Privacy Policy

Scope

This policy applies to the Lampada mobile app for iOS (App Store) and Android (Google Play, package app.lampada) and to the public website at lampada.app. The app handles your data the same way on both platforms; where they differ, this policy says so. It does not apply to the separate Bible Garden app or its website, although both apps use the same operator-owned backend at api.bible.garden.

Lampada is provided and maintained by Maria Novikova, who is responsible for the processing described in this policy.

Lampada does not require an account, registration, your name, email address, phone number, contacts or location.

Data kept on your device

The following data is stored locally and is not sent merely because you use the app:

• prayer topics, generated questions, typed answers and final takeaways;
• voice recordings and their transcripts;
• prayer history, saved scripture passages and favourites;
• consent choices, scripture settings, reminders and prayer-day history;
• optional PIN and biometric lock settings, and a local diagnostic log that must not contain prayer content.

The PIN itself is never stored or transmitted. Scheduled prayer reminders are local operating-system notifications and are not sent through a push service.

The app asks only for the device permissions its features need: the microphone, used only while you record a voice answer; notifications, for prayer reminders and, on Android, for the prayer timer and the notification of music or Scripture narration playing in the background; and biometrics, only for the optional app lock, where the device performs the check and Lampada receives only its result. On Android, music and narration you start keep playing with the screen locked through a media playback service, which shows a notification while it runs. Lampada does not request access to your location, contacts, photos or files.

Depending on your operating-system and cloud-backup settings, locally stored app data may be included in a device backup managed by Apple or Google. Lampada does not operate or control those backups. On Android 9 and later, the journal is included in the Android backup to your Google account (Auto Backup) only when that backup is end-to-end encrypted with your device screen lock; voice recordings are never included in it. When you transfer data directly from your old Android phone to a new one, both the journal and voice recordings are copied. On Android 8.1 and earlier, the app keeps all its data out of backups and transfers. The app lock PIN settings are never copied: after a restore or transfer to a new device, the app lock is off until you set a PIN again.

Optional AI processing

Lampada has three AI features. Each one asks for your permission separately before any prayer content leaves your device.

1. Core prayer AI. Sends the prayer topic to generate guiding questions and select relevant scripture.
2. Answer context. Sends your typed answers and transcripts so that later questions and scripture can take them into account.
3. Audio transcription. Sends a recording you choose, only to turn it into text. The recording itself is never used for questions or scripture.

While a choice is not made or is denied, the app sends no prayer content. Prayer works without AI too: questions come from a built-in set, scripture is chosen without your prayer context, and recordings stay on your device.

Your choices

Silence or simply using the app never counts as consent. You can change or withdraw each choice in Settings at any time; the change applies from the next request. Content that has already been sent cannot be recalled.

Where AI processing happens

Content you allow is sent over HTTPS to our server, Bible API (api.bible.garden). Guiding questions and scripture selection use Google Gemini through Google’s paid API. A voice recording you choose is transcribed either by Whisper on company-managed servers or by Google Gemini through Google’s paid API. Scripture search uses the bge-m3 model on company-managed servers and does not go through Google.

Under the terms of Google’s paid API, Google does not use the content it receives, including recordings sent for transcription, to improve its products, but may keep it for a limited time to prevent abuse and meet legal obligations, and may process it in any country where Google operates. We do not enable Gemini API logging or data sharing. Our server keeps no archive of prayers. The temporary question memory is described in section 09; content reports are described in section 07. Whisper and bge-m3 are operated by our company under their own service settings.

Technical request data

For most API requests our server stores the time, path, HTTP method, status, response time, application name and any service-degradation category. The IP address itself is not stored in these records: only a keyed hash is recorded as a pseudonym. The user agent is stored for non-AI requests, but not for the AI endpoints. The IP address is used during request processing for abuse protection and to derive the statistics pseudonym. Request and response content is not written to request statistics or logs.

Request records are deleted from the live database after 14 days. Backups may keep them longer, and the oldest backup copies stay until we delete them deliberately. Only daily counts are kept permanently, including the number of distinct pseudonyms; they cannot reveal prayer content.

Web server access logs are configured to omit IP addresses, user agents, referrers and query parameters. Critical-error logs may contain an IP address.

Content reports

If a generated question or a selected scripture passage seems wrong, you can report it. A report is sent only when you tap Send report. It contains the reported text, whether it is a question or a passage, the app’s interface language and your comment, if you write one. Your prayer topic, answers and recordings are never included. A generated question can reflect what you prayed about, so check the text and your comment before sending.

Our server stores the report with the time it was received and a review status. The report carries no account, device or user identifier, IP address or pseudonym; technical request data for the report request is recorded as described in section 06. Reports are read only by the Lampada maintainer in a password-protected admin panel. The maintainer is also notified of each new report in a private Telegram chat; the notification contains the report text and comment, so Telegram processes them too.

Reports have no automatic deletion period: they stay in the database until we delete them manually, and server backups keep copies according to their rotation, with the oldest copies kept until we delete them deliberately. We do not link reports to you or to the technical request records in section 06, so we can find a report on request only if you tell us its text.

Website, analytics and tracking

Lampada contains no advertising or analytics SDKs and does not create behavioural profiles. The website sets no analytics cookies and stores only your selected language in local browser storage; that preference is not transmitted by Lampada.

The website (not the app) counts visits with Umami, open-source analytics running on our own server, stats.bible.garden. Umami sets no cookies and stores no IP addresses: the address is used only during the visit to derive a pseudonymous visitor ID that changes every month. The country comes from Cloudflare; region and city are not stored. What is stored: the page address and title, the site you came from (addresses without query parameters), browser, operating system, device type, screen size, language, country, time of visit and clicks on App Store links. The statistics stay on our own servers and are not used for advertising or profiling. Records older than 13 months are deleted; backups usually keep them for up to 7 more days. Like the rest of the site, stats.bible.garden runs through Cloudflare, which receives no stored statistics from us.

The public website is delivered through Cloudflare. Cloudflare may process IP addresses, request metadata and security signals, and may set strictly necessary security cookies when required to protect the site. In-app AI traffic currently connects directly to api.bible.garden and is not routed through the Cloudflare website proxy.

Retention and deletion

Local prayer data remains until you delete a prayer or erase all Lampada data by uninstalling the app or using its full-wipe flow. Deleting a prayer removes its answers and recordings; its historical prayer-day marker remains until a full wipe. Favourites remain until removed or all data is erased. Device backups, if enabled, are controlled separately through your Apple or Google account.

Our server keeps no archive of prayers. To avoid repeating questions, it keeps the text of AI-generated questions and their topic in memory, without identifiers, not your answers or recordings. Entries are valid for up to two hours (at most 2,000 entries per server process); expired entries are cleared when the cache is accessed and may remain in memory longer while idle. This memory is not written to disk, logs or backups. Content reports you choose to send are stored separately as described in section 07. Google’s retention and company-managed services are described in section 05.

Security

Network requests use HTTPS. Lampada minimises transferred content, keeps server secrets outside the app and offers an optional app lock with a PIN and device biometrics. No method can guarantee absolute security; protect access to your device and avoid sharing sensitive prayer content in public support channels.

Changes to processing

When this policy changes, we update this page and its date. If we change the AI provider or how it handles your data, Lampada will ask for your permission again before sending the affected content. Switching to another model under the same terms does not require a new choice. Moving audio transcription between the two processors already named in section 05, Whisper on company-managed servers and Google Gemini through Google’s paid API, does not require a new choice either; any other processor does.

Questions and requests

For a private question about this policy or your privacy choices, email [email protected] or contact the Lampada maintainer on Telegram at @Mandarinka4. GitHub Issues are available for general public questions and bug reports. Do not include prayer text, recordings or other sensitive information in a public issue.