Legal

Privacy Policy

Effective July 5, 2026

Who we are: Aurenia Group, the maker of Holy Tea ("we", "us"). Contact: privacy@aureniagroup.com.

Holy Tea is an AI Bible reflection app. You talk with AI guides about your life and the people in it, grounded in scripture. Because of what the app is, your data here is unusually personal: conversations about faith, relationships, and hard seasons. This policy is written to be read, not skimmed. The short version: we collect what the product needs to work, we don't sell it, we don't show ads, your conversations train no one's models, and you can delete everything yourself, in the app, instantly.

1. What we collect

You give us

• Account:email address, optional display name, date of birth (used once to verify you're 18 or older; see §7).
• Conversations: messages you exchange with your guides, including Grace Drafts (drafts you write and never send) and My Walk entries.
• Your Circle (people in your life):first names, relationship type (family / friend / romantic / work), and the ongoing story you share about each person. This is information about third parties who haven't signed up. We use it solely to provide your experience. It is never used to contact those people, never shared, never used for advertising, and first names are stripped from shared cards by default.
• Derived memories:so your guide can remember what you share, our system extracts and stores facts and events from your conversations (e.g. "estranged since November," "apologized Dec 2"). These are part of your account data and are deleted with it.
• Preferences: chosen guides, Bible translation, notification settings, faith-background answer (optional and skippable), locale.

Collected automatically

• Usage analytics: screens viewed, features used, subscription events, coarse device/app-version info (PostHog). Used to improve the product, never to profile faith for advertising.
• Crash and error data: diagnostic logs and stack traces (Sentry).
• Purchase state: subscription tier, trial, and renewal state via app-store purchases (RevenueCat). We never see or store your card number.
• Push tokens if you enable notifications.

We never ask for and do not want:denomination or church membership, political positions, confessions, income, sexuality or gender as gating questions, or anyone's contact information. There are no ads and no data sales.

2. How we use it

To run your conversations and memory; generate your Daily Pour, Living Journeys, and notifications; enforce plan limits; process subscriptions; fix crashes; understand aggregate product usage; and send transactional email (sign-in codes, data exports). Marketing email is separate and opt-in.

3. AI processing — the part to actually read

• Your messages are sent to large-language-model providers to generate your guides' replies: Anthropic and Google, routed via Vercel's AI Gateway. Per our provider terms, this data is not used to train their models and is deleted by the provider within 55 days at most(7 days for Anthropic on paid tiers; up to 55 days for Google Gemini on the free tier).
• You can pause AI processing at any time (Profile → Privacy & Data → "AI Data Sharing"). While paused, guides can't reply.
• Scripture is retrieved word-for-word from public-domain translations, never generated.
• Guides are AI, not pastors, counselors, therapists, or medical professionals. Conversations touching crisis topics surface real-help resources (e.g. 988 in the US); see our AI Disclosure.

4. Processors (who touches the data, and why)

Each processes data only on our instructions, and only for the purposes above.

5. Retention

• Account data, conversations, Circle, memories:kept while your account exists; deleted when you delete it (§6). Your guides' memory windowvaries by plan. That's a product feature; the underlying data remains yours and remains deletable.
• AI provider copies: deleted within 55 days at most (§3).
• Analytics: 12 months, then aggregated or deleted.
• Crash logs: 90 days.
• Backups: encrypted database backups roll off within 30 days of deletion.
• Legal holds: purchase records retained as required by tax/accounting law.

6. Deletion & your data, self-serve

• Delete My Account: in the app, Profile → Privacy & Data → Delete My Account. This immediately and permanently deletes your profile, your Circle, every conversation, every gathered verse, and everything your guides remember. It cannot be undone. Web fallback: holytea.app/account/delete.
• Download My Data: same screen; we email a complete export link within 24 hours.
• Subscriptions are cancelled through Apple/Google, not by account deletion; the app stores control billing.

7. Children

Holy Tea is not directed at children or teens. The app enforces a date-of-birth age gate: you must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18. If we learn an under-18 account exists, we delete it.

8. GDPR (EEA/UK) basics

• Legal bases: contract (running the service you signed up for: conversations, Circle, memory, purchases); legitimate interests (crash monitoring, security, aggregate analytics, balanced against your rights); consent (marketing email, push notifications, optional faith-background question); legal obligation (purchase records).
• Special-category note: conversations in a faith app can reveal religious beliefs. To the extent Art. 9 applies, we rely on your explicit consent, gathered at onboarding, revocable in-app (AI Data Sharing toggle / account deletion).
• Your rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. The export and delete tools in §6 satisfy most requests instantly; anything else: privacy@aureniagroup.com. You may lodge complaints with your supervisory authority.
• Automated decision-making: none with legal or similarly significant effects.

9. CCPA/CPRA (California) basics

We do not sell or share(for cross-context behavioral advertising) personal information, and haven't in the preceding 12 months. Categories collected: identifiers, commercial information (subscriptions), internet activity (usage), inferences (derived memories), and potentially sensitive personal information (religious-belief-revealing conversation content, used only to provide the service). Rights: know, delete, correct, portability, limit-use of sensitive PI, non-discrimination. Exercise via §6 tools or privacy@aureniagroup.com.

10. Security

Encryption in transit (TLS) and at rest; row-level security on user data; least-privilege service keys; review-bypass and admin routes are env-gated and audit-logged. No system is perfect. We'll notify you and regulators of breaches as the law requires.

11. Changes

We'll post changes here and, for material changes, notify you in-app or by email before they take effect.

Contact: Aurenia Group · privacy@aureniagroup.com