Kerith

Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how Oleh Chausov, an individual operating the "Kerith" service ("Kerith", "we", "us", or "our"), collects, uses, shares, and protects your information when you use the Kerith mobile application, the website at https://kerith.app, and related services (collectively, the "Service").

Data controller: Oleh Chausov, an individual residing in Kharkiv, Ukraine. Contact: support@kerith.app.

By using the Service, you agree to the practices described in this Policy. If you do not agree, do not use the Service.

1. Information we collect

1.1. Account information. When you create an account we collect your email address and authentication identifiers (for example, your Apple Sign In identifier), and the preferences you set during onboarding — including your selected tradition or denomination, experience level, goals, reminder frequency, and Bible translation preference. We also record the date and time you grant or withdraw consent to AI processing.

1.2. Content you create ("Your Content"). This includes your journal entries, prayers, saved sermons (including sermon text, photos you upload for text extraction, and audio you submit for transcription), AI-generated reflections and reviews of your entries, memorized verses, and chat messages.

1.3. Sensitive information. Some information you provide is sensitive under applicable law — in particular, your religious denomination or tradition, and the content of your prayers, journal entries, and chat messages, which can reveal religious or philosophical beliefs and other personal matters. We process this information only with your consent and as described in Section 3 and Section 8. See Section 8 for how this is treated under the GDPR and the CCPA/CPRA.

1.4. Usage, device, and analytics information. We collect technical and usage data needed to operate and improve the Service, including device type, operating system, app version, language settings, time zone, and product analytics events (for example, when a journal review is generated or opened, or a subscription status changes). Analytics are processed through our analytics provider (PostHog). We attach limited account properties to analytics — such as denomination, experience level, subscription status, guest/registered status, and time zone.

1.5. Push notification tokens. If you enable notifications, we store a push notification token (Firebase Cloud Messaging) so we can deliver reminders and devotionals.

1.6. IP address. We process your IP address transiently to apply rate limits and prevent abuse. We do not store your IP address in your account record.

1.7. Payment information. Subscriptions are processed by the applicable app store (Apple App Store or Google Play) and our subscription manager (RevenueCat). We do not collect or store your full payment card details; the app store handles payment processing. We receive subscription status and related identifiers, not card data.

2. How we use your information

We use your information to: (a) provide, maintain, and operate the Service; (b) personalize responses based on the tradition you select; (c) process AI chat, journal reflections and reviews, sermon transcription and summaries, and daily devotionals (see Section 3); (d) manage your account and subscription; (e) communicate with you about the Service, including support requests and notifications you enable; (f) maintain security, prevent abuse, and comply with legal obligations; (g) improve the Service through product analytics.

3. AI processing

3.1. We use third-party AI providers. Several features rely on external AI processing. To generate a response, the relevant content you submit to those features is sent to our AI processing providers. The current providers are Anthropic, OpenAI, Google (Gemini), and Groq; embeddings used for search are generated via Voyage AI and Cloudflare. Audio transcription uses OpenAI or Cloudflare Workers AI. The full list of providers is in our Subprocessors list.

3.2. Which content is sent, and when. AI processing is not limited to chat. When you use an AI-powered feature, the related content is sent to an AI provider — automatically as part of using that feature, not only when you explicitly press send in chat. Specifically:

3.3. AI consent. AI features are off until you opt in. We do not send Your Content to external AI providers for these features until you have granted AI consent in the app, and you can withdraw consent at any time in Settings. Withdrawing consent stops further AI processing of new content.

3.4. We do not use Your Content to train AI models. We use our AI providers under their business/API terms, under which your content is not used to train their models. We do not sell Your Content and we do not use it to train models.

3.5. Crisis detection. To respond safely, the Service screens messages for signals of self-harm or suicide and may surface a crisis-support response. This is an automated safety feature, not a medical or psychological diagnosis, and it is not an emergency service. If you are in danger, contact your local emergency number or a crisis hotline.

3.6. Automated decision-making. AI outputs are informational and pastoral in nature. They are not used to make decisions that produce legal or similarly significant effects about you within the meaning of Article 22 of the GDPR.

4. Data storage and security

4.1. Encryption at rest. Sensitive content fields are encrypted at rest in our production environment using AES-256-GCM. This covers your journal entries and their AI reflections, your chat messages, your sermon content (text, summary, title, and related fields), and your journal reviews. Account metadata and preferences (for example, your email and denomination) are stored without field-level encryption. Backups are encrypted as a whole (see Section 6).

4.2. Security measures. We use reasonable administrative, technical, and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Sharing and disclosure

5.1. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

5.2. We share information only with: (a) service providers / processors who process data on our behalf — cloud hosting, AI processing, audio transcription, analytics, error monitoring, subscription management, and push delivery. A current, named list is in our Subprocessors list; (b) app stores, for payment and subscription management; (c) authorities or third parties when required by law, to enforce our Terms, or to protect the rights, safety, and security of users or the public.

5.3. Business transfers. If Kerith is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

6. Data retention and deletion

6.1. Retention. We retain your information for as long as your account is active or as needed to provide the Service, and as required to comply with legal obligations, resolve disputes, or enforce our agreements.

6.2. Account deletion. You can delete your account and all associated data in the app at Settings → Account → Delete Account. When you do:

6.3. Backups. We keep encrypted backups of our database on a rotating schedule: daily backups are retained for 30 days, weekly backups for 12 weeks, and monthly backups for 12 months. After you delete your account, residual copies of your data may persist in these encrypted backups until they age out on the schedule above (up to 12 months for monthly archives), after which they are deleted. We do not restore deleted accounts from backups. If we have to rebuild our database from a backup to recover from a system failure, we re-apply every deletion that was recorded after that backup was taken before the restored database goes back into service, so an account you deleted stays deleted.

6.4. Legal retention. We may retain limited information where required to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Your rights

Depending on your jurisdiction, you may have rights to: (a) access the personal information we hold about you; (b) correct inaccurate information; (c) delete your information; (d) object to or restrict certain processing; (e) request a copy of your data in a portable format; (f) withdraw consent where processing is based on consent (including AI consent), without affecting processing already carried out; (g) opt out of the "sale" or "sharing" of personal information (we do neither); (h) limit the use of sensitive personal information (see Section 8); (i) lodge a complaint with your data protection authority.

To exercise these rights, contact us at support@kerith.app. You can also manage, export, and delete much of your data directly in the app. We will not discriminate against you for exercising your rights.

8.1. GDPR legal bases (EEA / UK users). Where the GDPR or UK GDPR applies, we rely on:

8.2. Special-category data (GDPR Article 9). Your denomination and the content of your prayers, journal entries, and chat messages may reveal religious or philosophical beliefs, which are a special category of personal data. We process this data on the basis of your explicit consent (Article 9(2)(a)), which you provide through onboarding and AI consent. You may withdraw this consent at any time, which stops further such processing.

8.3. Sensitive personal information (CCPA/CPRA — California users). The categories above are "sensitive personal information" under California law. We use this information only to provide the Service you request and for the purposes described in this Policy — not to infer characteristics about you for unrelated purposes. We do not sell or share sensitive personal information.

8.4. International transfers. We operate globally and use providers located in the United States and other countries. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, an adequacy framework. You may request more information about these safeguards at support@kerith.app.

9. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. In some jurisdictions (for example, parts of the EEA/UK), a higher minimum age (up to 16) applies to consent-based processing; where required, we apply that higher age. If you believe a child has provided us with personal information, contact us at support@kerith.app and we will take appropriate steps to delete it.

10. Third-party services

The Service relies on the third-party services listed in our Subprocessors list, and may link to other third-party services (such as app stores). Their use of your information is governed by their own privacy policies, which we encourage you to review.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date, record the change in our changelog, and, where appropriate, notify you through the Service. Continued use after changes take effect constitutes acceptance.

12. Contact

Questions about this Privacy Policy or your data? Email us at support@kerith.app.