AnkyraPrivacy Policy
Last updated: 2026-10-08
This policy explains what the Ankyra app (iPhone, iPad, widgets and Apple Watch) and the website ankyra.app collect, why, who receives it, how long we keep it and what your rights are.
Short version: what you log in Ankyra stays on your iPhone or iPad. We have no account system and no servers that receive your logs. We collect a small amount of technical data to run subscriptions, fix crashes and understand how the app is used. We don't sell personal data, we don't share it for targeted advertising and we don't track you across other companies' apps or websites.
Who is responsible
Pediaca, LLC, 1111B S Governors Ave, Ste 81429, Dover, DE 19904, USA ("we", "us"), is the controller of the personal data described here. Contact for anything about privacy: hello@ankyra.app. More company details in our Legal notice.
Privacy contact. Santiago Gonzalez Fernandez, our founder and manager, is responsible for privacy and answers every request sent to the contact above. Where a law asks for a designated person, he is that person: the "encarregado" under Brazil's LGPD, the person in charge of the protection of personal information under Canadian and Québec law, the data protection officer under Singapore's PDPA, the information officer under South Africa's POPIA, the representative for Peruvian territory under Peru's data protection regulation, and the contact for requests under the laws of India, Chile, South Korea, Japan and Mexico. We have not appointed a GDPR data protection officer because our activities don't require one.
Countries where the app is offered
Ankyra is not offered in some countries whose laws require a local representative, a paid registration or licence, or local data storage that we don't have yet: the European Union and the European Economic Area, the United Kingdom, Turkey, Russia, Belarus, Kazakhstan, Uzbekistan, Saudi Arabia, Egypt, Serbia, North Macedonia, Albania, Bosnia and Herzegovina, Montenegro, Kosovo, Moldova, Ecuador, Vietnam, Nigeria, Ghana, Uganda, Rwanda, Tanzania, Zambia, Zimbabwe, Morocco, Algeria, Mauritius and mainland China, and, because the app involves sensitive data, Thailand and Oman. We don't accept waitlist sign-ups from those countries. If you visit this website from one of them, this policy explains what happens with that visit.
What stays on your device
Everything you log in Ankyra is stored only on your iPhone or iPad (and on your Apple Watch, if you use it). We can't see it, and deleting the app deletes it.
It is included in your device's own backup (iCloud or computer) if you have backups turned on; that backup is handled by Apple and you, not by us.You can export everything at any time, free (Settings → Export), and delete it from the app (Settings → Delete all my data).
Religious beliefs
Using a Bible app can reveal religious or philosophical beliefs, which the GDPR (art. 9) and several US state laws treat as sensitive data. We treat everything about how you use Ankyra that way:
- Your prayers, notes, highlights, searches, the feelings you choose, your reading plans and your onboarding answers stay on your device. They are never sent to us, to analytics, to crash reporting or to anyone else, and never to an AI service.
- Analytics only receives neutral product events, such as "reader opened" or "daily reading completed", never which passage, plan, feeling or search.
- We never use any of this for advertising or profiling, and we never sell or share it. The app has no advertising SDKs and the website has no Meta pixel.
- If you download an extra Bible translation, the app requests the file from ankyra.app; as with any download, our hosting provider sees your IP address and the file requested. Crisis lines shown in the app open your phone's dialer or browser; we don't see those calls or visits.
What we collect, why and on what basis
The "legal basis" column applies if you are in the European Economic Area, the UK or Switzerland (GDPR / UK GDPR); the purposes are the same everywhere.
| Data | Why | Legal basis | Who receives it | How long |
|---|---|---|---|---|
| Purchases: a random app user ID created on your device, Apple's identifier for vendor (IDFV), purchase and subscription history and receipts, approximate country. | Unlock what you paid for, restore purchases, prevent fraud, handle refunds and accounting. | Contract (art. 6(1)(b)); legal obligations (art. 6(1)(c)). | RevenueCat (USA), Apple | While you have purchases with us and up to 3 years after your last transaction. |
| Usage analytics: events such as screens viewed and features used, app version, device model, OS, language, time zone and approximate country, linked to the random app user ID. | Understand what works, improve the app and measure which channels bring people. | Everywhere in the world: your explicit consent (art. 6(1)(a) and 9(2)(a)), asked in the app. Until you agree, analytics is off and no event is sent; you can withdraw your consent in Settings at any time. Events never include what you read, write, search or pray. | PostHog (USA) | Up to 12 months. |
| Crash and performance reports: error details, device model, OS and app version, a random installation ID, with personal data removed. | Find and fix bugs and crashes. | Legitimate interest in a working, secure app (art. 6(1)(f)). You can object at any time. | Sentry (USA) | Up to 90 days. |
| "How did you hear about us?" Optional answer (for example a platform or a creator's handle). | Know which channels and creators bring people. | Legitimate interest (art. 6(1)(f)); the question is optional and you can skip it. | RevenueCat, PostHog (USA) | Same as purchases / analytics. |
| Waitlist (website): your email address; how you found us (link, campaign or creator, referring site); the language of the page and of your browser; approximate country. | Email you your beta (TestFlight) invite and tell you when the app is available. | Your consent (art. 6(1)(a)); because joining the list of a Bible app may reveal religious beliefs, your explicit consent (art. 9(2)(a)), which you give by submitting the form. | PostHog (USA) | Until you unsubscribe, and at most 12 months after the app launches. |
| Website visits: pages viewed, clicks on creator links, referring site, device type, approximate country. No cookies. | Know which pages and links work. | Legitimate interest (art. 6(1)(f)). | PostHog (USA), Vercel (hosting, USA) | Analytics up to 12 months; hosting logs a few days. |
| Emails you send us: your address and what you write. | Answer you and keep a record of support requests. | Legitimate interest (art. 6(1)(f)); contract, if it is about a purchase. | Cloudflare (email forwarding), Google Workspace (mailbox) (USA) | Up to 3 years after the conversation ends. |
We never put the content of your logs in analytics or crash reports. Your IP address reaches our providers with every request, as on any network connection; they use it to estimate an approximate country and to protect their services. We don't make decisions about you based solely on automated processing, and we don't build profiles for advertising.
Providing this data is not required by law. Purchases need the purchase data; everything else is optional or can be turned off, and the app works without it.
Waitlist and early access
When you join the waitlist we store your email address. We use it only to send you your beta invite, tell you about the launch and shape the app. We don't sell it, share it with advertisers or set cookies to collect it. To unsubscribe and delete it, reply to any of our emails or write to hello@ankyra.app; we remove it within 30 days. Withdrawing consent doesn't affect what we did before.
Cookies and tracking
The website sets no cookies and doesn't store anything on your device for analytics. The app contains no advertising SDKs and no Meta pixel, and it doesn't use Apple's advertising identifier (IDFA) or ask to track you. We don't "sell" or "share" personal data as those terms are defined in US state privacy laws, and we honor Global Privacy Control signals.
Service providers and international transfers
We use these providers as processors, under contracts that only let them use the data to provide their service to us: RevenueCat, Inc. (purchases), PostHog, Inc. (analytics and waitlist), Functional Software, Inc. — Sentry (crash reports), Vercel Inc. (website hosting), Cloudflare, Inc. (DNS and email forwarding) and Google LLC (Google Workspace email). Apple processes purchases as the App Store operator under its own privacy policy.
We and these providers are in the United States. When the law of your country restricts transfers of personal data abroad, we rely on: for the EEA, the EU-US Data Privacy Framework where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where applicable); for Brazil, the safeguards permitted by the LGPD; and for Japan, the measures described in "Japan" below. You can ask us for a copy of the relevant safeguards.
Your rights
Depending on where you live, you can ask us to: confirm whether we process your data and give you a copy; correct it; delete it; restrict or object to its processing; receive it in a portable format; and withdraw any consent at any time (without affecting earlier processing). Most of your data is on your device, where you control it directly.
How to exercise them: write to hello@ankyra.app. Because we don't have accounts, to find data linked to the app we need the support ID shown in the app (Settings → Support) or, for the waitlist, the email address you used. We may ask for information to confirm the request is yours. We answer within one month (15 days for a confirmation or copy under the LGPD; 45 days under US state laws), extendable where the law allows, and for free. If we refuse a request, we explain why and how to appeal: reply to our answer with "Appeal" and we will review it within 45 days. You also have the right to complain to a data protection authority (see below), and we would appreciate the chance to address your concern first.
We never discriminate against you for exercising your rights.
Region-specific information
European Economic Area, UK and Switzerland. You can complain to the data protection authority where you live or work, for example the Information Commissioner's Office (ico.org.uk) in the UK. The legal bases are in the table above. Where we rely on legitimate interests, you can object at any time.
Brazil (LGPD). In addition to the rights above, you can ask for anonymization, blocking or deletion of unnecessary data, information about the entities we share data with, and information about the possibility of not giving consent and its consequences. You can also petition the National Data Protection Authority (ANPD).
Mexico (LFPDPPP). You can exercise your rights of access, rectification, cancellation and opposition (ARCO), revoke your consent and limit the use or disclosure of your data by writing to the contact above with your name, the right you want to exercise and the data concerned. We answer within 20 days. If you are not satisfied, you can go to the competent Mexican data protection authority.
Japan (APPI). The business handling your personal information is Pediaca, LLC, 1111B S Governors Ave, Ste 81429, Dover, DE 19904, USA, represented by Santiago Gonzalez Fernandez. Your data is provided to the processors listed above in the United States, a country that has no comprehensive federal data protection law (information on its system is published by Japan's Personal Information Protection Commission); each provider is bound by contract to protect it at a level equivalent to the APPI. Our security measures include: limiting what we collect, encryption in transit, access restricted to the person responsible with two-factor authentication, removal of personal data from crash reports, and contracts with every provider. You can request disclosure, correction, suspension of use or deletion through the contact above.
United States. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws have the rights described above, including the right to opt out of the sale of personal data, targeted advertising and profiling — we don't do any of these. In the last 12 months we collected the categories described in the table (identifiers, commercial information, internet or other electronic activity, approximate geolocation), for the purposes stated, from you and your device, and disclosed them only to the service providers above. Because using Ankyra can reveal religious beliefs (sensitive data under some state laws), we process that data only to provide the app and what you ask for, and never for advertising, profiling or sale.
Canada. Our privacy contact above is the person in charge of the protection of personal information (also under Québec's Law 25). Your information is processed in the United States by the providers listed above. You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information.
South Korea (PIPA). To provide the app, the data in the table above (purchase data, and analytics and crash data where they are on) is transferred over the network, each time you use the app, to the providers listed above in the United States, for the purposes and periods stated in the table. You can refuse by turning analytics off in Settings and not making purchases; the app keeps working, except for purchases.
India (DPDP Act). Send requests and grievances to the contact above. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Argentina (Law 25,326). You can exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest (art. 14(3)). The Agency for Access to Public Information (AAIP), as the supervisory authority of Law 25,326, handles complaints from anyone whose data protection rights are affected.
Other countries. In Chile, Colombia, Peru, Uruguay, South Africa, Singapore, Australia, New Zealand and elsewhere you have the rights described above and can complain to your national data protection authority (for example Colombia's Superintendencia de Industria y Comercio, Peru's Autoridad Nacional de Protección de Datos Personales, South Africa's Information Regulator, Singapore's Personal Data Protection Commission or Australia's OAIC).
Children
Ankyra is for people aged 16 and older. It is not directed to children under 13 and we don't knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.
Security
We collect as little as we can, keep your logs on your device, use encrypted connections, restrict access to our provider accounts and require two-factor authentication. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
Changes
If this policy changes in a meaningful way, we will update the date above and tell you in the app before the change applies. If a change requires your consent, we will ask for it.
Language
This policy is written in English and offered in other languages for convenience. If the versions differ, the English version prevails, except where the law of your country requires the version in your language or where it is more favorable to you.
Contact
Pediaca, LLC · 1111B S Governors Ave, Ste 81429, Dover, DE 19904, USA · hello@ankyra.app