign-in.
• Sentry (policy) — error and performance reporting. It is configured not to receive request bodies, cookies, authorization headers, account identifiers, or the text you write. It may receive technical diagnostics such as stack traces, application routes, browser type, and timing data. Event retention depends on the data type and our Sentry plan; Sentry publishes the current periods in its retention table and says its event-data backups are deleted after 90 days. Our project is currently hosted in the United States.
• Cloudflare (policy) — hosts the website and the services behind it, forwards email sent to our addresses, and runs an invisible check before an answer is generated to keep automated traffic off it. That check is Cloudflare Turnstile, and it sees your IP address, your browser’s user-agent and some technical signals about the connection — never the question you asked. Cloudflare describes what it does with those in its Turnstile Privacy Addendum.
• Resend (policy) — sends the email we write back to you, so a reply about your data comes from our own address rather than a personal mailbox. It sees your address and what we write; none of your conversations pass through it. We chose its Irish region, so the message leaves from inside the European Union, though the company itself is in the United States.
• PostHog (policy) — usage analytics, described below. Your data is held in PostHog’s European region.

Optional usage analytics, and how to turn them on or off

Analytics are off unless you turn them on in Settings. If you do, we record a masked page category and a short list of product events: whether a question was a follow-up, the answer-depth setting, a short/medium/long question-length bucket, where the question was started, how long the answer took, its number of sources and outcome, whether it was stopped, the position of a source you opened, an up/down rating, and whether an explanation was opened or continued. PostHog also receives the event time and ordinary technical information supplied by its browser library, such as browser, operating system and device type.

These records never contain your chosen church tradition, the author or category of a source, your questions, answers, notes, journal, name or email address. A private chat reports nothing at all. PostHog receives a separate random analytics identifier rather than your account identifier. We can connect that alias to your account in our own database so that we can erase it when you delete the account; this makes the datapseudonymous, not anonymous.

Using a Bible and prayer app may itself suggest religious interests. Turning analytics on is therefore your explicit consent to this optional processing by Amos Standard and PostHog. You can withdraw that consent in Settings at any time, without losing any feature. The choice belongs to your account, so it applies on every device. The PostHog identity is kept only in browser memory for the current page; no persistent PostHog tracking identity is needed because the account supplies the alias after login.

If the law asks for your data

We may have to disclose data when a valid legal order requires it — a court, or an authority acting within its powers. This has never happened, and we will say so here for as long as it stays true.

If it does happen, we will tell you, unless we are forbidden from telling you. We will not hand over more than the order actually demands. And we will not volunteer your data to anyone who merely asks politely, however official the letterhead.

Who can read what you write

Amos Standard is made by one person, so there is no “authorised personnel” to hide behind. I hold the keys to the database. Technically, I can read what is in it, and any policy that implies otherwise would be a lie told with a straight face.

So here is the rule I hold myself to, and you should hold me to it as well:

• I do not read your conversations, your notes, or your prayer journal — with one exception you choose yourself. Under an answer there is a button saying This answer is wrong. Pressing it hands me that question and that answer, on purpose, so I can see what went wrong and fix it. Nothing else from the conversation comes with it, and nothing is sent anywhere else.
• I open the database to repair something that is broken, or to answer a support message you have written to me about — and for nothing else. Not to see how the product is doing, and not out of curiosity.
• When I need to know whether something works, I use my own account.
• There is no team, no contractor, and no dashboard anywhere that displays your text to anyone.

A promise is worth more when something enforces it. Because your text is encrypted in the database (see Security), opening the database is not enough to read it — the key lives with the application, not beside the data. That does not put your journal beyond me, and I will not pretend it does. It does mean nobody reads it by accident, and it means the answer to “who else could” is genuinely nobody.

How long we keep things, and how to delete them

We keep what you create until you delete it. We do not delete live conversations or notes merely because they are old. A private chat creates nothing to keep, so nothing here applies to it.

You do not have to delete everything to delete something. Any single conversation, note, journal entry, bookmark, or memorised verse can be removed on its own, whenever you want, without touching the rest.

A deleted note has a brief Undo window. It disappears from the app at once, and the screen offers Undo for five seconds. Its encrypted database row and any saved exploration remain temporarily so that Undo can restore the same note. A cleanup runs every five minutes and permanently deletes rows that have been removed for at least five minutes, so this normally completes within about ten minutes. Until that cleanup, the row is included if you download your account data.

You can delete your account yourself, at any time, in Settings. It removes everything: your conversations, your prayer journal, your notes, your bookmarks, your reading progress, and your usage records from the live application database. That part is immediate and cannot be undone. There is no thirty-day grace period and no archived account sitting somewhere in case you change your mind. If you opted into product analytics, we queue deletion of the separate PostHog analytics profile in the same database operation and try it immediately. A cleanup checks every five minutes and retries a failed request after a fifteen-minute delay until PostHog confirms that it is deleted or was already absent. The retry record contains only the random analytics alias, not your account ID.

There is one copy, and it lasts seven days. We keep a daily backup of the database, because a service holding this much of people’s inner life ought to survive a hardware failure, and backups are how that is done. It is encrypted, and it is deleted after seven days. So when you delete your account it goes from the live database at once, and the last copy of it is gone within a week. That window is short on purpose: most services keep thirty days or more, and we would rather be able to say this sentence than have a deeper safety net.

We will not restore that backup to bring an account back, and asking us to will not work — it exists for a disaster on our side, not as an archive of you. If the seven days ever become longer, this page will say so before the change takes effect and not after.

If you would rather have a copy of your data first, you do not have to ask anyone for it: Settings → Download your data gives you one JSON file holding everything this account has — chats, notes, prayer journal, bookmarks, reading progress and settings. Nothing is held back from it. If you would rather have it by hand, or want it in some other form, write to privacy@amosstandard.com and we will send it within one month.

Why we are allowed to hold this (legal bases)

Amos Standard is run by one person living in Poland, so European data protection law (the GDPR) applies to everyone who uses it — including users in the United States. That is a higher standard than US law alone would ask for, and we are glad of it. It means we have to name the basis for each thing we do:

• To provide the app — your account, your conversations, your notes, your journal, your settings: performance of our contract with you.
• Your religious beliefs — your chosen tradition, your prayers, and the questions you ask all reveal religious belief, which the law treats as a special category requiring more care: your explicit consent, given when you create your account. You may withdraw it at any time by deleting your account, and we will delete the data with it.
• Keeping the service working and secure — error reports, server logs: our legitimate interest in a service that functions and is not abused.
• Optional usage analytics — your explicit consent. Analytics are off everywhere until you turn them on, and you may withdraw that consent at any time in Settings without losing any feature.

Sending data outside your country

Amos Standard is run from Poland, and most of the services it depends on are based in the United States — including the provider that answers your questions. Using the app means your data is processed there, under privacy laws that differ from your own. The standby answer generator is in France, inside the European Economic Area. Your account, your conversations and everything you have saved are stored in the European Union (Frankfurt).

Your rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal data, to restrict or object to processing, to withdraw consent, and to appeal if we refuse. If you are in California, this includes rights under the CCPA/CPRA; we do not sell or share personal information as those terms are defined there.

You also have the right to complain to a data protection authority. Ours is Poland’s UODO (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, and if you live in the EEA you may complain to your own country’s authority instead.

Write to privacy@amosstandard.com and we will respond within one month.

Security

Your data travels over encrypted connections, and it does not sit in the database as readable text. Your conversations, your notes, your prayer journal, and the tradition you have chosen are encrypted before they are stored, with the key held by the application and never kept in the database itself.

What that buys you is specific, so here is the honest version. If someone obtained a copy of our database — a stolen password to it, a leaked backup, a demand served on our database provider instead of on us — they would find unreadable text. What it cannot protect against is a break-in to the application itself, which necessarily holds the key. And it is not end-to-end encryption: you sign in with Google, so there is no password of yours to build a key from, and your question has to be readable to be answered at all.

Scripture passages you have saved are stored as ordinary text. They are the public Bible, and keeping them searchable is worth more than hiding what everyone can already read.

No system is perfect, and we will not claim otherwise.

If something goes wrong. If your data is exposed in a way that puts you at real risk, we will write to you and tell you what happened, what was affected, and what we did about it — without undue delay, and without waiting until we have a comfortable version of the story. We will also report it to our supervisory authority within 72 hours, as the law requires.

Children

Amos Standard is not intended for children under 18. We do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.

Changes

If we change this policy in a way that affects what we collect or who receives it, we will say so in the app before the change takes effect — not quietly, and not only by changing the date at the top. Every change is also listed below, in plain words, so you can see what moved and when.

What has changed

• September 8, 2026 — Added “What is stored in your browser”: the sign-in cookie and the six settings the browser keeps are now named, along with the reason none of them asks for your consent.
• September 8, 2026 — Made deletion of an opted-in PostHog analytics profile durable: the request is now queued before the account disappears and retried after failures until the provider confirms completion.
• September 8, 2026 — Added permanent cleanup for deleted notes. A note now has a five-second Undo button, remains recoverable in the live database only briefly, and is normally removed there within about ten minutes.
• September 3, 2026 — Corrected the AI providers’ policy and contract links, described their retention exceptions and the moderation categories, and replaced the absolute Sentry description with the technical data it may receive.
• September 3, 2026 — Made product analytics opt-in everywhere, removed church tradition, author and source category from events, replaced the account ID with a separate analytics alias, and corrected “anonymous” to “pseudonymous”.
• August 29, 2026 — You can now tell us an answer is wrong, with a button under it. It is the one case where you hand us a conversation to read, so it is written into the rule above rather than left as an exception you had to infer: pressing it sends that question, that answer, and anything you add — and nothing else from the conversation.
• August 29, 2026 — When we reply to an email you send us, the reply now goes out through Resend, so it comes from our own address instead of a personal mailbox. Resend is added to the list above: it sees your address and what we write back, and nothing else of yours reaches it.
• August 28, 2026 — Said what the server logs actually hold: your IP address, your browser, and the address you opened, kept for seven days by our host. That was already the case and this page said only “standard web server logs”.
• August 28, 2026 — The beta is open, so the waiting list is gone. We no longer ask for an address before you can sign in, the section describing that list has been removed from this page, and the list itself was deleted rather than kept.
• August 28, 2026 — Said plainly where your account, your conversations and everything you have saved are stored: the European Union, in Frankfurt. That was already true; it was simply not written down.
• August 28, 2026 — Said where things are kept rather than only who keeps them: what you write is stored in Frankfurt, and the Sentry project used for technical diagnostics is in the United States. Nothing moved; this names what was already the case.
• August 28, 2026 — Fly.io no longer runs anything of ours and has been removed from the list above. The services it used to host moved to Cloudflare, which was already listed.
• August 28, 2026 — Named the anti-bot check by its name, Cloudflare Turnstile, said what it sees — your address and browser, never your question — and linked Cloudflare’s own addendum for it. Nothing new is collected; this says plainly what already was.
• August 28, 2026 — Sentry, already listed, now also receives browser errors from the site itself. It is configured the same way as everywhere else: request contents and default personal identifiers are excluded.
• August 28, 2026 — The website moved from Vercel to Cloudflare. Vercel no longer receives anything and has been removed from the list above; Cloudflare, which was already listed for the anti-bot check, now hosts the site as well.
• August 28, 2026 — We now keep a daily backup of the database, encrypted and deleted after seven days. Until now there was none at all, which was safer for privacy and worse for you: a failure on our side would have lost everyone’s journals with nothing to restore from. A deleted account can now exist in that copy for up to seven days before it is gone everywhere.
• August 28, 2026 — You can now download everything your account holds from Settings, as one file, without asking anyone for it.
• August 28, 2026 — Added a way to report a damaged passage in the library. It sends the passage’s reference and what you write, never any part of your conversation, and it is read by a person so the text can be fixed.
• August 28, 2026 — Added the private chat: questions asked there are not stored and are not counted in usage analytics. This collects less than before, not more, and adds no new recipient of your data.
• August 6, 2026 — First published.

Contact

privacy@amosstandard.com

See also the Terms of Use.