Trust & security
Security engineered into every product.
Encryption, verified accounts, and human moderation, built into the products. This page covers what is in place today and what we are still building.
Our commitments
What we put in place.
Encrypted in transit and at rest
Data is encrypted with TLS in transit and at rest on our servers. Private messages and prayer requests are next for end-to-end encryption, where only the people in the conversation hold the keys.
We do not train AI on your life
Your conversations, prayers, journal entries, and messages are never used as training data. That rule is built into the products, not a setting to turn on.
Real people, verified
Profile photos are checked against a live capture before an account can reach other people, and every install is verified as a genuine, unmodified app.
Reports reach a person
When you report or block someone, it goes to a human who reviews it. Accounts that keep harming people are removed.
Children are handled differently
Anything made for children has no open-ended AI conversation, no advertising, and no way for strangers to reach them. A parent approves generated content before a child sees it.
Clear about your data
We are incorporated in Canada and handle personal information under PIPEDA, honouring GDPR rights for people in the EU and UK. Deleting your account deletes your profile and your content.
How it works
The details, in plain language.
You should not need a technical background to understand how your information is handled.
- Signing in
- You can sign in with email, Google, or Apple. Passwords are handled by Firebase Authentication and are never stored in a form we, or anyone else, could read.
- App integrity
- Our apps confirm that requests come from a genuine, unmodified install before they reach our servers, using Play Integrity on Android and App Attest on iOS.
- Connections
- Everything travels over HTTPS, and browsers are instructed to refuse anything less. Our pages also refuse to be embedded in other sites, and stop browsers guessing at file types.
- Payments
- Your card details never touch our servers. Payments run through Google Play, Apple, and Braintree, each of which handles card data under its own certification.
- Who can see what
- Rules on our servers govern every read and write. Our own access to live data is restricted to the people who need it, and every such access is logged.
- Your data, on request
- Deleting your account removes your profile and the content attached to it. If you would like a copy of your information, or a correction made to it, email us and a person will handle the request.
Where we are
What is done, and what is next.
Security work is never finished, so the useful thing is to show both columns. On the left is what protects your account today; on the right, what we are actively building.
In place today
- Encryption in transit and at rest across all products
- Verified accounts and app integrity checks on mobile
- Personal information handled under PIPEDA, with GDPR rights honoured
- A published privacy policy and terms of service
What we are working on
- End-to-end encryption for private messages and prayer requests
- A published security contact and disclosure policy
- A written incident response process
- Formal SOC 2 readiness work
Found a problem?
Tell us and we will fix it.
If you have found a security issue, we want to hear about it. Email us with what you found and how to reproduce it, and we will confirm we received it. We will not take action against anyone who reports something in good faith.