Privacy Policy
How Merovyn Ltd handles your information when you use Religiously.
Last updated 13 October 2026
Using Religiously in a browser
The policy below was written for the mobile app and applies equally to the website, with these differences in how your browser stores things:
- Your sign-in session is kept in cookies set by this site, which are needed to keep you signed in.
- Reading positions, theme, text size and AI defaults are kept in this browser's local storage instead of on a phone. Clearing your browser data removes them.
- Scripture text is loaded from this site as you read, rather than stored on a device.
- Payments open Stripe's own checkout pages in a new tab; card details are never entered on this site.
Who we are
Religiously is operated by Merovyn Ltd, the controller of your personal information. Contact contact@merovyn.com with privacy questions or requests.
Account, profile and study data
Supabase provides authentication. It processes your email, password credentials, account identifier and login/session information. Passwords are handled by Supabase authentication; the app does not store a readable copy. If you use Google sign-in, Google and Supabase process the identity information supplied through that sign-in flow.
Convex provides our account database and backend. It stores your email and account identifier, username, bio, preferences, reading positions, verse lists, subscription access, organisation membership, AI usage counters, wallets and theme ownership where you use those features.
Religious preferences, selected scriptures, study content and AI questions may reveal religious or philosophical beliefs. You can select ‘Prefer not to say’ for religion. We use study preferences to provide the features you choose.
Settings, downloaded scripture databases, offline access information and reading data are also stored on your device. Login credentials for sessions use the operating system's secure storage.
Online AI and your permission
Online verse search and teacher responses use OpenRouter, which routes requests to third-party AI inference providers. Before these features send data in this version of the app, we ask for your separate AI data-sharing permission. Reading scripture and using saved lists do not require this permission.
An AI request includes your question, selected scripture context and, for the teacher, recent conversation messages. We do not add your email, username, bio or account identifier to the AI request. Information you type yourself may still identify you or reveal sensitive beliefs, so avoid names, contact details and confidential information.
Convex handles the request and our quota/account checks. OpenRouter and the selected inference provider process the request to generate an answer. Their processing and retention depend on their policies and the endpoint used; we do not promise that every provider immediately deletes requests or that every request has zero retention.
You can withdraw permission in Settings → Privacy → AI data sharing. This stops new online AI requests from this app. Withdrawal does not undo a request already sent or automatically erase records that providers must retain under their policies. Contact us about information already submitted.
Subscriptions and purchases
Superwall manages paywalls, store purchases and subscription access. It receives your account identifier, paywall interactions, purchase/entitlement information and SDK/device information needed to operate those features. We pass an account identifier rather than your email or religious preferences to Superwall.
Apple App Store or Google Play processes store subscriptions and payment details under its own policies. Stripe processes organisation checkout, AI-credit and theme purchases wherever these payment flows are offered. The app receives purchase status, currency, amounts and customer/transaction identifiers; card entry is handled by the payment provider.
Deleting your Religiously account does not cancel a store subscription. Use the store's subscription settings to stop future billing.
Optional analytics
PostHog helps us understand app navigation and feature use. Optional analytics is off until you enable it in Settings → Privacy. Turning it off stops future optional analytics events. The choice is stored on this device.
If enabled, analytics includes app screens, limited product events, device/app information, and an account identifier when signed in. We filter out email addresses, usernames, bios, questions, conversation text, religious preferences, scripture choices and route parameters from the events we send. Touch autocapture, session replay and automatic feature-flag requests are disabled.
Core authentication, database, security and purchase processing still operate when optional analytics is off. These services are necessary for the features you use and are not controlled by the analytics switch.
Organisation sharing
When you join an organisation, its authorised administrators can see membership details and relevant usage/budget information needed to manage its seats. Content published on an organisation's public page is visible to people who can access that page. Shared verse-list codes allow other people to import the content you choose to share.
Purposes and choices
We use necessary account and study data to provide the service, sync your data, operate purchases and protect the app. We process optional analytics and online AI sharing based on the permission described above. We also process information where needed to meet legal obligations or pursue legitimate interests such as security and fraud prevention.
We do not use the app's study questions or religious preferences for advertising. Providers may process data outside your country; their policies describe their locations and processing arrangements. Contact us for information about the providers and safeguards relevant to your request.
Retention and account deletion
You can request account deletion in the app's account settings. Access ends when requested, followed by the stated seven-day grace period before scheduled permanent cleanup of the Supabase login and personal Convex account records. Failed cleanup steps are retried. Shared organisation records are preserved with account references removed where appropriate.
The shared verse-search cache has no account identifiers, so account deletion cannot locate cache entries by account. Cache entries may remain for reuse; contact us to request removal of identifying information. We and our providers may retain information needed for legal, financial, security or fraud-prevention obligations. Payment providers and stores handle their own records under their policies.
Your rights and security
Depending on your location, you may have rights to access, correct, export or delete personal information, withdraw consent, and object to or restrict processing. Contact contact@merovyn.com. You may also complain to your local data-protection authority, including the UK's Information Commissioner's Office.
We use access controls, secure connections and protected credential storage to safeguard information. No system can guarantee absolute security.
Children
The app is not directed at children under 13 or the minimum age required in your jurisdiction. We do not knowingly collect information from children under that age.
Changes and contact
We update the date above when this policy changes materially and notify you where appropriate. For questions or privacy requests, email contact@merovyn.com.