Privacy Policy

Last updated: June 12, 2026

Providence ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Data	Purpose	Retention
Email address	Authentication, account recovery, digest emails	Until account deletion
First & last name	Display name in community features	Until account deletion
Hashed password	Authentication (if password login chosen)	Until account deletion
Session transcripts	Formation history, digest recommendations	Until account deletion
Carries (reflections)	Shared with circle/series members	Until account deletion or removal
IP address	Rate limiting, abuse prevention, audit logs	90 days
Analytics counters	Aggregate usage statistics (no personal data)	90 days

2. Data We Do Not Collect

We do not use cookies for tracking or advertising
We do not sell, rent, or share your personal data with third parties for marketing
We do not build advertising profiles
We do not track you across other websites

3. How We Use Your Data

Authentication: To verify your identity when you sign in
Scripture sessions: Your session content is sent to Anthropic's Claude API to generate contemplative questions. Anthropic does not use this data for training. See Anthropic's Privacy Policy.
Weekly digest: If opted in, we use your session history to generate personalized Scripture recommendations sent via email
Community features: Carries you share are visible to members of your circles and series
Abuse prevention: IP addresses are used for rate limiting and logged in audit records with a 90-day TTL

4. Third-Party Services

Cloudflare: Hosting, CDN, and KV storage (Privacy Policy)
Anthropic (Claude): AI-powered Scripture questions (Privacy Policy)
Resend: Transactional email delivery (Privacy Policy)
Google Identity Services: OAuth sign-in, if you choose Google login (Privacy Policy)
ESV API / API.Bible: Scripture text retrieval (no personal data sent)

5. Data Storage and Security

Your data is stored in Cloudflare KV, a globally distributed key-value store. All connections use TLS encryption. Passwords are hashed with PBKDF2 (100,000 iterations). Refresh tokens are hashed with SHA-256 before storage. JWT access tokens expire after 15 minutes.

6. Your Rights

All Users

Access: Export all your data via Account → Export my data
Deletion: Delete your account via Account → Delete my account (24-hour grace period to cancel)
Unsubscribe: One-click unsubscribe from digest emails via the link in each email
Correction: Contact us to correct inaccurate personal data

EU/EEA Users (GDPR)

If you are in the EU/EEA, you have additional rights under GDPR:

Legal basis: We process your data based on consent (account creation) and legitimate interest (security, abuse prevention)
Data portability: Use the Export function to receive your data in JSON format
Right to object: Contact us to object to processing based on legitimate interest
Supervisory authority: You may lodge a complaint with your local data protection authority

California Users (CCPA)

We do not sell personal information. You may request disclosure of the categories and specific pieces of personal information we have collected. Use the Export function or contact us.

7. Children's Privacy

Providence is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

8. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users via email within 72 hours of discovery, as required by GDPR and applicable laws.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email. The "last updated" date at the top reflects the most recent revision.

10. Contact

For privacy-related questions or to exercise your rights, contact us at hello@providence-bible.com.