North Star App Privacy Policy

North Star is a Bible companion app built and operated by:

• AJ Software Development Limited (company number 17191882, registered in England and Wales)
• 19 Vale Gardens, Ince, Wigan, WN3 4JD, United Kingdom
• anthony@ajsoftwaredev.org

For UK GDPR purposes, AJ Software Development Limited is the data controller for the North Star app.

This policy covers the North Star mobile application on iOS and Android — accounts, journals, prayers, AI conversations, reading progress, and anything else you do inside the app.

The marketing site at northstarbible.com has its own separate policy at /privacy.

We try to collect as little as we reasonably can. Here’s the full list:

• Account details. Your email address and a hashed password (handled by Supabase Auth — we never see your plain password). Optionally, your first name if you choose to add one.
• Journal entries. Whatever you write in your journal. Private to your account.
• Prayer entries. Your prayer list, answers, and notes. Private to your account.
• AI conversation messages. The prompts you send to AI features (devotional, ask AI, prayer help, sermon, journey) and the responses generated. These are sent to the Anthropic Claude API for processing — see the AI section below.
• Reading and plan progress. Which passages you’ve read, where you are in a plan, and your streak.
• Photos. Only if you deliberately attach one (e.g. to a journal entry). We never browse or upload your photo library.
• Crash and diagnostic data. If the app crashes, Expo (our build platform) collects basic diagnostic information so we can fix the bug. No content from your journal, prayers, or AI chats is included.

We don’t collect your location, your contacts, advertising identifiers, biometrics, or any device fingerprint used for tracking. There is no analytics SDK, no ad SDK, and no third-party tracker in the app.

The data above is used to:

• Sign you in and keep your account secure
• Sync your journal, prayers, and progress across your devices
• Generate responses for the AI features you use
• Diagnose and fix crashes

That’s the lot. We don’t run ads, we don’t sell data, and we don’t plug in third-party analytics beyond crash reporting.

Our lawful basis under UK GDPR is the performance of a contract with you (delivering the service you signed up for) and, where relevant, your consent.

We use a small number of trusted providers (sub-processors) to run the service:

• Supabase — authentication, Postgres database, and file storage. Your account, journal, prayer, and progress data live here. Hosted in the US/EU. supabase.com/privacy.
• Railway — backend hosting for our API. Hosted in the US. railway.com/legal/privacy.
• Anthropic — Claude AI, used to generate devotionals, prayers, sermon helps, and Q&A responses. Hosted in the US. Per Anthropic’s stated policy, Anthropic does not use customer data sent via the API to train its models. anthropic.com/legal/privacy.
• Expo — build and crash reporting platform. expo.dev/privacy.

We do not sell your data and we do not share it with advertisers or data brokers.

When you use any AI feature in North Star (devotional, ask AI, prayer help, sermon, journey, etc.), the text of your prompt is sent over an encrypted connection to the Anthropic Claude API. Anthropic processes the prompt long enough to generate a response and returns it to the app.

Per Anthropic’s published policy, prompts and responses sent through the API are not used to train their models. They may be retained briefly for abuse monitoring and service operation, then deleted in line with Anthropic’s own retention policy.

Practical advice: please don’t paste personally identifying information, financial details, medical records, or other sensitive personal data into AI prompts. Treat AI prompts the way you would treat any message sent over the internet to a third-party service.

Some of our sub-processors are based in the United States. Where your data leaves the UK or EU, the transfer is covered by the appropriate UK GDPR safeguards — typically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent mechanism used by the provider.

We keep your data for as long as your account is active. When you delete your account, your data is deleted along with it (see below). We may retain minimal records (e.g. a deletion log) for legal and security purposes for a short period.

You can delete your account in two ways:

• In the app — Settings → Account → Delete my account.
• On the web — visit northstarbible.com/delete-account and follow the steps.

Either route deletes your account and the associated data (journal, prayers, AI history, progress) from our active systems. Backups are rotated out within 30 days.

You have the right to:

• Access the data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict how we process your data
• Receive a copy of your data in a portable format
• Object to processing
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email anthony@ajsoftwaredev.org. We’ll respond within 30 days.

North Star is for users 18 and over. We do not knowingly collect data from anyone under 18. If you’re a parent or guardian and you believe a child has signed up, email anthony@ajsoftwaredev.org and we’ll delete the account.

We take a few specific, practical steps to keep your data safe:

• In transit: TLS 1.2 or higher between the app and our backend. Nothing leaves your device in the clear.
• At rest: AES-256 encryption on the Supabase Postgres database that holds your account, journal, prayers, and progress.
• Row-Level Security (RLS): Supabase enforces database-level rules so every query is scoped to your user ID. In plain English — even if our backend code had a bug, the database itself wouldn’t let one user read another user’s journal or prayers.
• Passwords: stored as bcrypt hashes by Supabase Auth. We never see, store, or transmit your plain-text password.
• AI prompts: per Anthropic’s API terms, no customer data sent through the API is used to train their models.

We follow sensible engineering practices around access control, secrets management, and dependency hygiene. That said, no system is 100% secure. If you ever suspect your account has been compromised, email us straight away.

If we materially change how we handle your information, we’ll update this page and bump the date at the top. For significant changes, we’ll also notify you by email or via an in-app notice before the change takes effect.

If you’re in the UK and you think we’ve mishandled your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk. If you’re in the EU, you can complain to your local Data Protection Authority. We’d appreciate the chance to put things right first — email us before you go to the regulator if you can.

Privacy questions, data requests, or anything else about how your information is handled — email anthony@ajsoftwaredev.org.