1. What we collect
- Account data. Your email address and — if you signed up with a password — a scrypt-hashed form of your password with a per-user random salt. We never store or see your plaintext password. If you sign in with Google, we store no password at all, only the Google-verified email.
- Session cookies. Signing in sets a session cookie (
sid) that is HttpOnly and expires after 30 days. It exists only to keep you signed in; we store a hash of the token, never the token itself. We use no advertising or cross-site cookies. - Your study data. The projects, notes, drafts, personal-library entries, highlights/marks, preferences, and reading position you create in the app, stored so the app can show them back to you.
- Optional API keys. If you connect your own AI-provider API key (bring-your-own-key), it is stored encrypted at rest with AES-256-GCM under a server master key, and used only to make the AI requests you initiate.
- AI usage metering. For paid plans we record monthly usage counts — turn counts and token counts (input, cached, output), bucketed per calendar month — to enforce plan allowances. We do not store the content of your AI conversations: chat messages are sent from your browser with each request, answered, and not persisted on our servers.
- Images you transcribe. If you photograph a page for text capture (OCR), the image is processed in memory and discarded — it is never written to disk.
2. What we don't do
- No ads. There is no advertising on the service.
- No sale of data. We never sell or rent your personal information.
- No tracking or analytics scripts. The app contains no third-party analytics, tracking pixels, or fingerprinting — the only client-side storage is your own preferences (theme, layout, reading position) in your browser.
3. Third-party processors
We share data with a small set of processors, each only for the purpose listed:
| Processor | Purpose | What they receive |
|---|---|---|
| Anthropic (Claude) | AI processing when you use AI features | Your chat messages and the passage/study context needed to answer them. Not stored by us. |
| Google (Gemini) | AI processing when you select Gemini or use image transcription | Your chat messages, passage context, and any image you submit for OCR. |
| Stripe | Subscription payments | Payment and card details go directly to Stripe — card data never touches our servers. We keep only your Stripe customer reference and plan status. |
| Resend | Transactional email (e.g. password resets) | Your email address and the message being sent. No marketing email. |
| Google OAuth | "Sign in with Google" | Google tells us your verified email address; we request nothing else. |
Each processor handles data under its own privacy terms. If you bring your own AI-provider key, your requests to that provider are governed by your agreement with them.
4. How long we keep data
Account and study data are kept while your account exists. Session cookies expire after 30 days of inactivity. AI usage counters are kept as monthly aggregates for billing and allowance enforcement. AI conversation content is not retained server-side at all.
5. Your data: export & deletion
- Export. Signed-in users can download everything they own — account info, projects, notes, drafts, library, marks, and settings — as a single JSON file from the account area (the
/api/account/exportendpoint). This is free and does not use AI. - Deletion. You can delete your account from the account area (the
/api/account/deleteendpoint); this removes the account and cascades to all your data — projects, notes, drafts, keys, sessions, and usage records. You can also request deletion by emailing biblelabsai@proton.me.
6. Security
Passwords are scrypt-hashed with per-user salts and compared in constant time; session tokens are stored only as hashes; stored API keys are encrypted at rest with AES-256-GCM; session cookies are HttpOnly and, in production, marked Secure and sent only over HTTPS. No system is perfectly secure, but we design so that a copy of our database alone does not expose your password or your API keys. If we learn of a breach affecting your data, we will notify you as required by law.
7. Children
The service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them.
8. Changes to this policy
If we change this policy in a material way, we will notify you by email or a prominent in-app notice before the change takes effect. The "Last updated" date above reflects the current version.
9. Contact
Privacy questions or requests: biblelabsai@proton.me · BibleLabs LLC, ⟦mailing address — not configured⟧.