Privacy policy

You do not need an account

You can ask a question without signing in. An account is only for optional encrypted sync of saved answers, and for deleting those server copies later.

Chat is not stored by default

There is no conversation table. A question is sent in the body of POST /api/ask or POST /api/guide and is not written down as a chat. The application log records the event, the mode, and how long the question was. It strips question, answer, journal, prompt, and similar fields before the line is written. This repository does not include an analytics package.

The rate limiter keeps an address-derived key and a count. It does not keep the question text. A topic page can put its starter question in the address of /ask. A question you type is not put in that address.

The journal stays on the device

On the iOS app, the journal, the next step, the check-in date, and saved answers sit in one vault. The vault is encrypted with AES-GCM before it is written. On an iPhone the key is stored in the keychain. The browser preview of the app keeps that same key in local storage, which is weaker, and the in-app Privacy screen says so.

The server refuses a journal upload. POST /api/journal always returns journals_stay_on_device. The upload rule allows a saved answer only, and only after you turn encrypted sync on. Journals, the next step, and the check-in are refused even when that switch is on.

The website's A fresh start page is a separate browser demo. It stores its journal, next step, and check-in in this browser's local storage, unencrypted. That copy is still not accepted by the server.

Saved answers can sync as ciphertext

On the iPhone, saved answers stay in the vault until you turn on encrypted sync. Turning it on uploads ciphertext, an IV, and the salt label device-aes-gcm-key-stays-on-device to your own saved_items rows. That label is not the key. The AES key stays on the device. Turning the switch off does not delete copies already uploaded. Those stay until you delete the account.

On the website, Save writes the answer into this browser's local storage in the clear. A separate control on Account can encrypt a note in the browser with a passphrase (AES-GCM) and upload only that ciphertext. The passphrase is not sent.

What the AI provider receives

If LLM_PROVIDER is openai, openai-compatible, anthropic, or xai, and the matching key is set, the server sends your question and the retrieved source summaries to that provider. demo, or a missing key, answers from the library on the server and does not call a provider. A failed live call returns an error. It does not fill in the demo script.

What the provider keeps, and for how long, is the provider's own policy. This app does not control that.

No training on private content

This app does not train a model on private chats or journals. The only export is GET /api/admin?view=export, and only an admin can download it. Each line is an admin-approved pair marked style_format_only, with the warning that factual knowledge stays in the source library and that private conversations and journals are not training data. The export refuses journals.

Reports

POST /api/reports stores a category, a note, and source ids. The answer text is stored only when you check the box to include an excerpt. On the iPhone that category is sent as factual. On the website you can choose factual error, broken source, unfair framing, or harmful response.

Deletion

In the iOS app, Privacy and settings has "Delete saved answers, journal, next step, and check-in." That removes the vault and its key from the device.

"Delete account and server copies" sends POST /api/account with {"action":"delete"} and your access token. The server deletes the Supabase user. Rows in saved_items for that user are removed by the database cascade. A token can remain valid until it expires. The user record is already gone. Clearing the device is separate. Deleting the account does not wipe the on-device vault.

On this website, Account can clear the browser copies (saved answers, journal, next step, and check-in in local storage). The local username account on that page exists for the SQLite demo. The hosted site does not open SQLite, so that username path is not available there. Hosted accounts are the ones created in the app.

Deleting a row in the app database does not delete a backup your host already made. This app does not run those backups, and it cannot expire them.

Contact

Questions about this policy: support@askthebishop.com. How to report a bad answer, delete data, or reach crisis lines is on Support.