Privacy Policy

Last updated: November 11, 2026

1. Who We Are

Beatitude (“we,” “us,” “our”) is operated and published by Shepherd Systems Inc., an Ontario corporation, which is also the seller of record for purchases made through the App Store. Shepherd Systems Inc. is the data controller for the information described below. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights you have over it.

How to reach us. We do not publish a mailing address. Every right described in this Policy — access, correction, deletion, withdrawing consent, or making a complaint — can be exercised by email or by phone, and we do not require anything to be sent on paper:

• Email: hello@beatitudeapp.com
• Phone: +1 236-242-3780
• Data Protection Contact: Privacy questions can be directed to hello@beatitudeapp.com.

2. Information We Collect

We deliberately collect less than most apps in this category, by design:

Account & Profile:

• First name only (we do not collect last names), and it is optional
• Email address, used to sign you in by link — there is no password
• Country of residence, time zone and app language
• Onboarding quiz answers (prayer experience, struggle areas, prayer goals, prayer frequency and timing), your age range, and whether you believe in God
• If you are new to prayer, we ask once — optionally — what brought you here. One of six choices, and one of them is bereavement. It is the most sensitive thing we ask, so: answering is optional and skipping writes nothing at all; it is shown to no other user in any form; it changes nothing about which screens you see, so it cannot be inferred from your experience of the app; and you can have it deleted with the rest of your data at any time.
• A routine you choose to tie prayer to, in your own words if none of the presets fit (“after breakfast”). It appears on your own home screen and your own reminder, and nowhere else.
• The picture you choose for yourself, if it is one of our twelve symbols — we store which one. A photo from your library is not uploaded: it is copied into the app’s own storage on your phone and stays there, so it does not survive reinstalling the app and we never receive it.
• A record of your agreement to this policy and the Terms: which versions you agreed to, when, and the language the app was in. It is kept so we can show that consent was given and to what; it can never be edited, only added to.

Prayer Requests (Core App):

• A preselected struggle category (health, family, grief, job loss, addiction, relationship, guidance, provision, etc.) — selected from a fixed list, never free-form text
• We do not collect free-text descriptions of your situation

Usage & Engagement Data:

• Prayer completion logs, and a running count of how many people you have prayed for
• If you subscribe to the Mirror: a count of how many spoken prayers you have had analyzed on each day. This is how the fair-use limit described in our Terms is applied. It is a number per day and nothing else — not when you prayed, not for how long, and never any of the words
• Streaks, Blessings Points, levels and cosmetics were removed from the product in September 2026. The tables that held them have been dropped and nothing creates them: they are not collected at all
• This data is private to you by design — see Section 5

The Mirror Data (Optional, Paid Feature):

We never keep a recording. Your prayers are transcribed on your device, the audio is discarded immediately, and only the text is used to build your reflections — held for up to nine days, then deleted once your reflection is written.

That sentence is the canonical wording. It appears verbatim on the in-app paywall before anyone can subscribe, and the Apple App Privacy Label and Google Play Data Safety declarations are filled in to make the same claim in their own vocabularies (see Legal/Apple-App-Privacy-Label.md and Legal/Google-Play-Data-Safety.md). If it changes here it must change in all of them on the same day — three surfaces disagreeing about where a person’s voice goes is the version of this that becomes a regulatory problem.

It is also a binding constraint on the implementation, not a description of intent. On-device transcription is enforced in code: if a device cannot transcribe locally the feature refuses to run rather than falling back to a cloud transcription service, and the Mirror is never offered for sale on such a device in the first place.

• Weekly, monthly, and annual reflections on themes and patterns in your prayers are retained so you can track your own growth over time

Analytics:

We use TelemetryDeck to understand how the app is used. TelemetryDeck was chosen specifically because it does not collect device identifiers (IDFA/IDFV) or any other cross-app tracking data, consistent with our approach of collecting less than most apps in this category.

• What we send to TelemetryDeck: the name of an event (for example, that an onboarding screen was viewed, that a prayer was logged, or that the daily prayer lock was turned off), together with your platform, operating system version, app version, and language. Events carry only fixed categories and counts.
• What we never send to TelemetryDeck: the content of any prayer request, the first name or country attached to any request, your email address, spoken-prayer transcripts, or any free-form text. The app has no free-text fields, so there is no such content to send.
• How you are identified in analytics: your account identifier is hashed on your device before anything is sent, so TelemetryDeck receives a pseudonymous value and never your actual account identifier. This lets us see, for example, how many people finish onboarding, without tying that to you.
• Subscription and revenue analytics (billing events such as purchase, renewal, cancellation and refund) are handled separately through our subscription management provider (RevenueCat). Beatitude has no free trial, so there is no trial or conversion data of any kind.

Payment Information:

• Processed entirely by Apple App Store or Google Play — we do not receive or store your payment card details

Notifications, if you allow them. If you turn on notifications, the app stores a push token for your device so we can send them. Messages are delivered through Expo’s push service. A notification may contain the first name of someone you shared and the country a prayer came from. Nothing else.

We do not use free-text fields anywhere prayer requests are submitted. This is a deliberate privacy and safety design choice, not an oversight.

3. Automated Processing & AI Disclosure

The Mirror feature uses artificial intelligence (Anthropic’s Claude models) to analyze the text of your transcribed prayers and generate personalized reflections, pattern observations, and suggestions. This AI processing:

• Does not make any decision that produces legal or similarly significant effects on you
• Is used solely to generate reflective, informational content for your own use
• Can be disabled entirely by not subscribing to or using the Mirror, which is optional and separate from the core app

4. Why We Collect This Information (Purposes & Legal Basis)

Because prayer content and religious affiliation are treated as sensitive personal data in multiple jurisdictions we operate in (including explicit treatment of “religious beliefs” as sensitive data under some US state laws), we obtain your explicit, opt-in consent before collecting any of the above — not passive “by using this app” consent.

5. Who Can See Your Information — This Is Important, Please Read

This is different from most apps’ privacy policies, and we want to be direct about it: when you submit a prayer request, your first name, country, and selected struggle category are shown to other Beatitude users so they can pray for you. This is the core purpose of the app.

• We do not show your last name, exact city, or any free-text description
• We cannot guarantee that someone who knows you personally won’t recognize you from this reduced information, especially in smaller or tight-knit communities
• There is no public profile. Other users see a first name, a country and a category on a prayer request, and nothing else — there is no page about you for anyone to visit
• Your own activity, including how many people you have prayed for, is visible only to you and is never shown to anyone else
• We do not sell your personal information to third parties, and we do not use your prayer content for advertising

6. How Long We Keep Your Information (Data Retention)

The Mirror transcripts specifically (the canonical wording is in Section 2; this expands it, and must not contradict it):

• No audio is ever recorded or stored, at any point
• Transcribed text from each day’s prayer is held until that week’s reflection is written, and never longer than nine days
• Once your weekly reflection is successfully generated and saved, the raw text from that week is permanently deleted
• If a reflection cannot be generated — a failure on our side — the text is deleted regardless after nine days. The extra two days exist so that a reflection still being retried does not lose the start of its own week
• Weekly, monthly, and annual reflections are retained permanently (or until you delete your account/request deletion), since these are the actual product you’re using — the Mirror is designed as an insight tool, not a permanent journal of your exact words

Other data: retained for as long as your account is active, or as required to comply with legal obligations, resolve disputes, and enforce our agreements.

7. Your Rights (Vary by Region)

All users, regardless of location, may request access to, correction of, or deletion of their personal information by contacting hello@beatitudeapp.com.

Deleting your account. Step-by-step instructions, exactly what is deleted, what is not, and how long it takes are at beatitudeapp.com/delete-account. That page requires no sign-in and no app installed.

If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect, request deletion, correct inaccurate information, opt out of the sale or sharing of information (we do not sell your information), and limit use of sensitive personal information. Data belonging to consumers under 16 is treated as sensitive personal information under current California law.

PIPEDA applies to everyone, not only to Canadians. Shepherd Systems Inc. is an Ontario corporation, and Ontario has no substantially similar private-sector privacy law, so Canada’s Personal Information Protection and Electronic Documents Act governs how we handle personal information in the course of our commercial activities — including information belonging to users in the United States. Accordingly, every user, wherever they live, may access their personal information, challenge its accuracy, and withdraw consent at any time, subject to legal or contractual restrictions. We respond to access requests within 30 days.

If you are a Canadian resident, you may also file a complaint with the Office of the Privacy Commissioner of Canada, or with the applicable provincial authority (for example under Quebec’s Law 25), if you believe your rights have been violated.

8. Children’s Privacy

Beatitude is not directed at, and is not intended for use by, anyone under the age of 13.

We ask for a year of birth at sign-up, before anything you answered during onboarding is written to our servers. If the answer works out to under 13, we stop there: no account is completed, and nothing about that person is sent to us — not the year, not their answers, not a record that they were turned away. The year stays on their own device so that the refusal survives closing the app, and it expires by itself the year they turn 13.

For everyone else we keep only the range — 13–17, 18–29, 30–54, or 55+. We never store the year itself or a full date of birth.

9. Crisis Resources Disclaimer

If you select a crisis-adjacent category — grief, addiction, or mental health — when submitting a prayer request, we display contact information for country-specific crisis support organizations. That list lives in the app and is shown to you at the moment it is relevant; it is maintained by us and updated as organizations change, so the app is always the current version rather than a copy printed here.

Beatitude is not a substitute for professional mental health care, emergency services, or medical treatment. We do not monitor submissions in real time, and we cannot guarantee a response to any specific submission. If you are in immediate danger, contact your local emergency services.

10. If Something Goes Wrong (Breach Notification)

If we discover a breach of personal information that is likely to cause you serious harm, we will notify you and the relevant regulator as required by the law that applies to you:

• United States: state breach notification laws, which vary
• Canada: report to the Office of the Privacy Commissioner and notify affected individuals where there is a real risk of significant harm (PIPEDA), and maintain a record of every breach regardless of severity

11. International Data Transfers

We are a Canadian company and our infrastructure is not in Canada, so your information crosses a border. There are four separate flows and they affect different people to different degrees. Each is described on its own rather than gathered into one paragraph, because the first applies to you whether or not you ever pay us anything, one applies if you turn on notifications, and the other two do not exist at all unless you subscribe.

1. Your account and prayer data — everyone, always. Our primary database and our authentication service are hosted in the United States (Supabase, US West region). This is where your account, your first name, your country, your onboarding answers, your prayer requests and your prayer history are stored. It applies to every Beatitude user from the moment an account is created. It is not optional and it is not tied to any paid feature.

2. The Mirror transcripts — subscribers only, text only. If, and only if, you subscribe to the Mirror, the transcribed text of your prayers is sent to Anthropic for processing into your reflections. The audio never leaves your device and is never stored — see Section 2. This flow does not exist for users who do not subscribe.

3. Subscription records — subscribers only. If you subscribe, our subscription provider RevenueCat receives an app-specific user identifier and your billing events from the app store (purchase, renewal, cancellation, refund) and processes them in the United States. It never receives the content of any prayer, any transcript, any reflection, or the name or country on any prayer request. Your payment details go to Apple or Google and reach neither RevenueCat nor us.

4. Push notifications — if you allow them. If you turn on notifications, the app stores a push token for your device so we can send them, and the notifications themselves are delivered through Expo’s push service. A notification may contain the first name of someone you shared and the country a prayer came from, and nothing else. This applies if you allow notifications, whether or not you subscribe.

Separately, TelemetryDeck receives anonymous usage events — event names, platform, OS version, app version and language, tied to an identifier hashed on your device — and may process them in the United States or elsewhere.

In every case we remain accountable for the personal information we transfer to a service provider for processing on our behalf, and we use contractual means to require a comparable level of protection. Information held in the United States may be accessible to US courts, law enforcement and national security authorities under the laws of that country.

Beatitude is currently available only in the United States and Canada. We do not knowingly collect personal information from residents of other countries, and this Policy does not address the legal requirements of jurisdictions outside the US and Canada. In particular, Beatitude is not offered in the United Kingdom or the European Economic Area, and this Policy is not drafted to satisfy the GDPR or UK GDPR. Distribution will be expanded to other countries only once appropriate legal review for those jurisdictions is complete.

12. Security

We use industry-standard security measures, including encryption in transit and at rest, to protect your information. No system is completely secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We will update this policy as our practices change or as required by law.

When we make a material change, the app tells you: we record which version of this policy and of the Terms you agreed to, so an account holding an older pair is shown a notice on the home screen naming the new ones, with links to both, and asked to agree again. The date at the top of this page always names the current version.

14. Contact Us

• Email: hello@beatitudeapp.com
• Phone: +1 236-242-3780

We do not publish a mailing address. Both channels above reach us directly, and either one is sufficient for any request or complaint under this Policy.

Terms of Service · Privacy Policy · Delete your account