Trust
Security
Effective October 11, 2026 · Last updated October 11, 2026
Prayers, journals, and reflections deserve real protection. This page describes, in plain language, the measures we use to protect your account and your content — and it is honest about the limits. We make no exaggerated claims here, only ones we can support.
1. Encrypted connections
Data traveling between your device and our services is encrypted in transit using HTTPS with TLS. This protects your content from being read while it moves across the network.
2. Account security
Sign-in is handled by Supabase, which stores passwords using industry-standard password hashing. We never store or see your password in plain text. You can also choose Sign in with Google: Google shares your name, email address, and Google account ID with us, and we never receive your Google password.
3. Access controls
Our database uses row-level security policies, so each account can reach only its own content. Access follows the principle of least privilege: systems and people get the minimum access needed to do their job, and nothing more.
4. AI features and your content
Understand explanations and Listen audio are generated on our servers using OpenAI. The app never calls OpenAI directly and never holds an OpenAI key. Our servers send OpenAI only the Bible passage reference and passage text (and, for Listen, the explanation to be read aloud) — never your name, email, prayers, journal entries, or anything else you write.
5. Payment security
All purchases and subscriptions run through Google Play (Unstuck Faith is on Android first; iPhone is coming later). Payment details are handled entirely by Google under its own security program. We never receive or store your card number.
6. Sensitive spiritual content
We treat prayers, journals, and reflections as the most sensitive information we hold. They are stored in your account with row-level security so they sync privately across your devices. We do not read this content in the ordinary course of business, do not use it for advertising, and do not sell it. Our Privacy Policy describes this commitment in full.
7. Deletion on request
You can delete your account and its data at any time — in the app (Me tab, at the bottom: Delete Account) or through our account deletion page. Deletion requests are honored the same way whichever route you choose.
8. How we choose vendors
We keep our list of service providers deliberately small — Supabase, OpenAI, Google, RevenueCat, PostHog, Sentry (optional crash reporting), and Hostinger for this website — and we choose established providers with mature, published security practices. Fewer vendors means fewer places your data can go.
9. Reporting a security concern
If you believe you have found a vulnerability or notice something suspicious about your account, please tell us. Email support@unstuck-faith.com with “Security” in the subject line. We read these reports carefully and appreciate responsible disclosure.
10. Honest limits
No system is perfectly secure, and we will not pretend otherwise. We use reasonable, industry-standard safeguards and keep improving them, but we cannot guarantee that unauthorized access will never occur. What we can promise is care: a small data footprint, restrained vendor choices, and honesty with you if something goes wrong.