Magyar English Deutsch Español Polski Română Русский Українська

PrepperPapa and Wordlight apps: privacy notice

This notice applies to the PrepperPapa app and the Wordlight app (PrepperPapa's Bible reader, a separate app). Where the two apps differ, we say so separately. The privacy notice of the prepperpapa.hu website is a separate document.

Effective: 9 November 2026 (date of publication).

1. In brief

• The PrepperPapa app is built to work offline: your inventory, notes, map points, Emergency Card, wallet and your conversations with Noah stay on your phone. Wordlight is a Bible reader: the text is on your phone, and no account is needed to read.
• Data reaches our server when you create an account or sign in, use rooms, send an SOS or your location to your rooms, send feedback or a report, redeem premium, use the referral programme, receive Gerah for daily reading or for a reading plan, submit a prayer request, turn on reading time sync, Bible data sync or backup to your account, or subscribe to the newsletter, or turn on the anonymous daily statistics. In Wordlight, signing in is not mandatory; it is needed only for redeeming premium, submitting a prayer request, the newsletter, reading time sync, Bible data sync and backup to your account. For a daily goal met in Wordlight, the Gerah goes to the PrepperPapa wallet if PrepperPapa is installed on the same phone. Apart from this, reading data from Wordlight reaches the server only if you turn on reading time sync (3.13), the anonymous daily statistics (3.17) or Bible data sync (3.18).
• Room message text is encrypted by your phone before it is sent. The server cannot read the text. The server does see who is a member of which room, under which name, when someone wrote, and whether an SOS signal was sent.
• The app has no advertising ID, no trackers, no behavioural analytics, no Google Analytics and no crash-reporting service. We do not sell data and do not profile you. The only tracking is the open-tracking of the newsletter, and only if you subscribe to it separately (3.11).
• You can delete your account and the data tied to it: see section 9.

2. Who handles your data

Controller: Nagy János László, sole proprietor (seat: 3128 Vizslás, József Attila út 15., Hungary; registration number: 63017434; tax number: 92514027-1-32; trading from: 2026-10-28).
Contact for privacy matters: prepperpapa@gmail.com.
The server is run by a hosting provider (see section 6); we are the controller.

3. What we process, why, on what legal basis, for how long

Legal bases refer to Article 6(1) of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council). "Performance of a contract" here means that without the data we cannot provide the function you asked for.

3.1. Account and sign-in

• Data: e-mail address; if you register with a password, a one-way (scrypt) hash of the password, never the password itself; if you sign in with a Google account, the e-mail address verified by Google; the time the account was created and of the last sign-in; the account state (active, pending, revoked); the confirmation code received by e-mail (for a short time, in server memory or as a hash).
• Tester version: at startup the tester version sends your e-mail address and your device ID to the server, which returns a signed, expiring permit; the server does not store it.
• Purpose: sign-in, tying rooms, premium, the referral programme, the daily reading Gerah, reading time sync, backup to your account and the newsletter to your account, abuse prevention. PrepperPapa asks for an account for these functions; in Wordlight, signing in is not mandatory (the same account, with the e-mail address and a six-digit code, without a password).
• Legal basis: performance of a contract (Art. 6(1)(b)); limiting sign-in attempts is a legitimate interest (Art. 6(1)(f)).
• Retention: until you delete the account. After deletion it remains in the backups for at most about 12 weeks (the server keeps 14 daily and 8 weekly backups, and another machine in Hungary keeps 30 daily and 12 weekly copies; the forum backup is 7 daily, on the same server).
• Your devices: the list of devices linked to your account. For each device we store the app's device ID, the device model as the app names it (for example SM-S938B), and the time of first and last use. For each account we also store the time of the last disconnection and which devices were disconnected. On Android the device ID is the identifier the system gives to this app (ANDROID_ID): it stays the same after a reinstall, no other developer's app receives the same one, and it changes when the phone is reset to factory settings. On iPhone it is a random identifier that the app stores in the phone's Keychain, so it also survives a reinstall. We do not read the advertising ID, and we do not use the device ID for tracking. Purpose: to recognise a reinstalled phone as the same device, so that it does not take up a new place in your account's device limit; to let you see and disconnect your devices in the list; and to prevent the device limit from being bypassed. Legal basis: performance of a contract (Art. 6(1)(b)); protection against bypassing the limit is a legitimate interest (Art. 6(1)(f)). Retention: as long as the device belongs to your account. The disconnection marks and time remain until the account is deleted, because the 30-day disconnection rule and the rule that a disconnected device does not return by itself depend on them. They are deleted when you delete the account, except the purchase record data under 3.7.
• Note: we send the verification code from a Gmail account (Google as e-mail provider).

3.2. Rooms (group messaging)

• Data the server sees in clear: room name and room language; members' IDs and display names; profile picture; who asked to join and when, the introduction written with the request, and that you accepted the rules and declared your age of 16 (one value, with the time of the request); invitations (with expiry); the sender, time, urgent flag, and edit and delete times of messages; reactions, saved items, read marks; the account-bound ID of the member; the list of removed members (e-mail, name, time). This data is not encrypted.
• Data the server normally receives only encrypted: the text of messages (AES-GCM 256, with the room's key; the key is handled by the members' phones; if you turn on backup to your account (3.14), the keys of your rooms are also in your encrypted backup, and we cannot read that either) and private member-to-member messages. The text of some older or system-sent messages is stored on the server unencrypted. Pictures attached to messages (up to 500 kB) are normally encrypted on the phone by the app, but the server also accepts an unencrypted picture, so the encryption is behaviour of the app, not a guarantee of the server. The room picture and the members' profile pictures are stored unencrypted in the database.
• Purpose: running the room.
• Legal basis: performance of a contract. For a join request, after you accept the rules, the room host and the members see what you provided.
• Retention: while the room or your account exists; when the room is deleted, the data belonging to the room is deleted too. The room's event log is kept for 90 days. In backups for about 12 weeks.
• Important: what you write in a room is seen by the members of the room, and they can also save or pass it on. Our responsibility does not extend to them. Encryption protects the message from the server, not from the members. The host who created the room is responsible for the content shared in the room: the host decides on admission, only the host can remove a member, and only the host can delete another person's message; the host can delete the room at any time, which irrevocably removes every member's messages. If you leave or are removed, the server will no longer deliver messages to you, but those already on your device remain readable. Location or inventory data shared in a room is sensitive; you are responsible for your own safety. We do not review the content of rooms in advance; we act after a report (see the Community Guidelines and the Terms of Use).

3.3. SOS, fall detection, "Send my location", Emergency Card

• Data: when you send an SOS (by hand, or after fall detection, if it is switched on), your exact location goes to your rooms in a message encrypted by your phone. If you tick it separately, your Emergency Card (blood type, allergy, medication, illness, contact) goes as well. The "Send my location" button works the same way, but sends only the location.
• What is visible without encryption: that there was an SOS signal, the sender's name, the room's name and the time. This also appears in the notification (see 3.4).
• Health data: the Emergency Card is health data (GDPR Art. 9). By default it is switched off, it goes only on your explicit ticking, and you can decide again before every SOS. The legal basis is your consent (Art. 9(2)(a)); you can withdraw it by switching it off.
• Legal basis (location): your consent (Art. 6(1)(a)), which you give by allowing location access and by sending the SOS.
• Retention: it stays among the room's messages until you or the room's host delete the message, or the room or the account ceases to exist. In backups for about 12 weeks.
• What you need to know: an SOS is not an emergency call. It does not call the ambulance, the police or the fire brigade, and only the members of your rooms are notified of it. In a life-threatening situation, call 112. We do not track your location continuously in the background; the app reads your location only when you ask for it or when an SOS starts. If you start a hike, hike tracking continues with the screen locked for as long as the hike lasts; this location data stays on your phone and does not go to our server.

3.4. Notifications (push)

• Data: your device's notification ID (Firebase Cloud Messaging token, or in a browser a web push endpoint and keys), the device language and the local emergency number (so that the SOS notification uses the right language and number), the room it belongs to; muting.
• Content of the notification: the sender's name, the room's name, the time and a short text with no content ("X wrote"; in the case of an SOS, the SOS text). The text of the message does not pass through this. A notification to the app passes through the servers of Google (Firebase Cloud Messaging). If you ask for notifications in a browser, they pass through the push service of the browser vendor (for example Google, Mozilla, and Apple on iPhone and in Safari); that provider receives the notification endpoint and the encrypted notification.
• Legal basis: performance of a contract; you grant the notification permission in your phone's settings and can withdraw it there.
• Retention: the ID is deleted if you leave, leave the room, delete the account, or the provider marks it invalid.

3.5. Feedback and reporting a Noah answer

• Data: the text you write, a picture (if you attach one), the type and the module; the version, the platform, the device, the browser/UA, the screen size, the language, the current view and the last up to 20 errors; the app's own device ID; your sign-in e-mail address (the server adds this). When you report a Noah answer, your question and Noah's answer. We send nothing else.
• Purpose: fixing bugs, correcting the reported content.
• Legal basis: your request (performance of a contract) and a legitimate interest in improving the product (Art. 6(1)(f)).
• Retention: 12 months after it is closed, or, if we do not close the feedback, 12 months after it was received.
• Noah's conversations otherwise run on your phone and do not reach our server.

3.6. Usage log (anonymous)

• Data: which screen, which button, what error, which version, and whether it is the native app or a browser. With a random session ID created when the app starts, which lives only in memory.
• Not included: e-mail address, device ID, IP address, name. It cannot be linked to a person.
• Legal basis: legitimate interest (Art. 6(1)(f)): understanding usage. Since it is not tied to a person, the stored data set is not personal data. On the app's address the web server keeps no access log, so there is nothing to link it with (see 3.9).
• Retention: 90 days.

3.7. Premium and purchases

• Google Play purchase: the purchase signal (token) issued by Google Play, the product, the order ID, the device ID, the sign-in e-mail, the unlocked modules. Our server keeps only a hash of the token. Google handles the payment; we do not see the bank card data.
• Support: if you buy support on the Support screen in the app, we process the same data as for a store purchase of premium (a hash of the purchase signal issued by the store, the product, the order ID), with your sign-in e-mail address if you are signed in. Support does not unlock anything. Purpose and legal basis: performing the purchase and keeping accounting records, as above. On iPhone, Apple handles the payment.
• Premium code (bought on the website): the code, the e-mail address and the device ID; one code can be redeemed on at most 2 (or, depending on the product, that number of) devices.
• Purpose: unlocking premium and preventing abuse (code sharing).
• Legal basis: performance of a contract; for accounting records, the retention obligation under the applicable tax and accounting legislation (compliance with a legal obligation, Art. 6(1)(c)).
• Retention: while the premium is valid, and afterwards the record data for the statutory retention period; if you delete your account, premium keeps working on the devices you have already unlocked, but cannot be tied to a new device; after deletion the purchase's record data (order ID, list of unlocked devices) is kept without name and e-mail address, under a random marker.
• The details of a website purchase (name, address, country, withdrawal statement, invoice) are in the privacy notice of the purchase page.

3.8. Referral programme and Gerah

• Data: the ID of the invitation (referral code); the fact and day a referral code was redeemed; a hash of the e-mail address (not the address itself); the device ID; the ID of your Gerah wallet; the reward received (and the premium bonus after the 14-day wait). When you install through a referral link, Google Play hands the referral code to the app at installation (install referrer). Gerah transactions are signed records that travel among the messages of rooms. Daily reading reward: when you reach your daily reading goal, the app sends the server, for crediting, the day, the seconds spent reading or listening that day and your daily goal, your Gerah ID (the fingerprint of the public key), the device ID and your sign-in e-mail address. A daily goal met in Wordlight is taken over on the phone by the PrepperPapa app, which sends it in the same way. The server counts at most one day per calendar day, per account, per device and per Gerah ID, and returns a signed credit. The server also keeps the counted days tied to your account (weekly escrow): the day, the day's Gerah amount, the daily goal, the reading seconds, and which device and which app sent the report; it keeps them for at most 45 days. The app also holds the signed daily credits in escrow on your phone and moves them to your wallet when the weekly goal is met.
• Reading plan reward (PrepperPapa only): when you have read or listened to a day of a reading plan, the app sends the server, for crediting, the plan ID and start date, the number of the plan day, the day of reading, the Bible chapters of the day and, per chapter, the time spent reading or listening, the chapter's verse and word count, the number of verses listened to and whether you reached the end of the chapter; and also your Gerah ID, the device ID and your sign-in e-mail address. Tied to your account, the server stores which days of which plan it has counted; for the last 10 calendar days, which Bible chapter it counted on which day, and the amount credited per day; the latest signed credits, at most 30; and, against abuse, which device and which Gerah wallet the plan belongs to. This data may reveal your religious beliefs (GDPR Art. 9). It arises only if you follow a reading plan and have a Gerah wallet; the app then requests the credit by itself. Legal basis: your explicit consent (GDPR Art. 9(2)(a)), which you give with a separate checkbox before the app first asks for the credit; without it the plan works the same, only no Gerah is credited, and you can withdraw the consent at any time in Settings. How long: while your account exists; it is deleted when the account is deleted (in backups for at most about 12 weeks).
• What the referrer sees: the referrer does not see the invited person's name, e-mail address or IDs, only the fact and day of the credit.
• Purpose: crediting the reward, excluding abuse (self-referral, multiple claims); after the account is deleted, the retained fingerprint serves so that, if you register again with the same e-mail address, you get back once the referral rewards of your former account, and so that the referral reward and the starting balance are not granted a second time.
• Legal basis: performance of a contract (by joining the programme); legitimate interest against abuse.
• Retention: for the duration of the programme, afterwards only for the period required by law; after the account is deleted, the keyed fingerprint of the e-mail address, the date of redemption and the date of the starting-balance credit for at most 24 months (the device ID and the wallet ID are not kept); the referral code redeemed by the deleted account and its reward flags remain in your referrer's records without a name, because the referrer's count limit and rewards come from them; the signed records of the rewards remain among the messages of rooms until the message or the room is deleted.
• Data of the daily credit: tied to the account, the last counted day and the number of counted days, the device ID and the Gerah ID, and the signed credit remain on the server while your account exists; when the account is deleted these are deleted (in backups for at most about 12 weeks). The Gerah is stored only by the wallet of the PrepperPapa app; for a daily goal met in Wordlight, the Gerah goes to the PrepperPapa wallet if PrepperPapa is installed on the same phone. Apart from this, reading data from Wordlight reaches the server only if you turn on reading time sync (3.13), the anonymous daily statistics (3.17) or Bible data sync (3.18).
• The Gerah is not money and cannot be exchanged for forints. The name "Gerah mining" is only a playful name: you receive the Gerah for reading, we do not produce it by computer work.

3.9. Server log

• On the app's address (app.prepperpapa.hu) the web server keeps no access log. The service's runtime log (events, errors, delivery of notifications) goes into the server's system log, for security and troubleshooting purposes; by measurement, the services in it (room, purchase, referral, sign-in) do not log client IP addresses. Legal basis: legitimate interest (Art. 6(1)(f)). Retention: we keep it for at most 30 days. When a sign-in code is sent, the sign-in gate also logs the e-mail address; we also keep this for at most 30 days. Exception: when someone signs in with the App Store review account, the gate logs the e-mail address, the IP address and the browser identifier (User-Agent), and sends a notification about it to the operator.
• Update check and lock/installation log (in the tester APK, in PrepperPapa and in Wordlight alike; there is no self-update in the store version): during the update check the app queries our server. If the tester version is locked, or the installation fails, the app sends an anonymous log entry of at most 160 characters: the app's own and required version, the Android and WebView versions, the device manufacturer and model, in the case of an installation error the system's status codes, the time elapsed since then and the system's error message. It contains no e-mail address, name or device ID; we do not store the IP address (only in memory, to limit requests). Legal basis: legitimate interest (Art. 6(1)(f)), troubleshooting. Retention: 90 days.

3.10. What stays on your phone

Inventory, notes, map points and the offline map, settings, the Emergency Card, the Token wallet and the document wallet (encrypted with a key derived from the PIN), Noah's conversations and the downloaded AI model are on your phone. Our servers cannot access them unless you send them. If you lose your phone, we cannot restore the PIN or the recovery code.

3.11. Newsletter (only if you ask for it)

• Data: the e-mail address of your signed-in account; the consent text as you saw it in the app (with its language); that the request came from the app; the time of subscription and a short fingerprint of your IP address at that time (SHA-256, 16 hex digits, to prove consent; not the IP address itself, but we use no salt, so we regard it as personal data); the fact and time of confirmation and the same kind of IP fingerprint. An unconfirmed subscription request is deleted after 7 days. The mailing system used for the newsletter records, on the basis of the time and IP address of opening, whether you opened the e-mail.
• Purpose: sending news, tips and offers about PrepperPapa, at most a few times a month.
• Legal basis: your consent (GDPR Art. 6(1)(a)). The box is never pre-ticked; the subscription takes effect with double confirmation (we send a confirmation e-mail, and you are subscribed only after the button in the e-mail). The e-mail address of the account is not consent in itself.
• Open-tracking: the newsletter contains an invisible image; when it loads, the sending service records the opening (time, IP address). This cannot be switched off within the e-mail; if you do not want it, do not subscribe, or unsubscribe.
• Withdrawal: at any time, by switching off the box in the app, with the unsubscribe link at the bottom of every e-mail, or at prepperpapa@gmail.com. We then delete your address from the newsletter list.
• Retention: until withdrawal. Deleting your account also unsubscribes you from the newsletter: both a confirmed and a pending subscription are deleted, without a confirmation e-mail.
• Processor: Brevo (Brevo, société par actions simplifiée, Paris company registration number: 498 019 298, seat: 9-17, rue Salneuve, 75017 Paris, France). It may also transfer the data outside the EEA; the safeguards are set out in Brevo's data processing agreement.

3.12. Wordlight: what is different

• Wordlight is PrepperPapa's Bible reader, a separate app. The text of the Bible is on your phone; no account is needed to read, and the text you read does not go to the server.
• The data that reaches the server is the same as in PrepperPapa, but only if you use the function: sign-in (3.1), redeeming a Bible premium code (3.7), newsletter (3.11), feedback (3.5), reading time sync (3.13), backup to your account (3.14), prayer request (3.15), praying (3.16), anonymous daily statistics (3.17) and Bible data sync (3.18). The anonymous usage log (3.6) runs in Wordlight too.
• The update log of the tester version is described in section 3.9; it applies to Wordlight as well.
• There is no Gerah wallet in Wordlight: the Gerah lives in the PrepperPapa app (3.8). For a daily goal met in Wordlight, the Gerah goes to the PrepperPapa wallet if PrepperPapa is installed on the same phone. Apart from this, reading data from Wordlight reaches the server only if you turn on reading time sync (3.13), the anonymous daily statistics (3.17) or Bible data sync (3.18).

3.13. Reading and prayer time sync (only if you turn it on)

• Data: for each day, the seconds spent reading the Bible and praying (for at most the last 400 days), with one ID per app and per device. It is tied to your account by a hash derived from your e-mail address; the address itself is not written to the file. The server stores these numbers in readable form, not end-to-end encrypted. This data may indicate your religious beliefs (GDPR Art. 9).
• Purpose: so that the time you spend in PrepperPapa and in Wordlight, and on your different devices, adds up.
• Legal basis: your explicit consent (GDPR Art. 9(2)(a)). The switch is in the Bible settings, it is off by default, and signing in alone does not start it.
• Withdrawal: if you turn it off, the sync stops and the app offers to delete the data on the server.
• Retention: while the sync is on and your account exists. It is deleted when the account is deleted; in backups it remains for at most about 12 weeks.

3.14. Backup to your account (only if you turn it on)

• Data: the full backup of the app (notes, highlights, settings, the keys of your rooms and the other data stored on your phone). Your phone encrypts it with your own backup key (PBKDF2-SHA256, AES-GCM 256) before sending it. The server stores only the encrypted file, its size, the app version and the time of the backup, under a hash derived from your e-mail address. We do not know your backup key, we cannot read the backup, and without the key we cannot restore it either. For each app, the latest and the previous backup are kept, at most 5 MB.
• Purpose: moving your data to a new phone.
• Legal basis: your explicit consent (GDPR Art. 6(1)(a)). As the backup may also contain health data (Emergency Card) or data indicating religious beliefs, also GDPR Art. 9(2)(a). The checkbox is off by default.
• Withdrawal: when you turn it off, the app offers to delete the backup on the server.
• Retention: until you delete it, or until your account is deleted. In backups it remains for at most about 12 weeks.

3.15. Prayer requests (only if you submit one)

• What happens to your request: a prayer request you submit is public. Every user of the Bible in PrepperPapa and of Wordlight can read it in the list, on the map and in the guided prayer, and it also appears on the wordlight.hu website. The reader's phone automatically translates the request into the reader's language; this is machine translation, made on the phone, it may be inaccurate, and the original text is one tap away.
• Data: the text, language and category of the request; the nickname it appears under (you can change it for each request; if you leave it empty, „Anonymous”; if you already have a profile name in PrepperPapa, we offer that); the place at the level of country and county, region or province (your phone rounds your location, still on the device, to the centre of an area of about 50 km and sends only that; from it we determine the country and the region; if you do not give location permission, you choose them yourself); the time of submission and of renewal, the state (active, answered, closed, deleted, held for moderation), the thank-you text if you write one, the reports received about the request; and your account, in the form of a keyed hash derived from your sign-in e-mail address, so that you can manage the request. Your e-mail address is not shown.
• Sensitive data: a prayer request may reveal your religious beliefs and is often about health (GDPR Art. 9). So we ask for your explicit consent to publication with a separate checkbox. Do not write identifiable data about others (full name, address, phone number, e-mail address, bank account number): if the request is about another person, write it so that nobody can tell who they are.
• Moderation: the request appears at once. An automatic, rule-based filter holds back, until a person reviews it, a request containing offensive text, a phone number, an e-mail address, a web address, a full name, a bank account number, or a request for money or donations. The final decision is made by a person; if we hold back or remove the request, you see the reason in the app, at your request. Anyone can report the request and block the sender in their own view.
• Purpose: publishing the prayer request and praying together. Legal basis: your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)); filtering and handling reports are a legitimate interest (Art. 6(1)(f)); acting against illegal content is a legal obligation (Art. 16 of Regulation (EU) 2022/2065).
• Retention: an active request stays up for 30 days, and you can renew it. A closed or expired request is deleted after 30 days. Reports are kept for 12 months from the moderation decision (see section 9). In backups for about 12 weeks.
• Withdrawal: you can delete your request in the app at any time; this withdraws your consent. Publication before the withdrawal remains lawful, and what others have read or added to their own prayer list by then, we cannot take back from their phones.
• Others' requests in your own prayer list: if you add a request to your own prayer list, it is stored on your phone. It goes to the server only end-to-end encrypted, if you turn on the sync of your own prayer list (3.18).

3.16. Praying for a request or for a topic of the guided prayer

• When you pray for a request or for a topic of the guided prayer (for example a world event), the server stores only this: for which topic, on which day, from which area of about 50 km, and how many. We do not store who prayed: no name, no account, no e-mail address, no device ID. Only your phone knows what you prayed for; this is also what prevents counting the same prayer twice, and what shows you the thank-you reply when the request has been answered.
• Who sees what: everyone can see the numbers and the map (the centre of the area, never an exact place) in the list, in the statistics and on the map; the person who submitted the request sees them at their own request. Nobody sees the names, nicknames or profile names of those who prayed. If only one person prayed from an area, someone who knows them may infer who it was.
• From these numbers we cannot identify anyone, so we do not ask for separate consent, and deleting your account does not affect them. Legal basis: legitimate interest (GDPR Art. 6(1)(f)): the statistics of praying together. Retention: as part of the statistics, without a time limit.

3.17. Anonymous daily reading and prayer statistics (only if you turn it on)

• What the app sends. If you turn on the „Anonymous statistics” switch in the Bible settings, after a finished day the app sends a single set of numbers: how many minutes you read the Bible and how many minutes you prayed that day, rounded down to a band (0, 1, 2, 5, 10, 15, 20, 30, 45, 60, 90, 120 minutes or more); in which app (PrepperPapa or Wordlight); and a random number made for that day only, with which the server filters out a repeated sending of the same record. If you did not read or pray that day, the app sends nothing. Days before you turned the switch on are not sent.
• What is not included. Account, e-mail address, name, device ID, a cookie linking to your account. The server does not store your IP address: it uses it only in memory, to filter out too many requests, in the form of a hash made with a key replaced every hour, and never writes it anywhere.
• What the server stores. It does not keep the set of numbers it receives but adds it at once to that day's total (per day and per app: how many read, how many prayed, how many minutes in all). The hash (SHA-256) of the daily random number is deleted after 4 days. No individual record remains, and the total cannot be linked to you or to your other days.
• Purpose. To publish on the Wordlight website and in the apps how many people read the Bible and how many prayed on a day, and for how many minutes on average. A day is published only when no more records can arrive for it (4 days after the day). We never publish a figure for a group of fewer than ten people, and we break the figures down so that a hidden small group cannot be worked out from the published numbers either.
• Legal basis. Your explicit consent: GDPR Art. 6(1)(a) and Art. 9(2)(a), because at the moment of sending the data may point to your religious practice; and, for reading the minutes stored on your device, section 155(4) of the Hungarian Act C of 2003 on Electronic Communications. The switch is off by default.
• Withdrawal. By turning the switch off, in the same place where you turned it on; after that the app sends nothing more. Withdrawal does not affect the lawfulness of earlier sendings. The days already sent appear only in the anonymous total, from which your data cannot be separated, so we cannot delete it separately (GDPR Art. 11).
• How long. We keep the daily total for 400 days and the hash of the daily random number for 4 days.
• Disclosure. To no one. The published figures are totals, not personal data.

3.18. Syncing Bible data between your devices (only if you turn it on)

• Data: if you turn it on, your phone syncs your personal Bible data through your account with your other devices, also between PrepperPapa and Wordlight. This covers notes, bookmarks and highlights, learned verses and your progress, verse cards, reading plans and the chapters marked as read, games, search history, Bible reading settings, prayer goals and your progress, and the state of the guided prayer. Before sending anything, your phone encrypts it with a key that it derives on the phone from your own passphrase (end-to-end encryption). For each item the server stores only the encrypted data, an encrypted hash of the item's ID and the time of the change, under a hash derived from your e-mail address. For a deleted item it stores a deletion marker with the time of deletion, so that your other devices delete it too.
• What we see and what we do not: your data is stored encrypted, and only you can open it, with your passphrase. We do not know your passphrase or the key, and we cannot read the content. We can see how many items you have, how large they are and when they changed. If you forget your passphrase, the data on the server cannot be opened and we cannot restore it either; the copy on your phones remains.
• If you do not turn it on: this data exists only on the device where you created it, and it does not appear on another phone even if you sign in with the same account.
• What is not included: downloaded translations and voices, the layout and the other settings that apply only to that phone. Reading and prayer time has its own sync (3.13).
• Your own prayer list: your own prayer list, including the requests of others you have added, goes into the sync with a separate switch. This switch is also off by default, and the prayer list is sent the same way, encrypted.
• Purpose: so that your Bible data is the same on all your devices and in both apps.
• Legal basis: your explicit consent (GDPR Art. 6(1)(a)). As the data may indicate religious beliefs, also GDPR Art. 9(2)(a). The switch is in the Bible settings, it is off by default, and signing in alone does not start it.
• Withdrawal: if you turn it off, the sync stops and we delete your encrypted data on the server. The data on your phones remains.
• Retention: while the sync is on and your account exists. We keep the deletion markers for at most 400 days. Everything is deleted when the account is deleted; in backups it remains for at most about 12 weeks, encrypted there too.

4. App permissions

You grant the phone's permissions, and you can withdraw them at any time in your phone's settings: location (map, compass, sunset, hike tracking, SOS, Send my location, prayer request and praying: your phone rounds the location, still on the device, to an area of about 50 km and sends only that), camera (QR code, reading light signals; no recording is made or sent anywhere), microphone (signals arriving as sound, for example SSTV, Morse; no sound recording is made or sent anywhere. The exception is spoken Bible-verse learning: there the phone's speech recogniser turns what you say into text, and depending on your phone settings the sound may be processed by the recogniser's provider, usually Google on Android and Apple on iPhone. Neither the sound nor the recognised text reaches our server), notifications, Bluetooth (nearby devices; message exchange without internet in local rooms, where nearby phones relay the encrypted room messages to each other, and handing over a Gerah payment between two phones next to each other), NFC (on Android, handing over a Gerah payment between two phones tapped together), local network (finding and using a local room on a shared Wi-Fi or hotspot; the host's phone announces the room's name on the local network), motion and pressure sensors (fall detection, storm warning; the measured values stay on the device), fingerprint/face (unlocking the wallet with the phone's own system). Apart from location, SOS and the area rounded for prayer requests and praying, none of these goes to our server. A room message or Gerah payment handed over by Bluetooth, NFC or the local network goes directly to the nearby phones, not to our server.

5. External services the app contacts

When you use these functions, your phone contacts the provider directly, and your IP address reaches it. Their own privacy notices apply to them.

6. Who we pass your data to

• Hosting provider: Hetzner Online GmbH (the server of the prepperpapa.hu website, the app, the sign-in gate, the back end of the web shop and the backups: Nuremberg, Germany; data processing agreement: from 27 October 2026).
• Google (Firebase Cloud Messaging, Google Play, Google sign-in, Gmail; see the table above): may process data outside the EEA, including in the United States; the safeguards are set out in Google's data processing terms.
• Apple (speech recognition on iPhone; delivery of notifications on iPhone and in Safari; see the table above): may process data outside the EEA, including in the United States; the safeguards are set out in Apple's data processing terms.
• Newsletter sending: Brevo (processor, France; its details are in section 3.11).
• Payment, invoicing (website purchase): Revolut, Számlázz.hu (KBOSS.hu Kft.), GoAffPro (referral commission).
• The other members of the room see what you send into the room or what is part of your membership (name, profile picture, messages, SOS, location).
• Authorities, if the law obliges us to, or on suspicion of a criminal offence (see the Terms of Use).
• We do not sell data, do not hand it over for advertising purposes, and do not give it to data brokers.

7. Security

The text of room messages is encrypted by your phone (AES-GCM 256; the key is handled by the members' phones, not by the server; in the backup to your account the key reaches the server only encrypted with your own backup key). We do not store passwords, only hashes. The connection is HTTPS. The wallet is PIN-encrypted. The server's disk and the backups are not separately encrypted and are protected by access permissions; the copy stored on the owner's computer is on an encrypted disk. No system is infallible: the server does not see the text of messages, but it does see membership, names and times (3.2), and we cannot protect against the loss of your phone or the ill will of a member.

8. Age

Use of the app is permitted from the age of 16. When joining a room and when submitting your first prayer request you declare, with a separate checkbox, that you are over 16 or have parental consent. If you are younger than 16, ask for the consent of your parent or guardian and use the app together with them. We do not verify age; if it comes to our attention that a child's data has reached us without parental consent, we delete it.

9. Your rights and deleting your account

• Deleting your account and data: in the app under Profile › Account › Delete account. It deletes the account, your memberships, the rooms you host, with all their messages, the messages you sent in other rooms (only the fact of deletion remains visible in their place, and your name is removed from them), your push IDs, your feedback, your newsletter subscription, your reading time sync, your synced Bible data, the backups saved to your account, your prayer requests together with the thank-you texts, and the referral/unlock data. On the devices you have already unlocked, premium keeps working after deletion but cannot be tied to a new device; the record of the purchase remains without a name because of an accounting obligation. What remains after deletion: reports made about you until the moderation decision, and after the decision for at most 12 months; a report you made, with a copy of the reported message, without your name and e-mail address, for 12 months from the moderation decision; in the referral programme, a one-way fingerprint (hash) of your e-mail address and the date of redemption for at most 24 months from the deletion of the account, for protection against abuse and so that, if you register again with the same e-mail address, you get back once the referral rewards of your former account (the Gerah between members, that is, what you received from phone to phone, we cannot give back); Gerah credits in the shared ledger, without name and e-mail address; the total count of prayers (3.16), which cannot be linked to anyone. You can also ask for the same without the app on the page https://prepperpapa.hu/fiok-torles/ (with a 6-digit code sent to your e-mail address), or at prepperpapa@gmail.com. Deleted data may still appear in backups for at most about 12 weeks, and then leaves them.
• Further rights (GDPR Arts 15-21): access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest; withdrawal of your consent at any time (processing before the withdrawal remains lawful). We answer your request within one month.
• Because we store the messages of rooms encrypted, for requests of access and erasure we can only hand over or delete the data on the server, not the copies on the members' phones.
• Complaint: National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11., Hungary; postal address: 1363 Budapest, Pf.: 9.; +36 (1) 391 1400; ugyfelszolgalat@naih.hu; naih.hu. You may also turn to a court.

10. Automated decisions, profiling

None. Noah is an open language model (Gemma 4) running on your phone, which makes no decision about you and does not send the conversation anywhere. It can be wrong; in a life-threatening situation, 112 comes first.

11. Changes

If this notice changes materially, we will notify you in the app. The effective version is the one with the date above. Earlier versions are available on request.