Privacy Policy

Effective: 17 August 2026  ·  Last updated: 17 August 2026  ·  Describes app version 1.3.8 (versionCode 23) and this website.

This policy is written to match the software as shipped: Android flavors standard (package com.example.kingjames1611assistant) and fdroid (package org.kingjames1611assistant), plus this marketing website. If a screen in the app is shorter than this document, this document controls for disclosure. We do not collect categories of data that are not listed here.

1. Who we are and how to contact us

The “Operator,” “we,” and “us” means the developer who publishes King James 1611 Assistant (the “App”) and this website (the “Site”).

• Product: King James 1611 Assistant, a Christ-centered offline-first Bible study application for Android.
• Standard / companion package id: com.example.kingjames1611assistant
• F-Droid package id: org.kingjames1611assistant
• Contact for privacy, legal, and account deletion: the chat widget on this Site (Tawk.to property used by the Operator), and the developer email shown on the Google Play Store listing for the App if the App is listed there.

We are not Adrian Rogers, Love Worth Finding, Bellevue Baptist Church, or any affiliated ministry, and we are not endorsed by them.

2. Scope

This policy covers:

• The App installed on an Android device, including debug, sideload, private LMCloud update, and store builds that use the code described here.
• The Site (these HTML pages and the Tawk.to widget embedded on them).
• Together, an optional invite-only group service used only by the standard flavor when the user turns Online Mode on and signs in. The F-Droid flavor does not embed the Together/Supabase client and cannot create Together accounts.

This policy does not cover:

• Websites or apps you open yourself (for example after you copy a verse and paste it elsewhere).
• Your mobile carrier, Google Play, F-Droid, Android backup tools you enable at the system level, or speech-recognition engines provided by the device vendor.
• A Windows program called LMCloud that you install on hardware you control. That program is your environment; we do not operate your PC.
• Model files hosted by Hugging Face that you choose to download; those hosts have their own privacy policies.

3. Short summary (Play-oriented)

• Core Bible reading, search, bookmarks, notes, highlights, personal plans, Listen, Tools, Extras, diagnostics, and Ask chats are stored on the device. Android Auto Backup is disabled (android:allowBackup="false").
• No ads. No advertising ID. No analytics SDK. No Crashlytics. No Firebase. No public cloud chatbot.
• No account is required to read Scripture.
• A Together account (email + password + display name) is optional, standard flavor only, and is stored with Supabase at lmayadcomumzuqgsjhhb.supabase.co.
• Network use is blocked until you turn Online Mode on. Default is off, including after upgrades.
• Uninstalling the App deletes on-device data. It does not by itself delete a Together cloud account. See Account deletion.

4. What we do not collect

The App does not implement, and we do not collect through the App:

• Precise or approximate location, contacts, calendar, call logs, SMS, photos/media library as a permission, health, or financial account numbers.
• Advertising ID, or any ad network, mediation, or attribution SDK.
• Crash reports, usage analytics, heatmaps, or session replay sent to us.
• Public social graph or people directory.
• Direct messages between two users (the Together schema comment states whole-group structures only; the current Android UI does not offer group chat or posts).
• Payment card data (there is no in-app purchase billing SDK in the App).
• Your Ask questions, assistant answers, or chat transcripts on our servers. Those files live under the App’s private storage, encrypted.

If a future build adds a category listed above, we will update this policy and the Play Data safety form before that build is distributed as a production update.

5. Data that stays on your phone

Unless you export it yourself or you opt into Together/LMCloud/model download as described below, the following stays in the App’s private storage (and is removed when you uninstall):

Display spelling modernization happens on device. It does not send verses to us.

6. Android permissions and why they exist

The App does not request camera, location, contacts, or SMS permissions.

7. Online Mode

A single fail-closed controller gates every App-owned network path. The persisted default is off. When off, the App blocks DNS, sockets, HTTP, discovery, redirects, and retries for App-owned purposes, including:

• Catalog LLM downloads (Hugging Face, and the gated Cloudflare Worker for Gemma 4 E4B)
• LMCloud pairing, session, inference, and discovery
• Together / Supabase
• Opening external websites from inside the App

Turning Online Mode off shuts down in-flight App-owned connections. Bible reading, search, and on-device study continue.

When Online Mode is on, the App still does not open arbitrary internet: Together HTTPS is host-pinned to the Supabase project named above; model downloads must be HTTPS to huggingface.co / *.huggingface.co / hf.co / *.hf.co or to the exact Cloudflare Worker host kjv-assistant-models.aiinsidersnetwork.workers.dev (Gemma 4 E4B only); LMCloud is aimed at an endpoint you supply (your PC’s private address). Cleartext HTTP is permitted in network security config only because some private LAN or CGNAT paths use HTTP on 100.x or 192.168.x addresses; the App still gates those destinations in software. The App does not use public cleartext for Together, Hugging Face, or the gated model Worker.

8. Together (optional cloud; standard flavor)

Together is invite-only group study. It is not required to use the App. F-Droid builds ship a no-op Together client and do not contain the Supabase host.

After you create a Together account in the App, Supabase sends a confirmation email. The link returns you to this Site’s standalone confirmation page (together-confirmed), which talks to the same Together Auth project and tells you the account was created. That page does not keep a lasting browser login, does not store Bible data, and is not the Android App. You then Sign in on the phone. The App also lists this website under Settings → Data, directly above the version number.

8.1 Account data we process if you sign up

8.2 Group and activity data

Personal Room plan progress is never written to Together tables.

8.3 Schema that exists but is not used by the current Android UI

The Together database also has tables for group posts, comments, whole-group messages, and reports, with row-level security. The current Android client does not call those tables. If you or another client wrote rows there, they would be user-generated content visible to group members under those policies. We still treat that content as personal data of the authors and of the group, and it is in scope for deletion with the account/group.

8.4 Who can see Together data

• You see your own profile and groups you belong to.
• Active members see other active members’ display names, roles, plan checkmarks, shared badges, and published prayers in that group (including a name if the author chose “Show my name”).
• Anyone on the public Site prayer wall sees only the prayer text, labeled “A believer.” The Site does not receive or display author id, display name, email, group id, or the named/anonymous switch.
• Admins can see kicked/banned members in order to Unkick or Unban.
• The Operator and the hosting processor (Supabase) can access the database for security, abuse, legal process, and deletion requests. We do not sell this data.

8.5 Legal bases (where GDPR/UK GDPR applies)

• Contract: creating an account and operating the group features you request.
• Consent: turning Online Mode on; submitting prayers and display names (including that prayer text may appear anonymously on the Site); optional email confirmation.
• Legitimate interests: security, fraud/abuse prevention, defending legal claims, and keeping invite-only integrity (kick/ban).
• Legal obligation: if a court or statute requires retention or disclosure.

9. Optional model downloads

If you choose an on-device catalog model and Online Mode is on, the App downloads weights over HTTPS. Downloaded files stay on your device. Model publishers’ licenses (for example Qwen or Gemma/LiteRT community terms) apply; we do not relicense them. This path is not a public chatbot and does not send Ask chats to us.

Hugging Face: most catalog entries download from Hugging Face (including CDN hosts such as cdn-lfs.huggingface.co). The App sends a product User-Agent. Hugging Face may log IP address, URL, and standard server telemetry under Hugging Face’s privacy policy. We do not receive those logs.

Gated Cloudflare Worker (Gemma 4 E4B only): that one catalog file is fetched from our Worker at kjv-assistant-models.aiinsidersnetwork.workers.dev, which streams the object from a private R2 bucket. The App sends a product User-Agent and an anti-hotlink header so browsers and hotlinks are rejected. Cloudflare sees the connection (including IP) as the network operator. For a daily cap of two full downloads per IP, we store a short-lived hash of date plus IP in Cloudflare KV (typically until the next UTC day). We do not use that hash for advertising. The Worker is not a public r2.dev CDN and is not Workers AI.

10. Optional LMCloud (your PC)

You may pair the App with a Windows companion on a machine you control, over a private PC address. Prompts and completions then travel between your phone and your PC, not to a public LLM API operated by us. Pairing secrets live in EncryptedSharedPreferences on the phone. If you enable private in-place APK updates, the App may download an APK from that paired PC into app cache and ask Android to install it without wiping App data.

You are responsible for physical access, malware, and who can use that PC. We do not see LMCloud traffic unless you send it to us yourself (for example by pasting a chat into the Site widget).

11. Microphone, speech, and Listen

Listen / TTS: Scripture can be spoken with a male voice on the phone (including on-device Piper/sherpa-onnx when installed). That audio is generated locally unless you explicitly use LMCloud narration on your PC.

Ask voice input: If you grant RECORD_AUDIO, the App uses Android SpeechRecognizer. Depending on the device, the recognizer may be on-device or may send audio to the vendor’s speech service (often Google on stock Android, or the manufacturer’s service). We do not operate that recognizer and we do not receive the audio on Operator servers. The resulting text stays in the on-device chat store unless you later opt into LMCloud inference (then the text goes to your PC) or Together (Ask chats are not uploaded to Together).

You can refuse the mic permission and type instead.

12. This website and Tawk.to

The Site is separate from the App. The App does not embed Tawk.to. The App can open this Site in your browser from Settings → Data (user-tapped link; the App does not fetch the Site in the background).

Pages may load fonts from Google Fonts, which can see your IP address and user agent. See Google’s privacy policy.

The Together confirmation page (together-confirmed.html) is a small standalone page on this Site. When you open a confirmation email, it may send the one-time confirmation token to Supabase Auth at lmayadcomumzuqgsjhhb.supabase.co so we can show success or an expired-link message. It does not embed Tawk.to. It is not a chatbot. Tokens in the address bar are removed after the page finishes.

The public prayer wall asks Supabase only for published prayer text through a dedicated function. That function does not return names, emails, group ids, or account ids. The page renders the words as plain text.

The Site embeds a Tawk.to chat widget (embed.tawk.to property id 688b284b9abe48192a749848, widget 1k08h07na). Tawk.to may process IP address, device/browser data, cookies or similar IDs, approximate location derived from IP, and the contents of chats, including if you enable Tawk AI Assist. That processing is governed by Tawk.to’s data protection terms and their role as a processor for the Operator. Do not send passwords or payment numbers in chat. Prefer Settings → Data in the App to delete a Together account. If you ask us in chat to confirm deletion, we will use the email you provide to look up whether an Auth user still exists.

The Site does not run App analytics and does not include an ad pixel operated by us. Tawk.to and Google Fonts are third parties with their own cookies; we do not respond to browser Do Not Track beyond not adding extra trackers of our own.

13. Sharing, sale, and processors

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use Together or Ask data to train a public generative model.

Processors / independent services that may receive data only in the cases above:

We may disclose information if required by law, to prevent serious harm, or to protect the rights of users (for example abuse of Together). We will narrow the request when we can.

A publishable Supabase key is embedded in the standard flavor so the App can call the public Auth/REST API. It is not a service-role secret and does not by itself bypass row-level security.

14. Retention, security, and backups

• On-device: until you clear data, uninstall, or overwrite via backup restore.
• Together Auth and database: until you successfully complete account deletion, or a group is deleted (group rows cascade when a group is removed; profile rows cascade when the Auth user is deleted).
• Kicked / banned membership: kept so Unkick/Unban and join blocking work, until the account or group is deleted.
• Site chat: according to the Operator’s Tawk.to property retention settings.
• Security: HTTPS for Together, Hugging Face, and the gated model Worker; EncryptedFile / EncryptedSharedPreferences with Android Keystore for chats, Together tokens, and LMCloud secrets; Together row-level security; Online Mode fail-closed; no cleartext to public Together/HF/Worker hosts. No security measure is perfect. You must also use a strong Together password and keep invite codes private.
• Android Auto Backup: disabled. Chat files are also excluded in backup and data-extraction XML. OEM or rooted tools could still copy private app storage; that is outside our control.

15. Your rights

You may:

• Use the App without an account.
• Turn Online Mode off.
• Sign out of Together (clears local tokens; does not delete the cloud user).
• Delete the Together cloud account from Settings → Data (two confirmations). After deletion the App shows an automated notice: it cannot verify the rows are gone because there is no data of you left to look up. Sign in to create a new account, or message the team if you want a person to confirm deletion.
• Export a local JSON backup from Settings → Data (does not include encrypted Ask chats).
• Delete chats in the App; clear diagnostics; reset reading progress (this does not reset Together cloud checkmarks by itself).
• Uninstall to wipe on-device App storage.
• Request access, correction, or deletion of Together personal data via Site chat or the Play listing email. See Account deletion.

CCPA/CPRA: We do not sell or share (as those terms are defined for advertising) personal information. We do not use sensitive information to infer characteristics for advertising. California residents may request know/delete/correct using the contact methods above. We will not discriminate for exercising those rights.

GDPR/UK GDPR: You may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. Where we rely on consent, you may withdraw it (for example by signing out and requesting deletion, and by stopping use of the Site chat).

We will need enough information to verify you control the Together email. We may deny requests that are unfounded, excessive, or would violate another member’s privacy (we will then delete or anonymize your identifiers instead of handing over other people’s prayer text).

16. Children

Scripture reading without an account does not require the child to provide personal information to us.

Together accounts are for users 13 years of age or older (or the digital-consent age in the user’s country, if higher). We do not knowingly create Together accounts for children under 13. If you believe a child under 13 created an account, contact us; we will delete it. Parents who share a device should use Android profiles and should not let a child sign into Together.

The App is a Bible teaching product, not a social network for minors. Together contains user-generated prayer text. We do not enroll the App in Google Play’s Designed for Families program unless a future listing expressly says so.

17. International transfers

Supabase, Tawk.to, Hugging Face, Cloudflare, and Google may process data in the United States or other countries. If you use Together, the Site, or a catalog model download from the EEA/UK, you understand that processors may store data outside your country. Hugging Face, Cloudflare, and Tawk.to publish their own transfer mechanisms.

The 1611 King James text is public domain in most countries. In the United Kingdom, Crown rights may still affect commercial printing of the Authorised Version; that is a copyright matter, not a personal-data transfer. See Copyright.

18. Changes

We will post the new effective date at the top of this page. Material changes to App data practices will also be reflected in the Play Store Data safety form before a production store release that collects new data. Continued use after the effective date is acceptance of the updated policy, except where the law requires opt-in consent.

This policy is intended as an accurate description of the product for users and for store review. It is not a waiver of GPL rights in the software, and it is not pastoral, medical, or legal advice.