Privacy Policy
Last updated: 19 October 2026
This policy explains how Oikos Bible handles your personal data when you use the Oikos Bible app (on iOS, Android and the web) and the website oikosbible.com. It is complete, as the law requires, and we have tried to keep it readable. Section 2 gives the essentials in a minute.
1Who we are
The controller responsible for your personal data ("we", "us") is:
- Controller
- Oikos Bible
- Contact
- info@oikosbible.com
- Data Protection Officer
- None appointed — data-protection requests are handled directly by the people responsible for Oikos Bible.
You can reach us about anything in this policy, including every request about your data, at info@oikosbible.com.
We process personal data under Albanian Law No. 124/2024 "On Personal Data Protection", which is aligned with the EU General Data Protection Regulation, and — for users in the European Union and the European Economic Area — under Regulation (EU) 2016/679 (GDPR). Your use of the service is also governed by our Terms of Service.
2Summary in plain words
- Oikos Bible is free, with no ads and no subscriptions. We never sell your data or use it for advertising.
- We process what is needed to run the app: your account, your settings and what you create — highlights, notes, prayers, your Oikos list, groups.
- A Bible and prayer app can reveal your religious beliefs. We process that only with your explicit consent, given when you sign up.
- Your notes and your Oikos list are private to you. What you post in a group is seen by that group; what you publish is public.
- In-app analytics are our own: no third-party SDK, no advertising IDs, no IP address, none of your content. Switch them off any time in Profile → Privacy.
- Questions to the AI assistant go to OpenAI to produce the answer. We do not store them; OpenAI may keep them for up to 30 days for abuse monitoring and then deletes them.
- Our servers are in Germany (EU). A few providers are in the USA and receive data only under recognised safeguards.
- The website sets no cookies and has no trackers or analytics.
- Download all your data in Profile → Privacy → Download my data and delete your account any time in Profile → Account → Delete account.
3What data we process
Depending on the features you use, we process the following categories of personal data.
Account and sign-in
Your email address, name and profile photo; your password, stored only as a secure hash that no one can read; the identifiers of the sign-in providers you use (Google, Apple, YouVersion); session tokens; and your role, such as administrator. You can sign in with email and password, with Google, Apple or YouVersion, or continue without an account, in which case an anonymous account is created for you. To protect sign-in we also keep login rate-limit records (including the IP address) and pending verification and password-reset requests.
Preferences
App and Bible language, Bible version, the faith-stage category you choose, your home-screen layout, notification switches and times, and your analytics choice.
Content you create
Highlights, bookmarks and notes; prayers with their updates, answered dates and reminder times; journeys (rrugëtime) and trainings you write; your progress; likes, votes and ratings; comments, answers to question cards, reactions and group messages; reports you file about group messages; and images or videos you upload.
Your Oikos list and invitations
The people you pray for and walk with — first and last name, discipleship stage, notes, photo, action log and reminders — and the email addresses you enter to invite someone to a group (see section 6).
Groups
The groups you belong to and what you share in them (see section 7).
Devices and notifications
Push token, platform, app version, language, time zone and when the device was last seen (see section 10).
Usage analytics
Events about how the app is used (see section 8).
Questions to the AI assistant
The text of your question, passed on to produce the answer and not stored (see section 9).
YouVersion sign-in and link (optional)
If you sign in with YouVersion or link your YouVersion account, we receive your YouVersion user ID, name, email address, avatar and access and refresh tokens. While your account is linked, we sync your highlights in both directions: highlights you make in Oikos Bible are also sent to YouVersion, and your YouVersion highlights are brought into the app. You can unlink at any time.
Technical and server logs
Request logs for security and debugging, which may include your account ID and error details. The reverse proxy and the server containers that run our application may also log IP addresses for security and troubleshooting.
Data stored on your device
The app stores an install ID, your settings, cached content and your login session (in secure storage) on your device (see section 17).
Messages to us
Whatever you write to us, for example by email.
Where the data comes from
Most of it comes from you. Some comes from elsewhere: the sign-in provider you choose (Google, Apple or YouVersion) sends us the account details listed above, and other users may enter information about you — for example in their Oikos list or in a group invitation (section 6).
Do you have to give us data?
No law requires you to. Some data is needed for a feature to work — an account needs a sign-in method, and creating one needs the consent described in section 5. Without that data, the feature is not available.
4Purposes and legal bases
We use personal data only for the purposes below, each on the legal basis shown. "Contract" means the processing is necessary to provide the service you signed up for (Art. 6(1)(b) GDPR). Where we rely on "legitimate interest" (Art. 6(1)(f)), we have weighed it against your interests and you may object (section 15).
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and run your account; sign you in | Account and sign-in data, session tokens | Contract | Until you delete your account |
| Protect sign-in against abuse; verify email addresses; reset passwords | Login rate-limit records (incl. IP address), pending verification and reset requests | Contract; legitimate interest in keeping accounts secure | Deleted automatically after 30 days |
| Remember your settings | Preferences | Contract | Until you delete your account |
| Provide the features you use — Bible reading, highlights, notes, prayers and reminders, your Oikos list, journeys, trainings, plans, sync across devices | Content you create, your Oikos list, progress | Contract; for data revealing religious beliefs, explicit consent (Art. 9(2)(a)) | Until you delete it or your account |
| Groups: membership, messages, shared prayers, comments, answers, reactions | What you post, your display name and profile photo | Contract; explicit consent (Art. 9(2)(a)) | Until you delete it or your account; groups you lead are deleted with your account |
| Publish the journeys and trainings you choose to share | The content you publish, your name and profile photo as author | Contract | Until you delete it; after account deletion, published items stay without your name or photo unless you ask us to remove them, which you can do at any time |
| Send group invitations by email | The invitee's email address | Legitimate interest in letting members invite people they know | Not stored — used to send the email only |
| Send notifications and reminders | Push token, platform, app version, language, time zone, last seen | Contract; legitimate interest in reliable delivery | Removed at sign-out; tokens that stop working are disabled and deleted after 90 days; devices not seen for 12 months are deleted |
| Improve the app with usage analytics | Usage events (section 8) | Explicit consent given at sign-up (Art. 9(2)(a)), as usage can reveal religious beliefs, and legitimate interest in improving the app (Art. 6(1)(f)) — you can switch it off at any time in Profile → Privacy | Raw events 90 days; then only anonymous daily totals |
| Answer your questions with the AI assistant | Your question and Bible context | Contract; explicit consent (Art. 9(2)(a)) | Not stored by us; OpenAI may keep it for up to 30 days for abuse monitoring, then deletes it |
| Sign in with YouVersion or link your YouVersion account; sync highlights in both directions | YouVersion ID, name, email, avatar, tokens, highlights | Contract (at your request) | Until you unlink or delete your account |
| Keep the service secure and fix errors | Application logs; server, container and proxy logs (incl. IP addresses) | Legitimate interest in security and reliability | Application log tables 30 days; server, container and proxy logs for a short period |
| Answer your messages and requests | Your email and what you write | Legitimate interest in helping you; legal obligation for data-protection requests | As long as needed to handle the request |
| Comply with the law | Only what a legal obligation requires | Legal obligation (Art. 6(1)(c)) | As long as the law requires |
We do not use your data for advertising or for profiling, and we make no decisions about you based solely on automated processing.
5Religious beliefs and your explicit consent
Using a Bible, prayer and discipleship app can, by its nature, reveal your religious or philosophical beliefs — through your prayers, your notes, what you read, the faith stage you choose or the groups you join. The law treats this as a special category of personal data (Art. 9 GDPR).
We process it only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give when you create your account by ticking a checkbox: you consent to the processing of data that may reveal your religious beliefs — including what you read in the app — to provide and improve the service. This consent also covers the usage analytics described in section 8. We record which version of this policy you agreed to and when.
You can withdraw your consent at any time by deleting your account in the app (Profile → Account → Delete account) or by writing to info@oikosbible.com. Because the app cannot work without this processing, withdrawing consent means your account and its data are deleted. Analytics alone you can switch off at any time in Profile → Privacy, without deleting your account. Withdrawal does not affect the lawfulness of processing carried out before it.
We never use this data for advertising and never sell it.
6Data about other people that you enter
Some features let you enter information about other people: your Oikos list (the names, discipleship stage, notes, photo, action log and reminders of the people you pray for and walk with) and the email addresses of people you invite to a group.
Your Oikos list is private to you. Oikos Bible stores it only on your behalf, uses it for nothing else and never shows it to anyone else: it is never shown to other users, and our administrators cannot see its text. Invitation emails are sent and the address is not stored.
You decide what you enter, and you are responsible for having a lawful reason to enter it. Please be considerate:
- use first names only where you can;
- do not record sensitive details beyond what you really need in order to pray and care well, and record details about someone's religious beliefs only where you have their permission or another lawful reason;
- never add someone's photo without their permission.
We have no contact details for the people on your Oikos list, so informing each of them would be impossible or would involve a disproportionate effort (Art. 14(5)(b) GDPR); for that reason we do not notify them individually. Anyone who thinks someone has entered information about them can contact us at info@oikosbible.com to exercise their rights.
7What others can see
- Only you: your notes, highlights, bookmarks, your Oikos list and the prayers you do not share. (Authorised administrators can view and correct the text of prayers — see section 11.)
- Your groups: what you post in a group — messages, shared prayers, comments, answers to question cards, reactions — is visible to that group's members, with your display name and profile photo next to it.
- Your journeys and trainings: a draft is private; an unlisted one can be opened by anyone with its link and by the groups you share it with; a published one is public — in the app's catalog, on our website and through share links. Users with a publisher role also see unlisted journeys and trainings written by users in their review queue, and our administrators can open drafts.
Please respect the confidentiality of what others share in a group — see the Terms of Service.
8Analytics and how to switch them off
To learn which parts of the app help people, the app records simple usage events. This is our own, first-party analytics: no third-party analytics SDK, no advertising IDs, no IP address and none of your content. An event contains:
- the event name and the screen;
- the ID of the item involved, for example journey:12;
- a few small technical properties;
- platform, app version and build, and language;
- timestamps;
- your account ID or an install ID, and a session ID.
Legal basis: your explicit consent given at sign-up (Art. 9(2)(a) GDPR, see section 5), which covers what you read and how you use the app, together with our legitimate interest in improving the app (Art. 6(1)(f) GDPR). Analytics are on by default, and you can switch them off at any time.
To switch them off, open Profile → Privacy in the app. From then on the app sends nothing, and our server also discards any event for your account. Switching off is how you object to this processing and withdraw your consent to it, without deleting your account.
Raw events are deleted after 90 days; only anonymous daily totals are kept. Events sent before you sign in carry only an install ID and are not linked to your account. The website has no analytics at all.
9AI assistant
When you ask the AI assistant a question, the text you type — together with the relevant Bible passages as context — is sent to OpenAI to generate the answer. We do not store your questions or the answers.
OpenAI processes this data as our processor. Under its API terms, data sent through the API is not used to train its models; OpenAI may retain it for up to 30 days to monitor for abuse, and then deletes it. OpenAI is based in the USA (see section 12).
Please do not put personal data — your own or anyone else's — in your questions.
Answers are generated automatically and may be wrong or incomplete; see the Terms of Service.
10Notifications
The app uses Google Firebase Cloud Messaging, which may create a device identifier (a push token) when the app starts. Your device registers that token with us, together with its platform, app version, language, time zone and when it was last seen, so that we can send you things like the verse of the day, prayer reminders and group activity at the right time and in your language. Notifications are only shown if you allow them in your device's system settings and in the app's Profile settings.
Notifications are delivered through Google Firebase Cloud Messaging and, on Apple devices, the Apple Push Notification service. Their text may contain short excerpts — for example the title of a prayer a group member shared — which therefore pass through those services.
You choose which notifications you receive, and when, in the app's settings, and you can turn them off in your device settings. When you sign out, the device's token is removed. A token that stops working is disabled and deleted after 90 days, and a device not seen for 12 months is deleted.
Legal basis: contract, and our legitimate interest in delivering notifications reliably.
11Recipients and processors
We do not sell personal data and we do not share it for advertising. We share it only with:
- Contabo GmbH (Germany, EU) — hosting of our servers, database and file storage (our own self-hosted object storage).
- OpenAI (USA) — the AI assistant, only when you use it, and the translation of our own platform content by administrators.
- Google (USA) — Google Sign-In, if you use it, and Firebase Cloud Messaging for push notifications.
- Apple (USA) — Sign in with Apple, if you use it, and the Apple Push Notification service.
- YouVersion (Life.Church, USA) — only if you sign in with YouVersion or link your YouVersion account; while your account is linked, your highlights are also sent to YouVersion. YouVersion also licenses Bible translations shown in the app.
- Third-party media hosts — for example Unsplash (Canada), YouTube (Google, USA) or Vimeo (USA), or any image link an author used. Some images, videos and video thumbnails in our content are loaded from them, so your device contacts them, and they receive your IP address, when such content is shown. Authors' profile photos may likewise be loaded from the servers of their sign-in provider (Google, Apple or YouVersion).
- Our email service (mail.oikosbible.com) — verification codes and group invitations.
- App stores (Apple App Store, Google Play) — they handle downloads of the app under their own privacy policies.
- Authorities — only when we are legally required to.
Our administrators
A small number of authorised Oikos administrators, bound by confidentiality, can see — to provide support and keep the platform safe — your email address, name, profile photo, sign-in methods, roles, last activity, counts of your activity, your group memberships (and, in the admin tools' Groups section, group names and descriptions and members' email addresses), your faith-stage category, Bible version, app language, whether a YouVersion account is linked, and your consent status. They can view and correct the text of prayers for support and abuse handling. Through the admin tools they never see your notes, the text of your Oikos list or the text of group messages.
12International transfers
Our servers are in the EU (Germany). Some recipients in section 11 are outside Albania and the European Economic Area. We transfer personal data to them only with adequate safeguards: an adequacy decision, the EU–US Data Privacy Framework where the recipient is certified under it, or the Standard Contractual Clauses approved by the European Commission.
You can ask us at info@oikosbible.com for more information about these safeguards or for a copy of them.
13How long we keep data
- Account, preferences and content: until you delete them or your account.
- Login rate-limit records, pending verification and password-reset requests: deleted automatically after 30 days.
- Logs: the application's own log tables are deleted after 30 days; server, container and reverse-proxy logs (which may include IP addresses) are kept for a short period for security and troubleshooting.
- Device tokens: removed at sign-out; tokens that stop working are disabled and deleted after 90 days; devices not seen for 12 months are deleted.
- Analytics: raw events for 90 days, then only anonymous daily totals.
- AI questions and answers: not stored by us; OpenAI may keep them for up to 30 days for abuse monitoring. Invitation email addresses: not stored.
- Messages to us: as long as needed to handle your request.
When you delete your account
Your account and all your personal data are removed immediately from our live database: prayers, notes, your Oikos list, group memberships, comments, answers, devices, preferences, your consent record and uploaded files — except files still used by journeys or trainings you published, which are kept with that content. Groups you lead are deleted. Journeys and trainings you published remain available without your name or profile photo unless you ask us to remove them, which you can do at any time (see the Terms of Service). Analytics events sent before you signed in carry only an install ID: they are not linked to your account and expire within 90 days. Anonymous aggregate statistics remain. See the account deletion page.
Backup copies of our database exist for disaster recovery. They are kept for a limited period on their rotation cycle — for some backups up to two years — are accessible only to a few authorised people and are never used for anything else. If a backup ever has to be restored, the deletions made since it was taken are applied again.
14Security
We protect your data with:
- encrypted connections (TLS) everywhere;
- passwords stored only as secure hashes;
- access control — every request is checked on our server and limited to your own account;
- role-based access for administrators;
- hosting in the EU;
- collecting as little data as possible.
If a personal data breach occurs, we notify the supervisory authority within 72 hours and inform affected users where the law requires it.
15Your rights and how to exercise them
You have the right to:
- Access — know whether we process your data and get a copy of it.
- Rectification — correct your data. Most of it you can edit directly in the app.
- Erasure — delete your account in the app (Profile → Account → Delete account), via our account deletion page, or by writing to us.
- Restriction — ask us to limit the processing of your data, for example while a correction is being checked.
- Data portability — download all your data as a JSON file in the app: Profile → Privacy → Download my data.
- Objection — object to processing based on our legitimate interests, including analytics (switch them off in Profile → Privacy).
- Withdraw consent — at any time, without affecting earlier processing (section 5).
- Not be subject to solely automated decisions — we make none.
- Complain to a supervisory authority (section 19).
Use the options in the app or write to info@oikosbible.com. We answer within one month; for complex requests this can be extended by two further months, and we will tell you if it is. We may need to confirm your identity before acting on a request.
16Children
Oikos Bible is not directed at children under 16. You must be at least 16 years old to create an account. If we learn that an account belongs to someone under 16, we delete it. If you believe a child has given us personal data, please write to info@oikosbible.com.
17Website, cookies and local storage
The website oikosbible.com sets no cookies, uses no local storage and contains no analytics or trackers. Its fonts are hosted by us. Our servers keep short technical logs of requests (section 13).
Some pages show images, videos and video thumbnails from third-party hosts — for example Unsplash, YouTube or Vimeo, or any image link an author used — and authors' profile photos, which may be loaded from the servers of their sign-in provider (Google, Apple or YouVersion). When such content is shown, your browser contacts those services, which receive your IP address; their own privacy policies apply.
In the app
The app stores an install ID, your settings, cached content and your login session (in the device's secure storage) on your device. This is strictly necessary to provide the app.
18Changes to this policy
We may update this policy when the service or the law changes. The date at the top shows the current version. We announce changes in the app and on this website; after a material change, the app asks you to agree again.
19Contact and complaints
For questions, requests or concerns about your data, write to info@oikosbible.com.
You also have the right to lodge a complaint with a supervisory authority:
- In Albania: the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) — idp.al.
- In the EU/EEA: the data protection authority of the country where you live or work — see the list of EU data protection authorities.