Privacy Policy

1. Information and sources

Information depends on the features you use. We receive it from you, your device, the sign-in or purchasing provider you choose, and any organization or referral code you redeem.

• Account and profile: account identifiers, name, email, sign-in provider, and optional profile photo, tagline, or location you enter. Apple may supply a private relay email instead of your usual address. Email sign-in also uses authentication and verification records.
• Assessment and activity: answers, scores, suggested or chosen pillars, journey dates, completion history, streaks, saved Bible passages, watched teachings, and related progress summaries.
• Content you save: reflections, journal entries, artifact or exercise responses, personal standards or covenants, signatures, and images you choose to upload.
• Purchases and access: app user identifiers, products, store transaction references, subscription status and dates, entitlement and conversion events, and organization membership or referral attribution. Apple or Google processes payment details; we do not receive your full payment card number from an in-app purchase.
• Device and service records: device and app information, notification preferences and registrations where used, delivery or notification history, IP addresses, request and authentication logs, and diagnostic or security information.
• Support: contact details, messages, attachments, and records needed to investigate a request, verify account ownership, or document its resolution.

Account and authentication information is needed for account features; purchase verification is needed for paid access. You can omit optional profile fields and choose whether to save reflections or grant optional device permissions. A feature may not work without the information needed for that feature. Please do not include information about other people or unnecessary sensitive details in free-text fields or support messages.

2. Purposes and legal grounds

• Provide the Service: create and authenticate accounts, store and sync content, calculate assessments and progress, and deliver the journey you request.
• Manage access: verify purchases, restore entitlements, administer organization sponsorships and referral codes, and resolve billing issues.
• Communicate: send verification and account messages, respond to support, and deliver reminders you enable. Notification permissions can be changed in the app and your iOS or Android settings.
• Operate responsibly: diagnose faults, protect accounts, prevent abuse, maintain service quality, comply with legal obligations, and handle claims.

Where the EEA, UK, or comparable laws require a legal basis, ordinary account and service processing is necessary to perform our contract with you; proportionate security, reliability, and support activities rely on our legitimate interests in operating a safe, functioning Service, balanced against your rights. Compliance records rely on applicable legal obligations. Optional processing that requires consent relies on that consent, which you may withdraw without affecting earlier lawful processing. Sensitive information requires an additional legal condition, explained below. We do not treat acceptance of the Terms or this policy as blanket consent for every use of information.

3. Sensitive faith and health information

Use of a Christian faith app, assessment answers, saved passages, and reflections may reveal religious or philosophical beliefs. Fitness, wellbeing, financial, or relationship entries can also contain sensitive information, including health information. We use information you provide for the features and purposes described here, rather than for advertising or unrelated profiling. You control what you write and save.

Where applicable law requires explicit consent or another specific legal condition to process sensitive information, that requirement applies in addition to the ordinary legal basis. Any explicit-consent request must be separate, specific, and presented before the processing that needs it; merely using the Service or accepting the Terms does not supply that consent. Contact the privacy team to withdraw consent, request removal of an entry, or ask which features depend on that information. Withdrawal may prevent us from continuing the affected feature, but does not remove other privacy rights.

4. AI-assisted content and personal information

Some published content is generated or edited with artificial intelligence (AI). This may include teaching text, prompts, challenges, summaries, and illustrations. AI-assisted content can contain errors or bias; see the AI content section of our Terms.

Producing published content with AI is different from using your personal information in an AI system. This disclosure does not authorize sending your private reflections, assessment answers, photos, or other personal information to a third-party AI service, or using them to train general-purpose AI models.

Before introducing a feature that sends personal information to a third-party AI provider, we will identify the provider, the information sent, the purpose, relevant retention and training practices, and your choices in a notice at the feature. We will obtain explicit permission before sharing where required, including under applicable app-store rules. You may decline that optional use. A future AI feature’s permissions cannot be inferred from your acceptance of this policy.

The assessment uses predefined scores, weights, and tie-breaking rules across the four pillars to suggest a starting area. Progress summaries are calculated from recorded activity. These tools support self-reflection, and are not medical diagnoses or decisions with legal or similarly significant effects. Contact us to question a result or ask how your information contributed to it.

5. Service providers and other recipients

Information is handled by providers relevant to the features you use:

• Supabase: authentication, database, storage, and backend services for account, assessment, saved content, access, and progress records.
• Apple and Google: sign-in information when you choose their sign-in services, app-store purchases and billing, and platform services. They also handle information for their own purposes under their respective policies.
• RevenueCat: app user identifiers, purchase and subscription information, device or app information, and entitlement verification and management.
• Resend and our email providers: addresses and message information needed to deliver authentication, account, and support communications.
• Website hosting and delivery providers, including Lovable: connection, request, and diagnostic information needed to deliver and maintain the website. The website also requests fonts from Google Fonts, which receives connection details such as your IP address and browser information.

Authorized team members and professional advisers may access information where needed for support, security, legal, or operational purposes. We may disclose relevant information where required by law, to protect legal rights or safety, or in a business transaction subject to applicable privacy protections and required notice. We do not sell personal information or share it for cross-context behavioral advertising, and do not share private reflections with advertisers.

If you use sponsored access or a referral code, we record the code, attribution, membership, and access status to administer that arrangement. A code does not itself give a sponsor or affiliate access to your private journal. Any additional sharing with a sponsor requires its own applicable disclosure and legal basis. Independently operated Explore destinations, including Genesis 90, have separate policies; following a link does not itself transfer your account or saved reflections to that business.

6. Storage, device permissions, and security

Account information is stored through our backend providers. Some information and preferences are also cached on your device for app operation. We use measures such as encrypted connections, authentication, and access controls to protect information; no storage or transmission system can guarantee absolute security. A device-level biometric lock, where enabled, is managed by the operating system; it does not give us your fingerprint or facial template.

You can manage notification and photo permissions in your device settings. Local storage and similar technologies support sessions, preferences, and app operation. Your browser and device settings let you clear stored information, though doing so may remove local preferences or sign you out. Optional tracking that requires consent must be disclosed and offered with a choice before it is enabled.

7. Retention and deletion

We retain account and saved journey information while needed to provide your account and requested features, unless you delete it sooner. You can delete individual content where the app offers that control or request help from support. Deleted items may have an in-app recovery period if shown in that feature; permanent account deletion is distinct from that recovery feature.

Permanent account deletion removes the sign-in account and associated app-owned records as described on the Delete Account page. We may retain limited records where needed for an applicable legal obligation, security investigation, transaction record, or legal claim. Retention is determined by the purpose, applicable recordkeeping or limitation period, and whether the information is still needed. A retained record is not permission to continue unrelated use. Ask support which records, reasons, and periods apply to your request.

Support correspondence is kept as needed to resolve requests and document relevant obligations or disputes. Technical records are kept as needed for reliability, security, and investigation. Provider backups and independently controlled store or billing records can have different retention cycles; account deletion does not delete your Apple or Google account. Deletion also does not automatically cancel a subscription.

8. International processing

We operate from the United States. Our team and service providers may handle information in the United States and other countries where they operate, which may have different privacy laws from your country. The providers and purposes are identified above; contact us for the processing locations and transfer arrangements relevant to your information.

Where law restricts an international transfer, a permitted transfer mechanism and any required additional safeguards must be in place before that transfer. Depending on the circumstances, mechanisms may include an applicable adequacy decision or approved contractual protections, such as EU Standard Contractual Clauses and the applicable UK transfer instrument. This policy does not assert that a particular provider is certified under a transfer framework. Using the Service or accepting this policy does not waive transfer protections or constitute blanket consent to international transfers. You may ask the privacy team about applicable safeguards and how to obtain a copy.

9. Your choices and requests

Depending on the law that applies, you may request access or confirmation of processing, a copy of your information, correction, deletion, portability, restriction, objection to processing, withdrawal of consent, or review of an automated result. You may also have rights concerning sensitive information, targeted advertising, or sale and sharing. We do not penalize you for exercising applicable privacy rights.

• Request account deletion: use Settings → Delete Account, or the public Delete Account page without signing in or reinstalling the app.
• Other privacy requests or consent withdrawal: email support@warriorcodeapp.com with the subject “Privacy request.” Explain what you want us to do and give your account email. Do not send your password, full payment details, or unnecessary identity documents.
• Notifications: change the in-app preferences or your iOS or Android notification settings. Switching off reminders does not stop essential account messages.
• Subscriptions: manage or cancel through the store where you subscribed.

We may request proportionate information to verify you or an authorized representative before releasing or deleting information. Requests are generally free, subject to exceptions allowed by law. We will respond within the deadline required by the law that applies, explain any lawful refusal or extension, and provide applicable appeal options. A shorter local deadline takes priority over general timeframes below.

10. Regional rights and complaints

EEA, United Kingdom, and Switzerland: applicable rights include access, correction, erasure, restriction, objection, portability, and consent withdrawal. EEA and UK requests are generally due a response within one month, with a notified extension only where the law permits. You may complain to your local supervisory authority, including an EEA data protection authority, the UK ICO, or the Swiss FDPIC, as applicable. You do not need to complete our internal process before exercising a statutory complaint right.

California and other US states: where the relevant law applies to us, you may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising or certain profiling, limit specified uses of sensitive information, and receive equal treatment. The information categories, sources, purposes, recipients, and retention criteria are described in this policy. We do not sell information or share it for cross-context behavioral advertising. We will honor legally required opt-out preference signals for any processing to which they apply. California access, correction, and deletion requests generally receive a substantive response within 45 days, subject to a lawful, notified extension. Authorized agents may submit a request with appropriate proof of authority. Where an appeal right applies, reply with “Privacy appeal”; we will provide the outcome and the applicable regulator complaint route if unresolved.

Canada: where applicable, you may request access, correction, information about disclosures, or withdrawal of consent, subject to lawful limitations. Our privacy team handles accountability and complaints. You may contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including Québec’s Commission d’accès à l’information.

Australia and New Zealand: where applicable, you may request access or correction and complain about how information is handled. Email our privacy team with what happened and the outcome you seek. We will investigate and explain our response within the applicable timeframe. Unresolved concerns may be raised with the Australian OAIC or the New Zealand Privacy Commissioner.

Brazil: where the LGPD applies, rights include confirmation, access, correction, information about sharing and consent, portability where applicable, anonymization, blocking or deletion of unnecessary or unlawfully processed information, deletion of consent-based information subject to lawful exceptions, consent withdrawal, and review of qualifying automated decisions. Contact our privacy team first; unresolved concerns may be submitted to the ANPD.

Other locations: local law may provide additional rights, consent, grievance, language, or transfer requirements. Contact the privacy team to exercise applicable rights. This policy does not limit a protection or remedy granted by your local law, and does not represent that every feature is offered in every country.

11. Adults only

The Service is intended for people who are at least 18 and have reached the age of majority where they live. It is not directed to children. If you believe a child has provided personal information, contact us so we can investigate and remove it where required. Do not submit a child’s information in reflections, images, or support messages.

12. Changes and contact

We will update the date when this policy changes and give appropriate notice of material changes. New purposes or disclosures that require consent will not be authorized simply by posting a revised policy. For privacy questions, complaints, accessible copies, or requests, contact Warrior Code LLC’s privacy team at support@warriorcodeapp.com.