Privacy Policy

We collect the following categories of personal data:

• Account & identity: your name, email address, and (where you choose phone sign-up) phone number. If you sign in with Google, Meta (Facebook), Microsoft, or Apple, we receive your basic profile and an authentication token from that provider.
• Faith & spiritual profile (sensitive): information you provide during onboarding — your date of birth, gender, Christian denomination, spiritual goals, how you are currently feeling spiritually, the ways you prefer to connect, your prayer times and reminders, and your preferred Bible translation and language. Because this reveals religious belief, we treat it as sensitive and apply a higher standard of care.
• Voice & audio: if you use the voice onboarding feature with NOAH, your microphone audio is streamed to our servers and on to Google, through Vertex AI on Google Cloud, in real time to power the conversation. We request your explicit microphone permission before any recording. Section 4 sets out that transfer in full.
• Content you create: messages you send to the NOAH AI chat, and any prayer requests, chat messages, community posts, or other free text you submit. We treat spiritual and prayer content as confidential. Content you post in Community Features (circles, communities, chat, prayer requests) is also governed by the Acceptable Use rules in Section 3.4 of our Terms & Conditions, including in-app reporting and blocking and our commitment to act on reports within 24 hours.
• Device & technical data: device model and operating system, app version, language/region, a device identifier, push notification token, approximate region (to route you to the correct regional servers), and diagnostic/crash data.
• Advertising & attribution identifiers: your device’s advertising identifier (the IDFA on iOS, the Google Advertising ID on Android), the identifier your device assigns to our app (the IDFV on iOS), and an AppsFlyer ID generated for your install. On iOS we can only read the advertising identifier if you allow tracking when your device asks; if you decline, iOS returns an all-zero identifier and no matching on the advertising identifier takes place.
• Install & attribution data: when you install the app, and when you open a UNOAH invitation, referral, or campaign link, we receive install, first-launch, and session data together with the link and campaign that referred you. We use this only to measure which invitation or campaign led to an install. The app does not display advertisements.
• Usage analytics: in-app events (for example, screens viewed and features used) to understand and improve the Service. Direct identifiers such as email and phone are hashed before they reach our analytics provider; we do not send raw contact details to analytics.
• removed text: Subscription & payment data (where applicable): if you purchase a paid plan, your subscription status and billing metadata. We do not store full payment card details — payments are handled by PCI-DSS compliant processors (e.g. Razorpay, PayU, Apple, Google).added text: Plans, subscriptions & payments: the plan you choose — including the free plan, which we record too so we know you chose one; whether you are on a free trial; your subscription status, renewal date and whether it will renew; and what your plan entitles you to. We do not receive or store your card number, card security code, or UPI details. Section 5 explains how payments work.
• added text: Plan usage: counts of how much you have used the features that have a limit on your plan, such as NOAH chats, prayer requests, communities and planner schedules. If you use the app without signing in, these counts are kept against your device instead.

• To create and secure your account and authenticate sign-in.
• To personalise your spiritual content, devotionals, prayer reminders, and NOAH conversations based on your profile.
• To provide the AI chat and voice features you choose to use.
• To send notifications and service communications you have enabled.
• removed text: To process subscriptions and payments (where applicable).added text: To record the plan you choose, run free trials and paid subscriptions, take payment through our billing platform, and apply the limits of your plan.
• added text: To stop free allowances and free trials being reset by deleting an account and registering again (see “Data retention”).
• To diagnose crashes, prevent abuse, and keep the Service secure.
• To understand usage and improve the Service.
• To measure which invitation, referral, or advertising campaign led to an app install, to make invitation and campaign links open the right screen in the app, and to see how our campaigns perform overall (attribution and campaign measurement). We do not use this data to show you advertisements in the app.
• To comply with legal obligations and respond to lawful requests.

added text: UNOAH offers a free plan and paid plans. Our Terms & Conditions set out the plans, the free trial, renewals and cancellation. This section explains what happens to your data.

added text: Our billing platform

added text: Plans, prices, trials and subscriptions are managed for us by our billing platform, UPG. UPG receives only an internal reference for your account — never your name, email address or phone number. It tells us which plan you hold and until when, and we keep a copy of that in our own database in India so the app can check your plan quickly.

added text: Who takes your payment

added text: You pay through a payment gateway or an app store, not to us directly. Depending on your country, your device and how you pay, this is PayU (UPI AutoPay, India), Telr (cards, the UAE and other GCC countries), Stripe, Apple (App Store) or Google (Google Play). You enter your card or UPI details on their page or in their app, and they process them under their own privacy policies and the PCI-DSS card-security standard. We do not receive or store full card numbers, card security codes or UPI details. The gateway or store tells our billing platform whether a payment succeeded, its amount and currency, the type of payment method, and a reference for the payment or mandate.

added text: Usage limits

added text: Some features have limits that depend on your plan. The limits for your plan, and how much of each you have used, are shown in the app. To apply them, we count your use of those features.

added text: How long we keep it

• added text: Your plan record — plan, status, renewal date, whether it renews — and what it entitles you to: for as long as your account exists. They are deleted when you delete your account.
• added text: Notifications our billing platform sends us about your subscription, which include the amount and currency of a payment: thirty (30) days, so we can process them correctly. Then they are deleted.
• added text: Daily and monthly usage counts: forty (40) days. Usage counts for longer periods, such as a plan period: for as long as your account exists. All usage counts are deleted when you delete your account; only the lifetime totals in the deletion record described in “Data retention” are kept, for 180 days.
• added text: Our billing platform, the payment gateways and the app stores keep their own payment records, as tax and accounting law requires.

We need a legal basis for each use of your personal data. These are the ones we rely on:

• Creating and securing your account, signing you in, and providing the features added text: and the plan you choose, including community features removed text: and any subscription — necessary to perform our contract with you (our Terms & Conditions).
• Personalising Scripture, devotionals and reminders from the preferences you give us — performance of our contract with you and, where those preferences reveal your faith or other special-category data, your explicit consent.
• The AI features — NOAH chat, AI-guided prayers and AI voice setup — your explicit consent, and nothing else, as explained below and in section 4.
• Taking payment, and keeping transaction, tax and accounting records — performance of our contract with you, and our legal obligations.
• Preventing fraud, abuse and security removed text: incidents added text: incidents, including keeping the deletion record described in “Data retention” — our legitimate interest in keeping the Service and its users removed text: safe.added text: safe and in preventing abuse of free allowances and trials.
• Crash diagnostics and in-app usage analytics, to keep the Service working and improve it — our legitimate interest in a reliable Service, and your consent where the law on cookies or device storage requires it.
• Install attribution and campaign measurement — your consent where the law requires it, including Apple’s App Tracking Transparency prompt on iOS.
• Answering your requests and complaints, and lawful requests from authorities — our legal obligations and our legitimate interest in handling them properly.

Where we rely on legitimate interests, we have weighed them against your rights and reasonable expectations, and you can object at any time by writing to privacy@unoah.com. In India, the equivalent grounds are your consent and the legitimate uses the DPDP Act permits. Where consent is required, we request it through clear notices and affirmative action (for example, agreeing to these terms at sign-up and granting microphone permission). You may withdraw consent at any time; withdrawal does not affect processing already carried out.

Sending your data to Google through Vertex AI on Google Cloud rests on your explicit consent, and on no other ground. We ask for it separately, before the first time an AI feature sends anything, because what you write to NOAH and in prayer requests routinely reveals religious belief, health, and personal relationships — special-category data under Article 9 of the UK and EU General Data Protection Regulation, and data we treat as sensitive throughout this policy. We do not rely on legitimate interests for it, and you can withdraw it at any time as described in section 4.

On iOS, our use of the advertising identifier (IDFA) for attribution depends on your App Tracking Transparency choice. We ask through Apple’s standard prompt and use the advertising identifier only if you allow it. If you decline, or later turn tracking off in iOS Settings, no measurement based on the advertising identifier takes place; attribution then relies only on aggregated, non-identifying reporting such as Apple’s SKAdNetwork. Declining does not limit any feature of the Service. On Android, you can reset the Google Advertising ID or opt out of its use for advertising from your device settings at any time.

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate safeguards, including:

• Cloud hosting (Amazon Web Services, India region) for our application and databases.
• Our engineering and operations team in India, who build, run and support the Service on our behalf and access personal data only where that work needs it.
• Google for sign-in, and Google LLC through Vertex AI on Google Cloud — with OpenAI as a fallback provider — for the AI features — NOAH chat, AI voice setup, and AI-guided prayers. Google receives the messages, voice audio, setup answers, and prayer requests described in section 4, and processes them on our behalf only to generate the response shown back to you. Section 4 sets out that transfer in full.
• Meta (Facebook), Microsoft, and Apple where you choose those sign-in methods. The Meta SDK in our app is used only for Facebook sign-in — we have switched off its automatic event logging and its collection of the advertising identifier, so it does not collect your advertising identifier on your device.
• Firebase (Google) for push notifications and crash diagnostics.
• Analytics and error-monitoring providers — Google Analytics for Firebase for in-app usage analytics, and Sentry and Firebase Crashlytics for crash and performance diagnostics, which are linked to your signed-in user ID so we can investigate faults on your account.
• AppsFlyer for mobile install attribution and for UNOAH invitation, referral, and campaign links. AppsFlyer receives your advertising identifier (IDFA or Google Advertising ID), your AppsFlyer ID, your device’s identifier for our app (IDFV on iOS), and install, launch, and session data.
• Meta, as a recipient of attribution data from AppsFlyer. Where an install is matched to a Meta campaign, AppsFlyer sends attribution data — including your advertising identifier — to Meta, which acts as a self-attributing network. This transfer happens server-to-server between AppsFlyer and Meta, not from the Meta SDK on your device.
• Google (Google Ads), configured as a measurement network so that iOS campaign results can be reported to us in aggregate through Apple’s SKAdNetwork framework.
• removed text: Payment processors (e.g. Razorpay, PayU, Apple, Google) for subscriptions, where applicable.added text: Our billing platform (UPG), and the payment gateways and app stores that take your payment — PayU, Telr, Stripe, Apple and Google — for plans and subscriptions, as described in section 5.

We use Cloudflare Turnstile to protect our site from automated abuse. When you use certain features (sign-in, sign-up, verification), Turnstile processes technical data such as your IP address and device/browser information to distinguish humans from bots. See Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

We may also disclose data where required by law or a lawful government request, in accordance with applicable law.

Your data is primarily stored and processed in our India (ap-south-1) region. Some processors may process data outside your country — including Google, which handles the AI requests described in section 4 through Vertex AI on Google Cloud, and OpenAI, which handles those same requests when it acts as the fallback removed text: provider. added text: provider, and the payment gateways and app stores described in section 5. Any cross-border transfer is carried out in compliance with applicable restrictions, conditions, or government directions under the DPDP Act, the UAE PDPL, the KSA PDPL, and other applicable laws.

We are established in Ireland. Where personal data is transferred out of the European Economic Area or the United Kingdom to a country without an adequacy decision — including India, where our servers and our operations team are, and the United States — we use the European Commission’s Standard Contractual Clauses (with the UK addendum where it applies) or another safeguard the GDPR recognises, with additional measures where they are needed. You can ask for a copy of the relevant safeguard at privacy@unoah.com.

We retain your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise your personal removed text: data within a reasonable period, except where added text: data, except for the limited records described below and records we are required to removed text: retain certain records added text: keep to comply with legal, tax, accounting, or security obligations.

added text: How deletion works

added text: When you ask us to delete your account, we may first hold the request for a short cooling-off period of no more than fourteen (14) days. If we do, we email you a link that lets you cancel the request during that period, and we may suspend sign-in to your account while the request is pending. We complete the deletion within one (1) month of your request.

added text: Some UNOAH products let you delete only your profile in that product — for example, your UNOAH Union profile — and keep your UNOAH account. This deletes that product’s data and leaves the rest of your account in place.

added text: What we keep after you delete your account

• added text: A record of the consents you gave — which notice you accepted and when, with the technical details recorded at the time, such as your IP address and device. It is our evidence that we asked you.
• added text: Audit records of actions taken on your account, with your identity removed.
• added text: Records we must keep by law, such as transaction and tax records for paid plans, for the period the law requires.
• added text: A deletion record, kept for one hundred and eighty (180) days, as described below.

added text: The deletion record (180 days)

added text: When you delete your whole UNOAH account, we keep a small deletion record for one hundred and eighty (180) days. It holds only: a keyed, one-way hash of the email address and/or phone number you signed in with; the date your account was deleted; whether the account used a free trial or a paid subscription; and how much the account had used, in total, of the features that have a limit on your plan. It does not hold your name, your email address or phone number in readable form, or any of your content.

added text: We keep it for one purpose: so that deleting an account and registering again does not reset free allowances or give a second free trial. If you register again with the same email address or phone number within 180 days, we use the record only to carry that trial status and those usage totals over to your new account. We do not use it to identify you, to contact you, or for any other purpose. After 180 days it is permanently deleted.

added text: We keep the deletion record to prevent fraud and abuse of the Service, relying on the legitimate uses and legitimate interests that applicable law allows for that purpose. Deleting only a product profile, such as your UNOAH Union profile, does not create a deletion record.

You have the right to access your personal data and get a copy of it; to correct it; to have it erased; to restrict our use of it or object to it, including where we rely on our legitimate interests; to receive the data you gave us in a portable format; and to withdraw your consent at any time, without affecting processing already carried out. Under India’s DPDP Act you may also nominate an individual to exercise your rights in the event of death or incapacity.

To exercise any right, contact privacy@unoah.com or use the in-app controls. You can request account deletion at any time at https://unoah.com/delete-account or from within the removed text: app. We added text: app; “Data retention” above explains how deletion works and what we keep. We complete account deletion within one (1) month of your request. We respond to added text: other requests within one (1) month of receiving them. Where a request is complex, or we receive many, we may extend that by up to two (2) further months; if we do, we tell you within the first month and explain why. We may ask for information to confirm your identity before we act on a request.

You also have the right to complain to a supervisory authority, including the Data Protection Commission in Ireland. Their details are under “Contact” below.