Privacy Policy

This Privacy Policy explains what personal data Blessed Soul collects, why we collect it, and what your rights are. It is written to comply with the EU General Data Protection Regulation (GDPR) and applies to everyone who uses the Service, regardless of where you live.

1. Data controller

The data controller for personal data processed via Blessed Soul is:

Gabija Sadauskaitė
Debesijos g. 10, LT-10314 Vilnius, Lithuania
Individual activity certificate No. 1365546

For all privacy questions or requests, contact contact@blessedsoul.app.

2. What data we collect

We collect the following categories of personal data:

• Account data — your email address.
• Content you create — your highlights, saved verses, study notes, journal entries, prayer requests, and conversations with the AI study assistant. Today most of this is stored only in your browser on your own device (see Section 2a); it reaches our servers only once you have an account and sync is switched on, or when you submit a prayer request to the community prayer wall.
• Reading and usage data — which books, chapters and reading plans you open, your reading position, your streak, and the time you spend on each screen.
• Subscription data — your subscription status, plan, renewal date, and payment-processor identifiers (customer ID, subscription ID). We do not store your card number; that information is held only by our payment processor.
• AI conversation data — the text of the questions you ask the study assistant, the passage on screen at the time, and the reply we return.
• Analytics — anonymous session-level data captured by PostHog. PostHog runs in cookieless mode (memory-only session); see Section 8.
• Advertising and conversion data — when you interact with our site, we share certain events (e.g. page view, email submission, paywall view, checkout initiation, purchase) with Meta Platforms via the Meta Pixel and the Conversions API. Data shared includes a hashed version of your email address (SHA-256), your IP address, browser user-agent, and event metadata such as the page URL and event timestamp. See Section 4 (Processors) and Section 8 (Cookies and tracking technologies) for details.
• Email delivery data — open and click data from transactional emails we send via Resend (e.g. receipts and other account emails).

2a. Data kept on your device

Blessed Soul is built to work without an account. Your reading position, streak, highlights, saved verses, study notes, journal entries and private prayers are written to your browser's local storage on the device you are using. That data stays on your device: we cannot read it, we do not back it up, and clearing your browser data deletes it permanently. It leaves your device only if you sign in and enable sync, or if you choose to submit a prayer request to the community prayer wall.

2b. Special categories of data (GDPR Article 9)

Blessed Soul is a Christian devotional service. The fact that you use it — and the content of your journal entries, prayers and questions to the study assistant — may reveal your religious or philosophical beliefs. Under GDPR these are special categories of personal data and receive additional protection.

• Where such data is processed on our servers, we rely on your explicit consent (Art. 9(2)(a)), which you give when you create an account or when you submit a prayer request.
• Where you choose to publish a prayer request to the community prayer wall, we additionally rely on Art. 9(2)(e) — personal data manifestly made public by you.
• You can withdraw this consent at any time by deleting your account or emailing contact@blessedsoul.app. Withdrawal does not affect the lawfulness of processing carried out before it.
• Your journal entries, private notes and private prayers are never published, never shown to other users, and never used for advertising.

3. Lawful basis for processing (GDPR Article 6)

We process your personal data on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — for account data, subscription data, reading and usage data, and the AI conversations you initiate. We need these to deliver the Service you have subscribed to.
• Legitimate interest (Art. 6(1)(f)) — for cookieless analytics, email-delivery diagnostics, advertising measurement (Meta Pixel and Conversions API), and the prevention of fraud and abuse. Our legitimate interest is in operating, securing, growing, and improving the Service. We have balanced this interest against your rights and concluded that the processing is proportionate; you may object at any time (see Section 6).
• Consent (Art. 6(1)(a)), and explicit consent (Art. 9(2)(a)) — for the special-category data described in Section 2b, for any future marketing emails, and, where required by law in your jurisdiction, for non-essential cookies and advertising tracking. We currently send no marketing email; if we begin to do so, we will request your explicit opt-in first. You can withdraw consent at any time without affecting the lawfulness of past processing.

4. Third-party processors

We rely on third-party providers to operate the Service. These providers fall into the following categories: hosting and content delivery, authentication and database, payment processing, transactional email, product analytics, advertising and conversion measurement, and artificial-intelligence text and speech generation.

AI providers. When you ask the study assistant a question, the text of your question and the passage on screen at the time are sent to Anthropic to generate the reply. When you use audio narration, the text of the passage or story being read is sent to OpenAI to synthesise the audio. Both act as processors under agreements that prohibit the use of your content to train their models. Neither receives your journal entries or private prayers unless you paste that text into a question yourself.

Each provider is bound by a Data Processing Agreement that meets GDPR Article 28 requirements, and personal data is processed only for the purposes described in this policy.

A current list of named processors and their locations is available on request — email contact@blessedsoul.app.

5. Data retention

• Account data, subscription data, and reading and usage data — retained for as long as your subscription is active, plus thirty (30) days after cancellation, to allow for re-activation. After that we delete or anonymize.
• Content you create on our servers (journal entries, study notes, saved verses, highlights, prayer requests) — retained until you delete it or delete your account. Deletion is immediate and irreversible; we hold no separate archive of it.
• AI conversation data — retained for thirty (30) days for abuse prevention and quality review, then deleted.
• Legal and financial records (invoices, billing history) — retained for seven (7) years as required by Lithuanian tax law (Republic of Lithuania Law on Tax Administration).
• Analytics data — retained for twelve (12) months, then automatically deleted by PostHog.

6. Your rights under GDPR

You have the following rights with respect to your personal data:

• Right of access — you can request a copy of the personal data we hold about you. Email contact@blessedsoul.app.
• Right to rectification — if any data we hold about you is inaccurate, you can update it via your account settings or by email.
• Right to erasure — you can request deletion of your data, subject to the legal retention requirements set out in Section 5. Email contact@blessedsoul.app.
• Right to data portability — you can request a structured, machine-readable export of your data. Email contact@blessedsoul.app.
• Right to restrict or object to processing — you can ask us to pause processing or object to processing carried out on the basis of legitimate interest.
• Right to withdraw consent — applicable to any consent-based processing. You can withdraw consent at any time without affecting the lawfulness of past processing.
• Right to lodge a complaint — you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija — VDAI) at https://vdai.lrv.lt/, or with the data protection authority in your country of residence.

We respond to verified rights requests within thirty (30) days, as required by GDPR.

7. International data transfers

Some of our processors are based outside the European Economic Area (notably the United States). Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, additional supplementary measures, to ensure your data continues to receive a level of protection equivalent to that guaranteed under EU law.

8. Cookies and similar technologies

We use a small number of cookies and similar technologies, grouped as follows:

• Strictly necessary — authentication cookies set when you are signed in; a locale preference cookie. These are required for the Service to function and are exempt from consent requirements.
• Product analytics — PostHog runs in cookieless mode (memory-only session); sessions are discarded when you close the tab. No persistent tracking cookies are set by PostHog.
• Advertising and conversion measurement — the Meta Pixel sets cookies (`_fbp`, and `_fbc` if you arrived via a Meta ad click) on your device for advertising attribution and audience-building. The Conversions API mirrors selected events from our server.

If you are accessing Blessed Soul from the EU, EEA, or UK and you would like us to stop sharing your activity with Meta for advertising purposes, please email contact@blessedsoul.app and we will exclude your data from advertising processing. We will also configure browser-side consent before launching paid advertising campaigns in those jurisdictions; until then, you can use your browser's tracking-protection settings or an ad-blocker to opt out at the network level.

9. Age requirement

Blessed Soul is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you are under 16, please do not create an account or submit a prayer request without the consent of a parent or guardian. If you believe a child has provided personal data to us, please contact contact@blessedsoul.app immediately and we will delete the data.

10. Security

We protect your personal data using:

• TLS encryption for data in transit.
• Encryption at rest at the database level.
• Access controls that restrict your data to your own authenticated session.
• Backend credentials stored as encrypted environment variables.

We never store payment-card information; that data is held only by our payment processor.

No system is perfectly secure, and we cannot guarantee absolute security. If you become aware of a security incident affecting your data, please contact contact@blessedsoul.app.

11. Updates to this Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email at least fourteen (14) days before the change takes effect, and we will update the "Last updated" date at the top of this page.

12. Contact

For all privacy-related questions, requests, or complaints, email us at contact@blessedsoul.app. We will respond as quickly as we can and within the legally required timeframes.