Privacy policy.

1. Summary

Midvash is a daily devotional and Bible study app available on the web, on mobile (iOS, Android), and as a browser extension. We collect only the data needed to run the product, measure how people find it, and keep it working. We do not sell personal data, and the Bible reader shows no ads. This page lists every category of data we handle and every provider that processes it.

2. Who we are

"Midvash" refers to the project published at midvash.com, including the iOS and Android applications and the Chrome extension. The project is operated by an independent developer. For data-related questions, contact contact@midvash.com.

3. What we collect

On the web (midvash.com). Reading does not require an account. Server-side request logs (URL accessed, IP address, user-agent, timestamp) are kept by our hosting provider for a limited period for operational and security purposes. We use Google Analytics and the Meta Pixel, loaded through Cloudflare Zaraz, to measure visits and the performance of our ads (for example, which campaign brought a visitor and whether they started a subscription). These tools may set cookies and receive your IP address, browser information, and the pages you visit.

On the mobile apps (iOS, Android). Reading preferences (default translation, theme, font size) are stored on your device. The apps use Google Analytics for Firebase to understand feature usage and the Meta SDK (App Events) to measure app installs and subscriptions that come from our ads. On iOS we do not collect the advertising identifier (IDFA); ad measurement uses Apple's SKAdNetwork. For Apple Ads campaigns, the app also collects Apple's AdServices attribution token, which does not use the IDFA and which RevenueCat exchanges with Apple to learn which campaign brought a subscriber. On Android the Meta SDK may use the Android advertising ID, which you can reset or delete in your device settings. The Android app reads the Google Play install referrer, which tells which link or ad led to the install, and sends it to our servers when you create an account. The Android app sends crash reports (device model, OS version, error details) to Sentry so we can fix bugs.

On the Chrome extension. Detection of Bible references happens entirely on your device. No page content leaves your browser. Detailed policy at midvash.com/chrome-extension/privacy.

4. What we do NOT do

We do not sell or rent personal data to anyone. We do not show ads inside the Bible reader or the devotional. We do not offer Facebook Login and do not access your Facebook or Instagram account. We do not send your notes, highlights, prayers, or chat messages to advertising or analytics providers.

5. Account

Creating a Midvash account is required for sync and account features (devotional, notes, highlights, reading plans, AI chat, subscription). When you create an account, we collect:

• Email address: to identify your account and enable sign-in
• Display name: pre-populated from your Apple or Google profile, editable later
• Profile picture: pre-populated from your Apple or Google profile, optional
• Gender and date of birth: optional, used only to personalize content, editable or removable in your profile
• Preferred locale and Bible translation: to sync your reading preferences across devices
• Your personal library and activity: bookmarks, highlights, notes, prayers, reading position, reading plan progress, devotional streak
• AI chat and study conversations: stored so you can return to them
• Subscription status: whether you have Midvash Pro and until when
• Origin of your account: which ad, campaign, link or site brought you to Midvash, the ad click identifier, the first page you visited, and your platform and app version. We use this to measure our ads and do not send it to advertising providers
• Time zone and email: your time zone, so emails arrive at the right hour, which Midvash emails you have already received, and whether you unsubscribed from these emails

We do not store passwords. Authentication uses Sign in with Apple, Sign in with Google, or a one-time code or link sent to your email.

Emails we send. Besides sign-in emails, we send a few emails about Midvash: welcome emails in your first days, a reminder if you have been away for a while, and, if you tried to open a Pro feature without a subscription, an email about it the next day. At most one per day. Every one of these emails has a link to unsubscribe, and you can also ask at contact@midvash.com.

6. Your daily study and memory

Midvash Pro includes Your daily study. The first part is the same for everyone. Below it, the For you part connects the passage to what you have been living. To do that, Midvash can remember a few things about you. We call this memory.

On for Pro, off when you want. Memory is only for Pro subscribers. For them, four of the five switches below come on, and the prayer requests switch comes off. Your faith is sensitive personal data (LGPD art. 11, I in Brazil; GDPR art. 9 in the EU). So you can turn off any switch at any time in your account, in the section “Rabbi remembers this about you”. A switch you turn off stays off until you turn it on again.

The five switches. Each one decides what Rabbi, the Bible chat, can use in your daily study and your conversations:

• Remember my profile: your first name, gender, age and birthday, what you wrote about yourself, and your answers to the welcome questions.
• Remember my preferences: your preferred Bible version.
• Remember my conversations: short reminders taken from your Bible chat conversations (for example, “wants to read the whole Bible this year”). With the switch on, the gear next to it opens the list, where you can correct or delete each one.
• Remember my prayer requests: your active prayer requests. This switch starts off and asks for a second yes.
• Remember what I do in the app: your notes, highlights, the devotionals you completed and your streak.

Turning a switch off deletes nothing: what it covers just stops being used. While the conversations switch is off, no new reminders are created, and those conversations do not become reminders later. Even with every switch off, Rabbi still receives today's devotional, the time of day, and what you write in the conversation itself.

“Who I am”. When you open the section, Rabbi writes a short summary about you, in the first person. It uses only your profile, your conversation reminders and your prayer requests, each with its switch on, and leaves out anything that sounds like a moment of crisis. You can change it whenever you want. The text Rabbi wrote is only for you to read: it does not go to the AI in the chat or the daily study, and it is rewritten without a source when you turn that source off and open the section again. If you write your own version, Rabbi does not write over it unless you ask, and your version goes to the AI in the chat and the daily study while the profile switch is on. If you turn off every switch, the text Rabbi wrote is deleted, and the one you wrote stays saved but unused until you clear it or delete everything.

What it is for. Only your daily study, your own Bible chat conversations and the “Who I am” summary. It does not go to ads, Meta, or analytics. It is not used to train AI models. Your daily study, the reminders, and “Who I am” are written by AI on Cloudflare Workers AI. When you talk to Rabbi, what memory allows is sent along with your message to Anthropic, only to build the answer (see section 8).

Deleting everything. The “Delete everything Rabbi remembers” button in the same section deletes your conversation reminders, your personal daily studies and “Who I am”, and turns memory off until you turn a switch on again. It does not delete your notes, highlights, prayer requests, profile or chat conversations: they stay where they are, and you manage them there. If your Pro ends, memory stops being used and the section no longer appears, but what was saved stays. To have it deleted, write to contact@midvash.com or delete your account (see section 10).

In the iOS and Android apps. The apps still show an older version of this screen, with one general switch, a prayer requests switch, the lists of what goes in, “Don’t use this” and the delete button. The five switches and “Who I am” are only on the web for now. It is the same account, so what you choose on the web also applies in the apps. In the apps, turning off the general switch turns off all memory, prayer requests included, and turning it back on does not turn prayer requests back on. “Don’t use this” takes a note, highlight, welcome answer, prayer request or devotional out of your daily study and “Who I am”. It can be undone only in the app, with “Use again”, and it stays even after you delete everything. The older screen does not show “Who I am”, can list reminders while the conversations switch is off, and says some things are always used. Where it differs, this section is what applies.

How long we keep it. Each personal daily study is deleted after 90 days. Reminders stay until you delete them or Rabbi updates them after a later conversation. Deleting your account deletes all of it (see section 10).

7. Authentication providers

You can sign in to Midvash using:

• Sign in with Apple: Apple authenticates you and shares your name and email with Midvash on first sign-in. If you choose Apple's "Hide my email" feature, you'll get a relay address (something like abc123@privaterelay.appleid.com); we'll only ever see that relay. We do not see your Apple ID password or have any further access to your Apple account.
• Sign in with Google: Google authenticates you and shares your name, email, and profile picture with Midvash. We request only basic profile scopes (no access to your Gmail, Drive, contacts, or calendar). We do not see your Google password.
• Email: you enter your email and we send a one-time sign-in code or link valid for 15 minutes. No third party involved.

You can revoke Midvash's access to your Apple or Google account at any time:

• Apple ID settings → Apps Using Apple ID
• Google account permissions

8. Providers that process data

We share data only with the providers below, and only for the purpose described:

• Cloudflare: hosting, CDN, security, and database. Stores your account data. Also runs the AI models for the daily study, memory, and summaries (Cloudflare Workers AI) and carries Rabbi messages to Anthropic through Cloudflare AI Gateway. The AI Gateway does not keep a copy of the conversations. Sends our emails.
• Anthropic: generates the answers of Rabbi, the Bible chat, with the Claude model. Receives your messages, the conversation history, the passage or entry you are studying, and what memory allows. Under Anthropic's commercial terms, this data is not used to train models and may be kept for a limited time for safety. If Claude fails, the answer is generated by a Cloudflare Workers AI model.
• Apple and Google: sign-in (when you choose it) and processing of in-app purchases through the App Store and Google Play.
• RevenueCat: manages subscriptions. Receives an anonymous app user ID, your purchase history, and your country. Also handles subscriptions bought on the website (RevenueCat Web Billing).
• Stripe: processes card payments for subscriptions bought on the website. Receives your payment details and your email. Midvash never sees your card number.
• Google Analytics and Google Analytics for Firebase: usage statistics on the website and apps.
• PostHog: usage statistics, error reports, and session recordings on the website and apps, to improve the product. Text you type and personal content such as notes, prayers, and chat messages are hidden from recordings. Visitors in the European Union are not measured.
• Meta (Facebook and Instagram): measurement of our ads through the Meta Pixel on the website, the Meta SDK in the apps, and subscription events sent from RevenueCat. Meta receives events such as page view, app install, trial start, and purchase, plus technical data (IP address, device and browser information). We do not send your name, notes, or reading content.
• Sentry: crash reports from the Android app.
• Legal requirements: we comply with valid legal requests (subpoenas, court orders) when required by applicable law.

Each provider handles data under its own privacy policy. We do not sell personal data and do not share it with data brokers.

9. Your choices

You can block or delete cookies in your browser settings. You can limit ad tracking on your device (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Privacy → Ads). You can manage how Meta uses data from other apps and websites at Your activity off Meta technologies. Instructions to delete data associated with Meta are at midvash.com/facebook-exclusion.

10. Account deletion

You can delete your account at any time from Settings → Account → Delete account in the app, or by emailing contact@midvash.com.

When you delete your account, we immediately mark it as deleted and revoke all active sessions. Your personal data (profile, bookmarks, notes, reading position) remains in a recoverable state for 30 days. During this grace period you can restore your account by contacting us. After 30 days, all associated data is permanently and irreversibly purged from our servers. Deleting your account does not cancel a subscription bought through the App Store or Google Play; cancel it in your store account. If you subscribed on the website, cancel it in your account, under Subscription, or write to contact@midvash.com.

11. Children

Midvash is suitable for general audiences. We do not knowingly collect personal information from children under 13. Account creation is restricted to users aged 13 and over. If you believe we have inadvertently collected data from a child under 13, contact us and we will delete it.

12. Your rights

Subject to applicable law (LGPD in Brazil, GDPR in the EU, CCPA in California, and similar regulations elsewhere), you have the right to access, correct, export, and delete the personal data we hold about you, and to object to its use for ad measurement. To exercise these rights, write to contact@midvash.com.

13. Security

We use industry-standard practices to protect data in transit (HTTPS) and at rest (encrypted databases). On mobile devices, authentication tokens are stored in the operating system's secure storage (iOS Keychain, Android Keystore), encrypted at rest by the OS. No system is perfectly secure; in the event of a breach affecting personal data, we will notify affected users as required by applicable law.

14. Changes to this policy

If we change this policy materially, we will publish the updated version at the same URL with a new Last updated date. For changes that affect how we handle data, we will notify users through the app or by email when applicable.

15. Community

The Community is optional. You only join after accepting its rules and stating that you are 13 or older.

Profile and search. Anyone with an account who is in the Community can see your profile (first name, photo, bio and what you posted to the whole Community) and find you by name. You can leave the search in the “Me” tab. When you invite someone by email, we use the address you typed only to send that invitation, once.

What other people see. What you post (prayer requests, verses with your sentence, milestones and comments) appears with your first name and photo to the people you choose: the whole Community in your language, only your friends, or only one group. A prayer request can be posted without your name. Your prayer journal stays private: nothing from it goes to the Community unless you decide to take a request there yourself.

Friends. Your friends see your profile (bio, day streak, posts) and, if they follow the same reading plan, whether you have read today. You can turn off the streak and the plans in the “Me” tab of the Community.

Sensitive data. A prayer request can reveal your faith and your health. Posting is your choice, request by request, and you can delete it whenever you want.

Moderation. Before it appears, the text goes through an automatic filter, and a Cloudflare AI model (Workers AI) reads it to hold back what looks offensive or like spam. Reported posts are reviewed by our team.

Invites and emails. When someone joins through your invite link, we keep that connection to count your reward. We send a friend request email, a reward email and a weekly summary; you can turn each one off in the “Me” tab.

Nothing in the Community is indexed by search engines or sent to advertising providers.

16. Contact

For questions, requests, or concerns related to this policy, write to contact@midvash.com.