⚠ Placeholder — replace before public launch. This document is engineering scaffolding pending a final privacy policy drafted with legal counsel. The data sections below accurately describe what Commontide collects, but the prose is not legally vetted.

Privacy Policy

Last updated: 2026-04-25 (placeholder draft).

Commontide is a digital Daily Office — a tool for praying the hours, the calendar, and the saints in the ACNA Book of Common Prayer 2019 tradition. This policy explains what data we collect, why, and what control you have over it.

1. What we collect

Commontide is usable without an account. If you choose to sign in, we collect the following.

From your authentication provider (Google or magic-link email)

Email address
Display name (if your provider shares it)
Profile picture URL (Google OAuth only — we don't store the image)
Account creation timestamp + last sign-in timestamp

From your in-app settings

Liturgical preferences: psalm cycle, default creed, default Lord's Prayer version, posture-rubric visibility, theme, time-zone preference

From your in-app intercessions

Names of your bishop, archbishop, parish, diocese, rector, country, and civic leaders — used to fill the bracketed blanks in BCP collects ("for our bishop _____", "for those in authority _____", etc.)
Your patron saint's name
City and country (used only to localize prayer suggestions)

From your prayer log (when this feature ships)

Names of people you pray for: birthdays, anniversaries, the unwell, the bereaved
The dates associated with each intercession

Automatically captured by the platform

Standard server logs (IP address, request path, response status) — retained ~30 days by Vercel (our hosting provider)
Anonymized analytics events via Vercel Analytics (page views, no personal identifiers)
Error reports via Sentry when an exception fires (when configured) — may include stack traces, request URLs, and your user ID, but never the contents of prayer context or prayer-intention names

2. Special category — religious data

Your prayer context and prayer intentions are religious affiliation data under GDPR Art. 9. We treat this as special-category data:

We collect it only with your explicit consent (you fill it in voluntarily; the app works without it).
We use it only to render personalized prayers — never for analytics, marketing, or sharing with third parties.
You can edit or delete any field at any time via /settings.
You can export or delete everything via the GDPR endpoints (§5).

3. Who we share with

We use these third-party processors. Each has its own privacy policy.

Processor	Role	What they see
Supabase	Database + authentication	All of your profile data, server-side
Vercel	Hosting + serverless	Request metadata, server logs, anonymous analytics
Crossway / ESV	Scripture API	Bible passage citations only — never your identity or prayer data
Sentry (when configured)	Error monitoring	Stack traces, request URLs, server-side error context. Never the contents of prayer context or prayer intentions. Session replay disabled.
Google	OAuth provider (optional)	Your email, name, profile picture URL

The full subprocessor inventory — including data location, links to each provider's privacy policy and Data Processing Agreement, and a change history — lives in docs/SUBPROCESSORS.md.

We do not:

Sell your data
Run advertising trackers (no Google Analytics, no Facebook pixel, no ad-network tags)
Share your prayer intentions or prayer context with anyone

4. Legal bases (GDPR Art. 6 + 9)

Data	Legal basis
Account creation, sign-in	Contract (Art. 6(1)(b))
Prayer context, prayer intentions	Explicit consent (Art. 9(2)(a))
Anonymous analytics, security logs	Legitimate interest (Art. 6(1)(f))

You can withdraw consent for the religious-data category at any time by clearing your prayer context and prayer intentions, or by deleting your account (§5).

5. Your rights

You can exercise all of the GDPR / CCPA rights below at any time:

Right	How
Access	GET /api/me/export returns a JSON dump of all your data
Portability	Same export endpoint — machine-readable JSON
Rectification	Edit any field on /settings
Erasure	Delete your account from /settings → Household & Profiles (in-app), or via POST /api/me/delete-confirm then DELETE /api/me — either path cascades all your data
Withdraw consent	Either clear the relevant fields on /settings, or delete your account
Restrict processing	Sign out — we stop processing on your behalf
Object to processing	Email us; see §8

6. Data retention

Data	Retention
Profile + preferences + prayer_context	Until you delete your account
Prayer intentions	Until you delete them, or your account
Authentication cookies	Until expiry / sign-out
Server logs	~30 days (Vercel default)
ESV scripture cache	24 hours rolling — no user data
Sentry error reports	90 days (Sentry default) when configured

7. Children

Commontide is intended for users 16 and older. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, contact us and we'll delete the account.

8. Contact

For questions, requests, or to exercise a right that requires a human:

Email: m@shadowandlife.com
Postal: [POSTAL ADDRESS — TO BE FILLED IF EU/UK USERS]

For EU/UK users: you also have the right to lodge a complaint with your national data-protection authority.

9. Changes to this policy

When the policy changes materially, we'll notify signed-in users in-app and update the Last updated date at the top.

10. Cookies

Commontide sets a small number of cookies. None are used for advertising or cross-site tracking.

Cookie	Purpose	Lifetime
sb-* (Supabase Auth)	Keeps you signed in across requests; refreshed by the auth middleware	~1 year (refreshed on use); cleared on sign-out
commontide-delete-confirm	Short-lived token gating the destructive DELETE /api/me call against accidental or forged requests	10 minutes; HTTP-only; SameSite=Strict; scoped to /api/me

Vercel may also set anonymous analytics cookies on its hosted infrastructure; see Vercel's privacy policy for details.

We do not currently display a cookie consent banner because every cookie we set is in the "strictly necessary" category under ePrivacy guidance (no analytics, marketing, or session-replay cookies). If that changes, we will surface a banner before the new cookies are set.

Return to Commontide