Privacy Policy

Warm Faith ("Warm Faith", "we", "us") is operated by [Legal entity name], [Registered address], [Country]. We are the controller of the personal data described in this policy — meaning we decide why and how it is processed.

This policy covers our website, the reading and prayer features, reading plans, small groups, games, and the mentorship service. It does not cover other companies' websites that we link to.

If anything here is unclear, or you want to exercise a right described below, write to hello@warmfaithforall.com. A person reads that address.

We group what we collect by why it exists, because that matters more than the labels.

Information you give us when you create an account

Your first name (or whatever name you choose), email address, and a password, which we store only as a salted hash. If you sign in with Google or Apple, we receive your name, email address and a stable identifier from them, never your password.

What you write and save

Prayers, journal entries, notes on passages, highlights, bookmarks, saved devotionals, plan progress, and answers to reflection questions. This is your content. We treat it as private by default — see 'Your private writing' below.

Onboarding and mentorship intake

If you ask to be matched with a mentor, we collect the answers you give: your season of life, what you are hoping for, the times you can talk, and the plan you choose. This may reveal beliefs or wellbeing information, so we treat it as sensitive and use it only for matching and support.

Small groups

The groups you ask to join, and anything you post inside a group. Group posts are visible to the other members and the host of that group — they are not private to you.

Payment information

If you subscribe to mentorship, our payment processor collects and stores your card details. We receive only the last four digits, the card brand, the billing country, and the status of each charge. We never see or store your full card number.

Usage and device information

Pages you open, features you use, approximate location derived from your IP address (city-level, not precise location), browser and operating system, and error reports. We use this to keep the service working and to decide what to build next.

Messages you send us

Support emails, bug reports and anything you attach to them.

We do not buy personal information about you from data brokers, and we do not build advertising profiles.

We use what we collect to:

• Create and secure your account, and keep you signed in.
• Save and sync your reading progress, prayers, notes and highlights across your devices.
• Suggest a plan at the end of onboarding, and show you where you left off.
• Match you with a mentor, arrange calls, and let you and your mentor message each other.
• Run small groups and show group members what has been posted in their group.
• Take payment, send receipts, handle renewals, refunds and failed charges.
• Send service messages: confirmations, reminders you asked for, security alerts, and changes to these documents.
• Send optional email — a daily or weekly devotional, or product news — only if you turn it on, and you can turn it off in one click.
• Keep the service safe: detect abuse, spam, and attempts to break in, and enforce our Terms of Use.
• Understand which features help people and fix the ones that do not, using aggregated counts rather than reading your writing.
• Meet our legal obligations, such as keeping tax records for invoices.

Prayers, journal entries, notes, highlights and bookmarks are visible only to you. They are not shown to other members, they are not shared with your mentor unless you send them, and they are not published anywhere.

Our staff do not read your writing as a matter of routine. A small number of engineers can access production systems, and therefore this content, only when it is necessary to fix a specific fault, investigate a security incident, or respond to a request you have made. Those accesses are logged and reviewed.

The exceptions are narrow: we may access content where we are legally required to, where we need to protect someone's life or safety, or to investigate a serious violation of our Terms of Use that has been reported to us.

Where the GDPR or similar laws apply, we rely on these bases:

Performance of a contract

Running your account, saving your content, providing mentorship you have paid for, and taking payment.

Legitimate interests

Keeping the service secure, preventing abuse, understanding aggregate usage, and improving what we build — balanced against your rights, which we assess before relying on this basis.

Consent

Optional emails, non-essential cookies, and any processing of sensitive information such as the details you share when asking for a mentor. You can withdraw consent at any time.

Legal obligation

Accounting and tax records, and responding to lawful requests from authorities.

Vital interests

Rare situations where acting is necessary to protect someone's life.

We never sell personal information, and we do not share it for cross-context behavioural advertising. We share it only in these situations:

Service providers

Companies that run parts of the service for us: hosting and content delivery, database and backup storage, payment processing, email delivery, video calls for mentorship, and error monitoring. They may process your data only on our instructions and under a written agreement.

Your mentor

If you are matched with a mentor, they see your first name, the intake answers you gave, the plan you are on, your call schedule, and any message or note you choose to send them. They do not see your private journal, prayers or highlights.

Small group members and hosts

What you post in a group, and the first name on your profile.

Legal and safety

Where we are required to by law, or where disclosure is necessary to protect the rights, property or safety of any person. We will tell you about such a request unless we are legally prevented from doing so.

Business transfers

If Warm Faith is ever acquired or merged, information may transfer to the new owner, who must continue to honour this policy or give you notice and a choice before changing it.

We use a small number of cookies and similar storage. Strictly necessary ones keep you signed in, remember your reading preferences such as text size and dark mode, and protect forms against abuse; these cannot be switched off without breaking the service.

Analytics storage, if enabled in your region, tells us which pages are used and where people get stuck. We ask for consent before setting non-essential storage where the law requires it, and you can change that choice at any time.

Some preferences — such as your reading settings and plan progress — are kept in your browser's local storage rather than on our servers. Clearing your browser data removes them.

• Account data: while your account is open, and for 30 days after you delete it, so an accidental deletion can be undone.
• Your writing (prayers, notes, journal, highlights): until you delete it, or until 30 days after your account is deleted.
• Mentorship records: for the duration of the mentorship and 12 months afterwards, so you can return to the same mentor.
• Payment and invoice records: for as long as tax and accounting law requires, usually five to ten years depending on the country.
• Server and security logs: up to 90 days, except where an investigation requires keeping them longer.
• Backups: encrypted, rotated, and fully expired within 90 days.

After those periods we delete the data or irreversibly anonymise it so it can no longer be linked to you.

• Everything travels over encrypted connections (TLS), and data is encrypted at rest.
• Passwords are stored only as salted hashes; nobody at Warm Faith can read them.
• Access to production systems is limited to the people who need it, protected by multi-factor authentication, and logged.
• Backups are encrypted and restore procedures are tested.
• We review the code and the providers we depend on, and we patch promptly.

No service can promise perfect security. If a breach ever affects your personal data, we will notify you and the relevant authority within the time the law requires, and tell you plainly what happened and what to do.

Wherever you live, you can:

• Access a copy of your personal data, and export your writing in a portable format.
• Correct anything inaccurate, directly in your profile or by asking us.
• Delete your account and its contents.
• Object to or restrict processing based on our legitimate interests.
• Withdraw consent for optional email or non-essential cookies, without affecting what came before.
• Ask a human to review any decision you think we got wrong.

To exercise any of these, use the controls in your profile or write to hello@warmfaithforall.com. We answer within 30 days, and we will not charge you or treat you differently for asking. We may need to confirm your identity first, to make sure we are not handing your writing to someone else.

If you are in the EEA or the UK and you think we have handled your data badly, you may complain to your local data protection authority — though we would rather you told us first, so we can fix it.

European Economic Area and United Kingdom

You have the rights described above under the GDPR and UK GDPR. Our legal bases are listed in section 5. Where we transfer data outside your region, we rely on Standard Contractual Clauses or an adequacy decision, and we assess the destination country's laws before doing so.

California

In the past 12 months we have collected the categories described in section 2 and disclosed them only to the service providers described in section 6. We have not sold or shared personal information for cross-context behavioural advertising, and we do not knowingly do so for anyone under 16. You have the right to know, delete, correct, and to limit the use of sensitive personal information; we do not use sensitive information for purposes beyond providing the service. We will not discriminate against you for exercising these rights.

Brazil

Under the LGPD you may request confirmation of processing, access, correction, anonymisation, portability, deletion, information about with whom we share data, and to withdraw consent. Our controller contact is the address in section 1.

Other regions

If your local law gives you stronger rights than this policy, those rights apply — tell us and we will honour them.

Warm Faith is hosted on servers operated by our infrastructure providers, and our team and mentors may be in other countries. That means your information may be processed outside the country where you live.

When we move personal data across borders, we use a lawful transfer mechanism — an adequacy decision where one exists, and Standard Contractual Clauses otherwise — and we require the same standard of protection described in this policy.

Warm Faith is intended for people aged 16 and over, or 13 and over with a parent or guardian's permission where local law allows it. Mentorship is only for adults aged 18 and over.

We do not knowingly collect personal data from children below those ages. If you believe a child has given us information, write to us and we will delete the account and its contents promptly.

We update this policy when the service changes or the law does. The date at the top always reflects the current version.

If a change materially affects your rights — for example, a new purpose for your data — we will tell you by email or in the app at least 14 days before it takes effect, so you can object, export your writing, or close your account.

Write to hello@warmfaithforall.com, or by post to [Legal entity name], [Registered address], [Country]. If we have appointed a data protection officer or an EU/UK representative, their details will appear here.