Privacy Policy

We collect the following categories of personal data:

• Account & identity: your name, email address, and (where you choose phone sign-up) phone number. If you sign in with Google, Meta (Facebook), removed text: or Microsoft,added text: Microsoft, or Apple, we receive your basic profile and an authentication token from that provider.
• Faith & spiritual profile (sensitive): information you provide during onboarding — your date of birth, gender, Christian denomination, spiritual goals, how you are currently feeling spiritually, the ways you prefer to connect, your prayer times and reminders, and your preferred Bible translation and language. Because this reveals religious belief, we treat it as sensitive and apply a higher standard of care.
• Voice & audio: if you use the voice onboarding feature with NOAH, your microphone audio is streamed to our servers and removed text: to our AI provider added text: on to Google, through the Gemini API, in real time to power the conversation. We request your explicit microphone permission before any recording.added text: Section 4 sets out that transfer in full.
• Content you create: messages you send to the NOAH AI chat, and any prayer requests, chat messages, community posts, or other free text you submit. We treat spiritual and prayer content as confidential. Content you post in Community Features (circles, communities, chat, prayer requests) is also governed by the Acceptable Use rules in Section 3.4 of our Terms & Conditions, including in-app reporting and blocking and our commitment to act on reports within 24 hours.
• Device & technical data: device model and operating system, app version, language/region, a device identifier, push notification token, approximate region (to route you to the correct regional servers), and diagnostic/crash data.
• added text: Advertising & attribution identifiers: your device’s advertising identifier (the IDFA on iOS, the Google Advertising ID on Android), the identifier your device assigns to our app (the IDFV on iOS), and an AppsFlyer ID generated for your install. On iOS we can only read the advertising identifier if you allow tracking when your device asks; if you decline, iOS returns an all-zero identifier and no matching on the advertising identifier takes place.
• added text: Install & attribution data: when you install the app, and when you open a UNOAH invitation, referral, or campaign link, we receive install, first-launch, and session data together with the link and campaign that referred you. We use this only to measure which invitation or campaign led to an install. The app does not display advertisements.
• Usage analytics: in-app events (for example, screens viewed and features used) to understand and improve the Service. Direct identifiers such as email and phone are hashed before they reach our analytics provider; we do not send raw contact details to analytics.
• Subscription & payment data (where applicable): if you purchase a paid plan, your subscription status and billing metadata. We do not store full payment card details — payments are handled by PCI-DSS compliant processors (e.g. Razorpay, PayU, Apple, Google).

• To create and secure your account and authenticate sign-in.
• To personalise your spiritual content, devotionals, prayer reminders, and NOAH conversations based on your profile.
• To provide the AI chat and voice features you choose to use.
• To send notifications and service communications you have enabled.
• To process subscriptions and payments (where applicable).
• To diagnose crashes, prevent abuse, and keep the Service secure.
• To understand usage and improve the Service.
• added text: To measure which invitation, referral, or advertising campaign led to an app install, to make invitation and campaign links open the right screen in the app, and to see how our campaigns perform overall (attribution and campaign measurement). We do not use this data to show you advertisements in the app.
• To comply with legal obligations and respond to lawful requests.

added text: Parts of the Service are powered by generative AI: the NOAH chat, AI voice setup (the voice onboarding conversation with NOAH), and AI-guided prayers. This section sets out exactly what leaves the Service when you use them, how we collect it, who receives it, and what it is used for. It adds to, and does not replace, the rest of this policy.

added text: What we send

added text: When you use one of those features, we send the following to our AI providers — Google, or OpenAI where Google is unavailable (see “Who receives it” below):

• added text: The messages you type to NOAH, together with the conversation history in that thread, so the reply follows what you have already said.
• added text: Your voice audio, if you use AI voice setup. Your microphone audio is streamed live for as long as that conversation lasts. We ask for your microphone permission before any of it is captured.
• added text: Your setup answers: your first name, your age range, your Christian denomination, the life situation you describe, the prayer topics you choose, and your preferred Bible version and language. These travel with your request so the reply is relevant to you.
• added text: The prayer requests you write, when you ask for an AI-guided prayer, together with any category or tags you select.
• added text: Scripture passages and instructions that our own servers add to your request. These come from us, not from you.

added text: How we collect it

added text: All of it comes directly from what you type, say, or select in the app. We do not infer it from your behaviour, and we do not obtain it from data brokers or any other third party.

added text: Who receives it, and what it is used for

added text: The primary recipient is Google LLC, through the Gemini API. Where the Google service is unavailable or fails to respond, the same request is sent instead to OpenAI as a fallback provider, so that the feature keeps working. Which of the two handles any given request depends only on availability at that moment; both receive the same categories of data described above, and neither receives anything more. Both process this data on our behalf, as our service providers, under the terms that apply to our use of their respective APIs. It is used for one purpose only: to generate the response that is shown back to you. It is not used to advertise to you, it is not used to build an advertising or marketing profile of you, and we do not sell it. We use no AI providers other than these two.

added text: What we never send

added text: We never send your payment or card details, your contacts, or your location to Google or OpenAI for AI processing.

added text: AI Insights on Bible verses

added text: The AI Insights shown alongside Bible passages are prepared in advance and stored as editorial content, and they are the same for every reader. Reading them sends nothing about you to Google.

added text: Your choice

added text: The AI features are optional. In the app we ask you before anything is sent to Google or OpenAI for AI processing for the first time, and nothing is sent unless you agree. You can withdraw that agreement at any time: tap the settings gear on the Home screen, then Privacy & Security → Data & Privacy. After that, no further data is sent for AI features. Declining, or later withdrawing, does not lock you out of the app: Bible reading, downloaded translations, guided prayers, the daily verse, and the community features all continue to work.

added text: The AI Companion on www.unoah.com uses the same AI features. The messages you type there reach the same providers in the same way, for the same purpose, and on the same terms. You can use the rest of the site without it.

added text: Where this processing takes place is described in section 7, and the rights you can exercise over it in section 9.

We process personal data on lawful grounds recognised by applicable law, primarily your consent and, where permitted, legitimate uses necessary to provide the Service. Where consent is required, we request it through clear notices and affirmative action (for example, agreeing to these terms at sign-up and granting microphone permission). You may withdraw consent at any time; withdrawal does not affect processing already carried out.

added text: Sending your data to Google through the Gemini API rests on your explicit consent, and on no other ground. We ask for it separately, before the first time an AI feature sends anything, because what you write to NOAH and in prayer requests routinely reveals religious belief, health, and personal relationships — special-category data under Article 9 of the UK and EU General Data Protection Regulation, and data we treat as sensitive throughout this policy. We do not rely on legitimate interests for it, and you can withdraw it at any time as described in section 4.

added text: On iOS, our use of the advertising identifier (IDFA) for attribution depends on your App Tracking Transparency choice. We ask through Apple’s standard prompt and use the advertising identifier only if you allow it. If you decline, or later turn tracking off in iOS Settings, no measurement based on the advertising identifier takes place; attribution then relies only on aggregated, non-identifying reporting such as Apple’s SKAdNetwork. Declining does not limit any feature of the Service. On Android, you can reset the Google Advertising ID or opt out of its use for advertising from your device settings at any time.

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate safeguards, including:

• Cloud hosting (Amazon Web Services, India region) for our application and databases.
• removed text: Google for sign-in and for the AI models (Gemini) that power NOAH chat and voice.added text: Google for sign-in, and Google LLC through the Gemini API — with OpenAI as a fallback provider — for the AI features — NOAH chat, AI voice setup, and AI-guided prayers. Google receives the messages, voice audio, setup answers, and prayer requests described in section 4, and processes them on our behalf only to generate the response shown back to you. Section 4 sets out that transfer in full.
• removed text: Meta and Microsoft where you choose those sign-in methods.added text: Meta (Facebook), Microsoft, and Apple where you choose those sign-in methods. The Meta SDK in our app is used only for Facebook sign-in — we have switched off its automatic event logging and its collection of the advertising identifier, so it does not collect your advertising identifier on your device.
• Firebase (Google) for push notifications and crash diagnostics.
• removed text: Analytics and error-monitoring providers (e.g. RudderStack and Sentry) for product analytics and stability.added text: Analytics and error-monitoring providers — Google Analytics for Firebase for in-app usage analytics, and Sentry and Firebase Crashlytics for crash and performance diagnostics, which are linked to your signed-in user ID so we can investigate faults on your account.
• added text: AppsFlyer for mobile install attribution and for UNOAH invitation, referral, and campaign links. AppsFlyer receives your advertising identifier (IDFA or Google Advertising ID), your AppsFlyer ID, your device’s identifier for our app (IDFV on iOS), and install, launch, and session data.
• added text: Meta, as a recipient of attribution data from AppsFlyer. Where an install is matched to a Meta campaign, AppsFlyer sends attribution data — including your advertising identifier — to Meta, which acts as a self-attributing network. This transfer happens server-to-server between AppsFlyer and Meta, not from the Meta SDK on your device.
• added text: Google (Google Ads), configured as a measurement network so that iOS campaign results can be reported to us in aggregate through Apple’s SKAdNetwork framework.
• Payment processors (e.g. Razorpay, PayU, Apple, Google) for subscriptions, where applicable.

added text: We use Cloudflare Turnstile to protect our site from automated abuse. When you use certain features (sign-in, sign-up, verification), Turnstile processes technical data such as your IP address and device/browser information to distinguish humans from bots. See Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

We may also disclose data where required by law or a lawful government request, in accordance with applicable law.

Your data is primarily stored and processed in our India (ap-south-1) region. Some processors removed text: (such as AI providers) may process data outside your removed text: country. added text: country — including Google, which handles the AI requests described in section 4 through the Gemini API, and OpenAI, which handles those same requests when it acts as the fallback provider. Any cross-border transfer is carried out in compliance with applicable restrictions, conditions, or government directions under the DPDP Act, the UAE PDPL, the KSA PDPL, and other applicable laws.

Subject to your local law, you have the right to access, correct, and request erasure of your personal data; to withdraw consent; to object to or restrict certain processing; and, under the DPDP Act, to nominate an individual to exercise your rights in the event of death or incapacity. To exercise any right, contact privacy@unoah.com or use the in-app controls. You can request account deletion at any time at removed text: unoah.com/account/deleteadded text: https://unoah.com/delete-account or from within the app. We respond within the timelines required by applicable law and, where no shorter mandatory period applies, within ninety (90) days.

removed text: UNOAH is intended for users aged 18 and over and we treat any user under 18 as a child. We do not knowingly process a child’s personal data without verifiable parental or guardian consent, as required by Section 9 of the DPDP Act and equivalent laws. We do not track, behaviourally monitor, or target advertising at children. If you believe we have inadvertently collected a child’s data, contact privacy@unoah.com and we will take prompt action.added text: UNOAH may collect and process the personal data of users under 18 only with verifiable consent from a parent or legal guardian and where permitted by applicable law. The parent or legal guardian may request access to, correction of, or deletion of the minor’s personal data and may withdraw consent. UNOAH does not knowingly permit minors to use the Service without the required consent and supervision.