Privacy Policy
Last updated: October 22, 2026
What Holy Root collects, why, who else touches it, and how to get it back or delete it. Written to be read, so if anything here is unclear, ask us and we'll fix the wording.
What we collect
We collect what the app needs to work, and we don't sell any of it. There are no ads inside the app. We do advertise the app elsewhere, and on iPhone we measure which of those ads led to an install only if you allow it when iOS asks; if you don't, nothing tracks you across other apps or websites.
Your email address and the identifiers from however you sign in: email and password, or Apple, Google, Facebook or X.
Why: You cannot have a private library without an account to keep it in.
Verse references, notes, reflections, and the circles you join. Reflections are encrypted. Nothing you write is visible to anyone else unless you deliberately share that note with a circle.
Why: This is the product: your verses, notes and reflections, synced between your devices.
When you use the microphone, the audio is sent to our server and on to a speech-to-text provider. We keep the transcript, which becomes your note. We do not keep the audio.
Why: Transcription happens on a server; the phone cannot do it alone.
When you scan a page of notes, the photo is sent to our server and on to an AI provider that reads the writing. We keep the text, which becomes your note. We do not keep the photo, and its location data is removed on your device before it is sent.
Why: Reading handwriting happens on a server; the phone cannot do it alone.
Whether your subscription is active, via RevenueCat and the App Store or Google Play. We never see or store card numbers.
Why: It is how the app knows whether your subscription is active on a new device.
If you report a shared note we record what you reported, the reason, anything you added, and who filed it, so we can review it. If you block someone we record that you did. Reports are never shown to other users, and the person you reported is not told who reported them.
Why: A report nobody can read is not a report, and a block has to outlast the session that made it.
How we use it
To run the app: save and sync your library, generate a study insight when you ask for one, transcribe what you speak, show your circles what you chose to share with them, and keep your subscription working across devices.
To keep circles safe: reviewing reports, acting on them, and enforcing the conduct rules in our Terms of Use.
To keep the service reliable, and to answer you when you write to support. That is the whole list. We do not profile you and we do not use your content to train AI models.
Who else processes your data
We use a small number of providers, each for one job. They process data on our instructions; none of them are permitted to use it for their own purposes.
- 1Supabase: the database your library lives in, and email/password sign-in.
- 2Clerk: social sign-in with Apple, Google, Facebook and X.
- 3RevenueCat, with the App Store and Google Play: subscription status.
- 4OpenAI: generating study insights, transcribing voice input, and reading scanned notes.
- 5API.Bible: the licensed scripture text a passage is served from.
- 6Google (Firebase Analytics) and Meta, on iPhone: counting installs, app opens and subscriptions so we can tell which of our ads work. Device and advertising identifiers are shared with them only if you allow tracking when iOS asks, and can be turned off any time in Settings → Privacy & Security → Tracking. Neither receives your notes, reflections, verses or email address, and ad personalization is off.
We may also disclose data where the law requires it, or to protect someone's safety. Data may be processed in the United States, where these providers operate.
Your rights
You can see, correct, export or delete your data. Deletion is built into the app and needs no email:
- 1Open the You tab on iPhone, Android, or holyroot.app.
- 2Scroll to Danger zone and tap Delete account.
- 3Confirm. It is immediate and cannot be undone.
For a copy of your data, or to correct something, email support@holyroot.app from the address on your account. Depending on where you live you may also have the right to object to processing or to complain to your data protection regulator.
Children
Holy Root is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.
How long we keep things
Your content is kept until you delete it or delete your account. Deleting your account removes your profile, entries, reflections, insights, circle memberships and shared notes, along with the blocks you made and the reports you filed.
Reports made about a note are kept as moderation history even after the reporter leaves, because a record of what was acted on is the only way enforcement can be consistent. The shared notes those reports point at are deleted with the account that posted them, so no user content survives either way.
If this policy changes materially we'll say so in the app before the change takes effect. Questions: support@holyroot.app.
Holy Root: Pray First
This policy also covers Holy Root: Pray First, our app that keeps the apps you choose locked until you pray.
The apps you choose to lock never leave your phone. Apple's Screen Time gives the app an opaque token for each one, not its name, and that token is stored only on your device. Your lock times, your prayer days and its reminders are on-device too.
Like Holy Root, Pray First uses Google (Firebase Analytics) and Meta on iPhone to count installs, finished setups, prayers and subscriptions, so we can tell which of our ads work. Device and advertising identifiers are shared with them only if you allow tracking when iOS asks, and you can turn it off any time in Settings → Privacy & Security → Tracking. Neither ever receives which apps you lock, what you pray, or your email address, and ad personalization is off.
A Holy Root account in Pray First is optional and needed only for Premium. If you sign in, it is the same account described above, and a subscription bought in either app is handled the same way. Deleting your account from Pray First deletes your Holy Root account and its data too.