Legal Changelog

This file records material changes to the Privacy Policy, Terms of Service, and Subprocessors list. Add a dated entry whenever a published version changes materially.

2026-10-20 — AI requests routed through Cloudflare AI Gateway

• Subprocessors list — Cloudflare's row now covers AI Gateway: it routes requests to OpenAI and Google and keeps a short-lived log of request metadata (model, token counts, cost, a pseudonymous user identifier), never the content.
• AI Disclosure — states the same routing and what the gateway does and does not keep.

2026-10-20 — Text generation moves to OpenAI

• AI Disclosure — text generation (chat, devotionals, prayer reflections, journal reviews, sermon summaries, reading tracks, memorization aids) now runs on OpenAI GPT models by default, with Google Gemini as the backup when OpenAI is unavailable. Journal-entry reflections and sermon-photo text extraction stay on Google Gemini. The Privacy Policy and Subprocessors list already name both providers and are unchanged.

2026-07-27 — Deleted accounts and disaster recovery

• Privacy Policy § 6.3 — the old wording carved out an exception ("except where required to recover from a system failure") with nothing enforcing it: a disaster-recovery restore replayed the backup as-is and brought deleted accounts back. The restore procedure now re-applies every deletion recorded after the backup before the restored database serves traffic (RESTORE.md § 8, scripts/restore/reapply-deletions.ts), and the Policy states that instead of the exception.

2026-06-25 — Initial publication

First published versions of the Privacy Policy, Terms of Service, and Subprocessors list, aligned with the actual behaviour of the Kerith backend and with GDPR/CCPA requirements:

• Privacy Policy — disclosed push tokens, transient IP use, and PostHog analytics; corrected the AI section to state that journal, sermon, devotional, and search content is sent to external AI providers (not only chat) and gated on AI consent; scoped the encryption-at-rest claim to the actually-encrypted fields; disclosed backup retention (30 days / 12 weeks / 12 months) for deleted-account data; added GDPR legal bases, special-category-data (Article 9) handling for religious data, CCPA/CPRA sensitive-PI handling, international-transfer safeguards, and the named-subprocessors reference.
• Subprocessors list — new document.
• AI Disclosure (Apple Guideline 5.1.2(i)) — new document. Corrected the provider attribution to match the code: text generation and sermon-photo OCR use Google Gemini by default (not Anthropic/Claude), and sermon audio is transcribed by OpenAI Whisper or Cloudflare Workers AI (photos are not sent to Whisper). Added the opt-in/consent framing and embeddings (Voyage AI/Cloudflare) for search.
• Terms and Conditions — published the detailed Terms (eligibility, service description with spiritual/AI and crisis disclaimers, accounts, subscriptions/trial and pricing, acceptable use, content license, IP, availability, disclaimers, limitation of liability, indemnification, termination, Ukraine governing law). Corrected the AI-processing clause so it matches the Privacy Policy (AI processing is not limited to chat) and noted that AI features are opt-in.