1. Who we are and how to contact us
This notice covers the HolyHub website and mobile app. It explains how personal information is used for accounts, community discussions, groups and rooms, messages, Prayer Sky, sermons, study tools and any enabled AI companion.
The controller is OzGen AI LTD, the operator of HolyHub. The controller decides how and why your information is used. HolyHub is the product name.
- Company registration number: [NEEDS EDITING]
- Registered/business postal address: [NEEDS EDITING]
- Country of establishment: [NEEDS EDITING]
- Privacy and data requests email: [NEEDS EDITING]
- Support and safety complaints email: [NEEDS EDITING]
- DPO or UK representative, if required: [NEEDS EDITING]
You do not have to agree to this notice to read about your rights. Acceptance of our Terms is separate from consent to optional processing.
2. Privacy at a glance
- Your profile, posts, group activity and prayer content can be visible to other people depending on the feature and audience you choose.
- Direct messages and journals are not public, but HolyHub is not an end-to-end encrypted service. The service can process stored content to deliver features and handle permitted safety or legal requests.
- Faith preferences, prayers and personal stories may reveal religion, health or other sensitive information. Read the sensitive information section before using those features.
- AI conversations are sent to an external AI provider when that feature is enabled. Uploaded images, including images attached to notes, can be sent for automated safety assessment.
- You can change privacy settings, withdraw optional consent, and ask for access, correction or deletion. Deletion is a process, not an instant removal of every copy.
3. Information we collect and its sources
- Account information: account identifiers, username, email and verification information supplied through Sign in with Apple, an age band, account status, sign-in sessions, device security identifiers, and records of Terms and consent choices. Apple may supply a relay email address.
- Profile and preferences: display name, avatar, biography, language, theme, account visibility, optional denomination or tradition, Bible edition preferences, and recommendation settings.
- Community information: posts, replies, reactions, polls, bookmarks, follows, blocks, group membership and invitations, room attendance and participation, chat messages, images and relevant timestamps.
- Prayer Sky: prayer requests, encouragement messages, selected audience and visibility, interactions, reports and associated delivery information. A display described as anonymous does not remove all information that the service uses to operate it.
- Study information: notes, journals, notebooks, tags, links, shared snapshots, Bible reading and quiz progress, saved sermons and listening or viewing activity.
- AI information, if enabled: prompts, relevant conversation history, generated replies, selected language, permitted preference context, usage limits and safety information.
- Technical information: IP addresses and network information received by the service and its hosts, device and app versions, push tokens, connection events, errors, performance diagnostics, and onboarding events. These can be linked to an account.
- Support and safety: enquiries, reports, appeals, decisions, restrictions, moderator notes, audit records and information supplied by other users about content or interactions involving you.
The planned paid service also uses subscription status, product identifiers, transaction references and payment or entitlement records. The payment provider’s information flow must be confirmed; do not assume HolyHub receives your full card details.
Advertising and analytics are planned for launch. Relevant information can include impressions, clicks, referrals, device identifiers and interaction events, depending on the final configuration. The exact collection and recipients will be identified before activation.
We obtain information from you, your device, Apple sign-in, your interactions, other participants and the providers that deliver the service. We do not need your Apple password. The current age flow asks for an age band rather than a full date of birth.
4. Why we use information and our legal bases
UK data protection law requires a lawful basis for each use of personal information. This draft proposes the following allocation, subject to confirmation of the production service and documented necessity assessments.
- Contract, Article 6(1)(b): necessary account administration, sign-in, delivery of features you request, synchronisation, requested notifications, and responding to service enquiries.
- Legitimate interests, Article 6(1)(f): proportionate security, abuse prevention, service reliability, investigation of reports, and defending the service. The interests are a safe and functioning service. We must assess necessity and the effect on your rights, with particular care for children. This is not permission for unrelated tracking.
- Consent, Article 6(1)(a): requested launch marketing, optional analytics where consent is the chosen basis, optional personalisation and other uses presented as a choice. You can withdraw consent without affecting the lawfulness of earlier processing.
- Legal obligation, Article 6(1)(c): processing necessary to comply with an identified legal duty, such as responding to a valid binding order or meeting applicable safety and data protection duties. An internal preference is not a legal obligation.
Subscription administration and the delivery of purchased features use the contract basis where necessary; any legally required accounting records use the relevant legal obligation basis. Optional faith preferences and AI features also need the additional protection described below. Providing information necessary for an account or a requested feature is necessary to use that feature. Declining optional information or marketing does not prevent use of unrelated features.
5. Advertising, analytics and purchases
OzGen AI LTD plans to use Google AdMob for advertising, Amplitude for analytics, and RevenueCat to manage paid subscription status and entitlements. A planned integration does not establish its production configuration. Event inventory, identifiers, retention, ad personalisation model, provider roles and consent controls: [NEEDS EDITING].
Where optional tracking requires consent, it will stay off until you choose it, and you must be able to withdraw as easily as you gave consent. If a narrow PECR statistical exception is used instead, its conditions and free objection control must be met. A device permission or agreement to these Terms is not advertising consent.
Religious or health information and inferred belief profiles need additional protection. Google’s advertising policies prohibit selecting or targeting personalised ads from religious beliefs or other prohibited sensitive interests. Those signals must not be passed as an advertising audience. Child advertising safeguards and any age-based personalisation restrictions must also be enforced. Non-personalised advertising can still use device information and must be assessed for consent.
Amplitude’s standard contract restricts sensitive data, and RevenueCat’s current processing agreement prohibits submission of special-category data. Do not send denomination, prayers, message or journal text, health information or sensitive group labels to these services. Account participation and event context can still reveal beliefs; the permitted payloads and contractual treatment must be reviewed before activation.
RevenueCat manages subscription information; it is not necessarily the seller or the payment processor. The checkout will identify the actual app store or payment provider, price and renewal terms. HolyHub uses the transaction and entitlement information needed to provide a purchased feature, handle disputes and meet applicable record-keeping duties. See subscriptions, cancellation and refunds.
6. Religious beliefs and other sensitive information
Using a Christian community service can itself reveal religious beliefs. Denomination, tradition, Bible choices, prayers, journals, group participation and AI conversations can reveal religion, health, sexuality or other special category information. We must identify an Article 9 condition as well as an Article 6 basis before processing it.
Proposed approach: obtain explicit, specific consent for processing religious account context, optional faith preferences, sensitive private content and external AI processing where required. Choosing a denomination is optional. The present denomination consent alone does not establish permission for every sensitive feature.
We will explain the relevant purpose, audience, external processing and withdrawal consequence at the point of collection. Agreeing to Terms or simply continuing to use the app is not explicit consent. A separate condition may apply to information you deliberately make public or to a necessary legal claim, but private groups, messages and journals are not automatically public information.
Withdrawing denomination consent clears the stored denomination, tradition, edition preference and derived AI denomination context in the reviewed implementation. Withdrawing AI storage consent prevents further use of the companion; it does not automatically delete existing history. Ask separately for deletion.
Do not include another person’s sensitive information without their permission or another lawful justification. Safeguarding or criminal allegation processing requires a separately documented legal basis and, where applicable, a Data Protection Act condition and policy document.
7. Who can see your content
- Profiles and community content: visible according to the account, feature and audience controls. A private account is not a guarantee that every group post, prayer or room interaction is private.
- Groups and live rooms: membership, messages, attendance and participation may be visible to other members or room participants. Hosts and moderators receive the information needed for their roles.
- Direct messages: delivered to the intended participants. They can copy, screenshot or report messages.
- Standard study notes: stored for your use unless you choose to share a snapshot. A recipient may retain or copy a snapshot.
- Journals: sharing is blocked by the current app. Journal titles and content have additional encryption and are excluded from standard note search. Images remain subject to the media pipeline and safety assessment.
- Prayer Sky: visibility depends on the selected prayer or message feature. Do not put identifying information into a prayer you intend to appear anonymous.
Selected staff and providers may process information for service delivery, authorised support, safety and legal obligations. Other users may retain copies independently of HolyHub. Choose an audience carefully before sharing.
8. AI, image safety and recommendations
When enabled, the companion sends your message and relevant conversation context to the configured AI provider to generate a reply. The reviewed integration uses Google’s Gemini Developer API. AI history is stored in HolyHub’s database with field encryption. It is not a confidential counselling session.
Uploaded images and any supplied caption can be assessed by an external safety provider. The current production provider path uses OpenAI image moderation. This applies to the image upload pipeline, including note images; a journal setting does not make an uploaded image exempt.
Feed and group recommendations, participation indicators, rate limits and safety filters use activity and settings. Automated filters can hold or block content. You can use the reporting and appeal tools to challenge an enforcement action.
Pending launch condition: the operator has selected a 13+ audience and Google, but the Gemini Developer API terms currently restrict clients likely to be accessed by under-18s and require paid service for UK clients. The operator must resolve the provider arrangement before enabling this integration. A statement of consent does not remove that restriction.
Provider arrangements, data sent, provider retention/training terms, processing regions, safeguards, child access and human review routes: [NEEDS EDITING]. No promise that providers never retain content, never use it for training, or never allow authorised review has been verified. Whether any decision has a legal or similarly significant effect, and the safeguards it requires, also needs assessment.
9. Live audio, camera, photos and notifications
Live room audio is transmitted to participants through the configured audio infrastructure. The current local build uses self-hosted LiveKit; the accepted production plan selects Cloudflare Realtime SFU as its migration target. The reviewed product has no platform live-room recording feature. Participants might independently record or repeat what they hear. Room membership, connection, attendance and chat information is stored separately from the live audio. The final production audio provider and configuration are [NEEDS EDITING].
The app requests microphone access for speaking, camera or photo access for images, and notification permission for push delivery. Device permissions can be changed in your operating system settings. Refusing access limits the feature that needs it.
Push delivery uses a device token and notification routing information. Notification previews may be visible on a locked device. Adjust previews and notification settings if you use a shared device. A system notification permission is not consent to unrelated marketing.
11. Processing outside the UK
The accepted production database plan uses Neon AWS US East 1 (aws-us-east-1), in the United States, with relevant backend Workers placed nearby and a global Cloudflare edge. This is not UK-only or EU-only processing. The plan requires a separate transfer review before activation.
Global authentication, media, AI, ads, analytics and notification providers can also involve processing or remote access outside the UK. R2 jurisdiction, realtime locations, backup locations and the Amplitude US/EU project region are [NEEDS EDITING]. A provider’s “auto” setting does not establish where production data stays.
Before any restricted transfer, we must identify the destination and put a lawful transfer route in place, such as applicable UK adequacy regulations or an International Data Transfer Agreement or UK Addendum with the required assessment. Consent is not a routine substitute for those safeguards.
Actual destinations, applicable adequacy or contractual mechanism, transfer assessments and how to request a copy of safeguards: [NEEDS EDITING]. The monitored privacy contact will provide information about applicable safeguards, with confidential details redacted where needed.
12. Retention and deletion
Information is kept only as long as needed for its stated purpose, taking account of your requests, safety needs and applicable law. A final retention schedule must be approved and checked against the deployed cleanup jobs. The following describes reviewed code, not verified production operation:
- Notes and journals: a daily job permanently removes individually deleted notes after a seven-day recovery period, subject to successful processing and cleanup of related media.
- AI history: after deletion, the code changes the account link after 30 days, then removes conversation content 90 days after that change. This is roughly 120 days plus job scheduling, not 90 days in total. Removing an account link does not prove that personal details within a conversation are anonymous.
- Diagnostics: reviewed API error cleanup uses 90 days. Onboarding event cleanup defaults to 90 days and is configurable.
- Notifications: read notification groups are eligible for cleanup after 90 days; unread groups currently have no automatic age cutoff.
- Community and safety information: some discussion content may survive account closure with a changed author display. This alone is not anonymisation of identifying details in the content. Necessary report, appeal and audit evidence requires a justified retention period.
Outstanding retention decisions: active and inactive accounts, messages, prayers, media, unread notifications, consent records, safety records, waitlist information, billing records, analytics/advertising information, provider copies and backups: [NEEDS EDITING]. Account erasure currently has unfinished domain handlers and must be verified before a complete deletion promise is published.
Where erasure applies, we will assess it individually and explain any lawful exception. Backups need a defined expiry and a process to reapply deletion after restoration. Neither a blanket legal hold nor an indefinite retention period is justified merely by calling information a safety record. See account deletion and data requests.
13. Security
HolyHub’s source includes account access checks, server-side encryption for direct messages and AI conversations, and separate field encryption for journal titles and content. Standard notes do not have the same field encryption. The service holds the keys used to process encrypted fields, so this is not end-to-end encryption.
Secure production configuration, encrypted transport, key management, staff permissions, backups and incident response must be checked before launch. No online service can guarantee absolute security. Keep access to your device and Apple account secure and report suspected misuse promptly.
14. Young people
HolyHub’s selected minimum age is 13. The reviewed app blocks registration by people who select an age below 13 and permits a 13–17 age band. It sets newly created minor accounts to private. Age is currently self-declared; this is not verified age assurance. Required production age assurance, child consent and safety arrangements: [NEEDS EDITING].
If children can access HolyHub, we must assess their best interests, provide understandable explanations, minimise collection and sharing, and assess profiling, recommendations, harmful content and contact risks. Parental permission by itself does not satisfy all these duties. The legal age for online data consent is not the same as the age of contractual capacity or an age-safety assessment.
If you are young: avoid sharing your address, school, passwords or private details about others. Check the audience before posting. You can leave a room, block someone and report an interaction that makes you uncomfortable. Ask a trusted adult for support when needed. Your privacy rights still belong to you.
Parents or guardians can raise concerns through the confirmed support channel. We may need to verify authority and consider the young person’s own rights before sharing account information. AI access and provider age restrictions require a separate launch decision.
15. Your rights and choices
You can ask for access, correction, erasure, restriction and, where applicable, a portable copy of your information. You can withdraw consent and challenge relevant automated decisions. These rights have conditions and exceptions; we will explain any refusal.
Your right to object: you can object to processing based on legitimate interests because of your particular situation. You can object to direct marketing at any time, including related profiling, and we must stop that marketing.
Use the app’s privacy and consent settings or contact the controller. We normally respond to a rights request without undue delay and within one calendar month. If a permitted extension or pause applies, we will explain it and the reason. We may ask for proportionate information to verify identity. Requests are normally free.
Deleting the app does not delete your account. See account deletion and data requests for the available route and limitations.
17. Complaints and changes
Send a privacy complaint to the confirmed privacy contact. Our process will acknowledge it within 30 days, investigate appropriately and keep you informed of the outcome without undue delay. This is separate from the normal deadline for a data rights request.
You may complain to the Information Commissioner’s Office, the UK data protection regulator, or call 0303 123 1113. You may also have rights to complain to a regulator where you live.
We will date changes and bring material changes to your attention. A new use needing consent requires a new valid choice; continuing to use HolyHub is not consent. This draft has no effective date and will be updated after the outstanding details are resolved.