Cultivae Privacy Policy

Version 1.0 · effective October 13, 2026 Portuguese version: Português. For users in Brazil, the Portuguese version prevails if the two differ.

Plain-language summary

What you write stays on your device. Your journal, prayers, prayer requests, testimonies, Bible highlights, and your journey are stored on your phone. You can use Cultivae without an account, and we cannot see this data.
Nothing leaves your device unless you ask. Cloud backup, the AI assistant, and the community prayer wall are optional. We ask for your specific permission before each one.
We know faith is personal. Data that reveals religious belief (and sometimes health) is sensitive data under the law. We process it on our servers only with your specific, explicit consent, and you can withdraw that consent at any time.
We do not sell your data, show ads, or track you across other apps or websites.
The AI assistant receives only your question and the Bible references involved. It never receives your journal. The AI provider may not use this data to train its models.
You are in control. You can export your data, delete your account in the app, and erase everything stored on your device without asking anyone.

1. Who we are

Cultivae is a daily Christian spiritual companion app. The entity responsible for your personal data (the controller under Brazil's LGPD and the EU/UK GDPR) is:

THE DELUSIONAL COMPANY DESENVOLVIMENTO DE SOFTWARE SOB ENCOMENDA LTDA, Brazilian taxpayer ID (CNPJ) 67.758.390/0001-34, with its registered office in São Paulo/SP, Brazil ("Cultivae," "we," "us").

Data Protection Officer (Encarregado): appointed by THE DELUSIONAL COMPANY DESENVOLVIMENTO DE SOFTWARE SOB ENCOMENDA LTDA under LGPD Art. 41. All data subject requests are received and answered through contact@cultivaeapp.com. General support: contact@cultivaeapp.com

Users in the European Economic Area and the United Kingdom: any request or question about personal data can be sent to contact@cultivaeapp.com.

Independence: Cultivae is an independent app. It draws on practices and campaigns associated with the Igreja Universal do Reino de Deus (Universal Church of the Kingdom of God), but it is not affiliated with, sponsored by, or endorsed by that church or any other church. No church has access to your data through Cultivae.

2. Local-first: what stays only on your device

Cultivae is built to work without an account and without an internet connection. By default, everything you record is kept in a local database on your device (SQLite and the app's local storage):

your name or nickname, what you are seeking, your "purpose for the year," and your reminder time;
your progress in journeys, reflections, answers, and checklists;
your journal (text; photo and audio are planned);
private prayer requests and testimonies;
Bible highlights, notes, and your reading position;
your church's name and neighborhood, if you choose to enter them, and the meetings you checked in to;
faithfulness records (commitments, check-ins, and acts such as fasting or taking part in a campaign). Cultivae never records tithe or offering amounts and does not receive donations;
consistency indicators and app preferences.

While this data stays on your device, we do not receive it, cannot see it, and cannot recover it. Its security also depends on how your device is protected (passcode, biometrics, and operating-system backups such as iCloud or Google, which follow Apple's or Google's policies).

You can erase all of it at any time in Profile > Settings > Privacy > Delete my data from this device. This also cancels your scheduled reminder.

3. What we process on our servers, why, and for how long

We process data on our servers only when you use a feature that needs it. The table below summarizes each case. Legal bases are given under Brazil's LGPD (Law 13,709/2018) and, for users in Europe, the GDPR/UK GDPR.

Category	Examples	Where	Purpose	Legal basis (LGPD / GDPR)	Retention
Anonymous session	random session identifier, creation date, IP address, and technical request data	Supabase (São Paulo, Brazil)	Let you use the AI assistant and community features without creating an account; apply quotas and prevent abuse	Performance of contract (Art. 7(V)) / Art. 6(1)(b); abuse prevention: legitimate interest (Art. 7(IX)) / Art. 6(1)(f)	While the session is in use; sessions unused for 12 months are deleted
Account	email, account identifier, sign-in method (emailed code, Apple, or Google), access dates	Supabase	Create and secure your account, send your sign-in code, enable backup and community	Contract (Art. 7(V)) / Art. 6(1)(b). Because having an account with a Christian app may reveal belief, account creation is paired with the consent in section 4	While the account exists; deleted when you delete your account
Cloud profile	display name, language, time zone, country, birth year; church name and neighborhood (only with consent)	Supabase	Personalize the app, check minimum age, apply country rules	Contract (Art. 7(V)) / Art. 6(1)(b); church data: specific, highlighted consent (Art. 11(I)) / Art. 9(2)(a)	While the account exists
Backup & sync (optional)	a copy of the records listed in section 2 (journal, prayers, requests, testimonies, journeys, faithfulness, highlights), a random device identifier, dates	Supabase	Store your journey and sync it across devices	Specific, highlighted consent (Art. 11(I)) / Art. 9(2)(a) and Art. 6(1)(a)/(b)	While backup is on. If you withdraw consent or delete your account, the cloud copy is deleted within 30 days (including safety backups)
AI assistant (optional)	the text you type into the assistant (a question, or what you describe to create a journey), Bible references, language	Sent to Anthropic to generate the answer; we do not store the text	Answer questions about the Bible	Consent (Art. 11(I)) / Art. 9(2)(a) and Art. 6(1)(b)	Us: daily usage counters only, deleted after 35 days. Anthropic: see section 5
Community (optional)	public prayer requests and testimonies (text, category, first name or "Anonymous," language), "I prayed for you," reports, and blocks	Supabase; text sent to Anthropic for automated moderation	Publish on the prayer wall, moderate, keep the community safe	Posting: consent (Art. 11(I)) / Arts. 6(1)(a) and 9(2)(a). Reports, blocks, and safety: legitimate interest (Art. 7(IX)) / Art. 6(1)(f) and, where applicable, legal obligation	Posts are visible for 30 days and permanently deleted 60 days after they come down. Reports and "I prayed" marks are deleted with the post
Subscription	customer identifier, product, status, start, renewal, and expiry dates, store (Apple/Google), environment	RevenueCat and Supabase	Unlock and maintain Premium access	Contract (Art. 7(V)) / Art. 6(1)(b); legal obligations and defense of claims (Art. 7(II), (VI)) / Art. 6(1)(c), (f)	While the account exists; a minimal transaction record for up to 5 years to handle consumer claims, then deleted
Transactional email	email, sign-in code, service messages (welcome, deletion confirmation), delivery logs	Resend	Send sign-in codes and service notices. No marketing without separate consent	Contract (Art. 7(V)) / Art. 6(1)(b)	Delivery logs per the provider's policy (up to 30 days)
Access & security logs	IP address, date and time, request type, session identifier	Supabase	Security, abuse investigation, and compliance with Brazil's Internet Civil Framework	Legal obligation (Art. 7(II); Law 12,965/2014, Art. 15) / Art. 6(1)(f)	Up to 6 months (Internet Civil Framework, Art. 15), unless a court orders otherwise
Support & rights requests	name, email, message content, request history	Support email inbox (Hostinger)	Respond to you and document that we honored your rights	Contract, legal obligation, and defense of claims (Art. 7(II), (V), (VI)) / Art. 6(1)(b), (c), (f)	Up to 5 years after the request is closed
Consent records	which consent, version, date and time, language, app version	Supabase	Prove that you gave permission (LGPD Art. 8 §2; GDPR Art. 7(1))	Legal obligation (Art. 7(II)) / Art. 6(1)(c)	While the account exists and up to 5 years afterward, in pseudonymized form

Usage analytics and crash reports: today the app collects neither. If we ever start, it will be optional, off by default, only with your consent and never include text you write, and we will update this policy first.

What we never collect: card or bank details, precise location (GPS), your contacts, advertising identifiers (IDFA/AAID), biometrics, or tithe and offering amounts.

4. Sensitive data: faith and health

Almost everything in Cultivae can reveal your religious belief. Prayer requests and journals can also contain information about health, your family, or other people. The LGPD (Arts. 5(II) and 11), the GDPR (Art. 9), and several US state laws treat this data as sensitive. So:

On your device: the data stays with you; we do not receive it.
In the cloud (backup): only with your specific, explicit consent, separate from the Terms of Use and recorded with a version (for example, sensitive-v1), date, and time. It covers storing and syncing your records and, if you provide them, your church's name and neighborhood.
Withdrawing is easy: turn off backup in Profile > Settings > Privacy. We stop syncing and delete the cloud copy within 30 days. Your data remains on your device. Withdrawing does not affect your use of the app on your device.
Limited use: sensitive data is used only for the feature you asked for. It is never used for advertising, profiling, sale, or decisions about you. It is never sent to the AI. It is never shared with churches.
No inferences: we do not build profiles of your religiosity, health, or personality. Your journey indicators and "Memory" are calculated on your device.

About other people: when you write about family or friends, please avoid full names or details that identify them, especially health information. On the public wall, this is a rule (see the Terms of Use).

5. AI assistant

What is sent: only the text you type into the assistant (a question, or what you describe to create a journey), the Bible references involved, and the language. Your journal, prayers, prayer requests, and testimonies are never sent, and the app does not attach anything automatically.
How it is sent: through an intermediary server we operate, which removes identifiers. Anthropic does not receive your email or account identifier. We store only how many questions you asked per day, to apply your plan's quota (deleted after 35 days), and the aggregate cost of the service. We do not store the text of questions or answers.
Provider: Anthropic, PBC (USA), Claude models, via its commercial API. Under Anthropic's commercial terms, Anthropic may not use content submitted through the API to train its models. Under Anthropic's published policy, API inputs and outputs are deleted from its systems within 30 days. That period can be longer when content is flagged for violating Anthropic's usage policies, or when the law requires it.
Your permission: we ask for your explicit permission before your first question. You can revoke it in Profile > Settings > Privacy.
Please be careful: do not type personal information about yourself or others into the assistant (full names, diagnoses, addresses). Answers are generated automatically and may contain errors. The assistant is not a substitute for pastoral, medical, psychological, or legal advice.

6. Community (prayer wall)

The community is optional and requires you to be 18 or older.

What is public: the text of your request or testimony, its category, how many days ago it was posted, how many people prayed, and the name you choose to show (your first name or "Anonymous"). The wall is separated by language.
What is never public: your account, email, identifier, who you are behind "Anonymous," and who prayed for you. Internally we keep the link between a post and your account so you can delete it, so blocks work, and so we can moderate.
Moderation: every post goes through an automated AI review (the text is sent to Anthropic under the same terms as section 5) and may be reviewed by members of our team before or after it is published. Posts can be declined, hidden, or removed if they break the rules. A post reported by 3 people is hidden automatically until it is reviewed. We will tell you when a post of yours is removed, and you may ask for human review (see the Terms of Use).
Reports and blocks: you can report a post (a reason and an optional comment) and block its author without ever learning who they are. Reporting requires an account with a verified email, to prevent abuse.
Duration: posts stay up for 30 days and are permanently deleted 60 days later. You can delete yours at any time.
Remember: other users can see, copy, or screenshot what you post before it is deleted.
Community numbers: we show only aggregate statistics. Numbers below 100 are not displayed, to reduce the risk of identifying people.

7. Subscriptions and payments

Premium subscriptions are sold through the App Store (Apple) or Google Play (Google). Payment happens entirely in the store: we never see or store your card or payment details. Apple and Google handle payment data as independent controllers under their own privacy policies.

We use RevenueCat to confirm with the store whether your subscription is active. RevenueCat receives a pseudonymous customer identifier, purchase receipts and events (product, dates, renewal, cancellation, store country), and basic technical data about your device and the app. RevenueCat acts as our processor.

8. Notifications

The daily reminder is a local notification: your device schedules and delivers it at the time you choose. No data is sent to our servers for this. You can turn it off in the app or in your system settings. If we later offer server-sent (push) notifications, we will ask for your permission and update this policy. In that case, a device notification token will be processed by Apple, Google, and Expo.

We do not sell or rent personal data, and we do not share it for cross-context behavioral advertising.

We share data only with:

Processors (service providers) that handle data on our behalf under contract, with confidentiality and security obligations equivalent to this policy: Supabase (database, authentication, and server functions), Anthropic (AI and moderation), RevenueCat (subscription status), Resend (email), Expo (app build and release infrastructure), and Hostinger (support email inbox). This is the complete list of our processors; where each one is located is in section 10. Each processor uses its own subprocessors (for example, Supabase uses Amazon Web Services), as listed by each provider.
Apple and Google, as app stores and payment processors (independent controllers).
Authorities, when we have a legal obligation, a court order, or a valid request, or to protect rights, people's safety, or the integrity of the service. We will notify you whenever the law allows.
In a corporate reorganization (merger or acquisition), data may be transferred to the successor, which will be bound by this policy. You will be told beforehand.

No church, including the Igreja Universal do Reino de Deus, receives user data.

10. International transfers

Our main servers are located in São Paulo, Brazil (Supabase, in the AWS sa-east-1 region). Some processors (Anthropic, RevenueCat, Resend, and Expo) are in the United States; our support email provider (Hostinger) and some providers' support staff may process data from other countries.

Users in Brazil: transfers follow LGPD Art. 33 and ANPD Resolution CD/ANPD No. 19/2024, using the ANPD-approved standard contractual clauses or another valid mechanism. The ANPD recognizes the European Union as providing an adequate level of protection (Resolution CD/ANPD No. 32/2026).
Users in the EEA: transfers to Brazil rely on the European Commission's adequacy decision for Brazil (January 2026). Transfers to the US use the EU-U.S. Data Privacy Framework, where the provider is certified, or the European Commission's Standard Contractual Clauses (GDPR Chapter V), with supplementary measures where needed.
Users in the UK: we use the UK Extension to the Data Privacy Framework, the IDTA, or the UK Addendum to the SCCs, as applicable.

You can request a copy of the relevant safeguards at contact@cultivaeapp.com.

11. Security

Our measures include:

Minimization: the local-first design keeps most data from ever leaving your device; the AI receives only your question.
Encryption in transit (TLS) for all communication with our servers, and encryption at rest provided by our database provider.
Per-user isolation: Row Level Security rules ensure each person can access only their own records. Privileges are granted explicitly, never by default.
Protected authorship in the community: the identifier of whoever posted never leaves the database to other users.
Rate limits and quotas against abuse and automation; reporting requires a verified account.
Short retention and automatic deletion routines (expired posts, rate-limit logs, and AI counters).
Restricted internal access on a need-to-know basis, with strong authentication, and data protection agreements with our processors.
An incident response plan, including notice to the ANPD, European authorities, and you within legal deadlines.

No system is 100% secure. If you suspect a problem, please write to contact@cultivaeapp.com.

12. Retention and deletion

We keep data only as long as each purpose requires (see the table in section 3) or as needed to meet legal obligations. In short:

On your device: until you erase it (in Settings or by uninstalling the app).
Deleting your account (in Profile > Settings > Account > Delete my account, or on the page cultivaeapp.com/en/delete-account): we immediately delete your account, profile, backup, posts, "I prayed" marks, reports, blocks, and subscription status. Copies in database safety backups are gone within 30 days. We keep only records the law requires (access logs for 6 months, under Brazil's Internet Civil Framework) and a minimal, pseudonymized record of transactions and consents, to defend against possible claims (up to 5 years).
Deleting your account does not cancel your subscription. Apple or Google bills you: cancel in the store's settings.
Deleting your account does not erase data on your device. To do that, also use "Delete my data from this device."

13. Your rights and how to exercise them

In the app, without asking anyone:

Export your data: Profile > Settings > Privacy > Export my data (an open-format JSON file).
Correct: edit your records and profile directly.
Withdraw consents: Profile > Settings > Privacy (backup, AI, and community).
Delete your account: Profile > Settings > Account > Delete my account.
Erase data on your device: Profile > Settings > Privacy > Delete my data from this device.

By email: contact@cultivaeapp.com. For your security, we may ask you to confirm the request from your account email. We do not charge for reasonable requests.

Where you are	Your rights	Response time
Brazil (LGPD Art. 18)	confirmation and access; correction; anonymization, blocking, or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about sharing; information about the option to refuse consent and its consequences; withdrawal of consent; objection; review of automated decisions (Art. 20)	Up to 15 days for the complete statement (Art. 19(II))
EEA and UK (GDPR/UK GDPR Arts. 15–22)	access, rectification, erasure, restriction, portability, objection (including to legitimate interests), withdrawal of consent at any time, not being subject to solely automated decisions with significant effects	1 month, extendable by 2 more months for complex requests, with notice
United States (CCPA/CPRA and state laws)	know/access, correct, delete, portability, opt out of sale, sharing, and targeted advertising (we do none of these), limit use of sensitive data, appeal a denial, non-discrimination	45 days, extendable by 45 more; appeals within 60 days or your state's deadline

Complaints to authorities: you may complain to Brazil's ANPD (Autoridade Nacional de Proteção de Dados, gov.br/anpd), to the data protection authority in your EU country, to the ICO in the UK (ico.org.uk), or to your state Attorney General in the US. We would like the chance to resolve it first, so please contact us.

14. Children and teenagers

Cultivae is not directed to children. We apply these minimum ages:

Using the app: 13 in the US and UK; 16 in the EEA; 16 in Brazil.
Community (public wall): 18 or older in every country. Before your first post, we ask for your birth year, without suggesting an answer.
Subscription: purchases are made through your store account. Users under 18 should have a parent's or guardian's permission; parents can use Apple's controls (Family Sharing / Ask to Buy) or Google's (Family Link).

If you are a parent or guardian and believe a child under the minimum age has given us data, write to contact@cultivaeapp.com and we will delete it. We do not knowingly collect personal information from children under 13 (COPPA, US).

15. Additional information for US residents

Notice at collection (California). The categories of personal information we collect, the purposes, and the retention periods are in section 3. In CCPA terms:

CCPA category	Collected?	Examples	Source	Disclosed for a business purpose to
Identifiers	Yes	email, account ID, anonymous session ID, IP address	You; your device	Processors (Supabase, Resend, RevenueCat)
Customer records (Cal. Civ. Code 1798.80(e))	Yes	display name, email	You	Processors
Protected classification characteristics	Yes	religion (inferable from use and from backup and community content); age range (birth year)	You	Processors
Commercial information	Yes	subscription status and history	Stores; RevenueCat	RevenueCat
Internet or network activity	Yes	access logs	Your device	Supabase
User-generated content	Yes	backup, AI questions, community posts	You	Supabase; Anthropic
Precise geolocation	No	—	—	—
Biometric	No	—	—	—
Inferences for profiling	No	—	—	—
Sensitive personal information	Yes	religious beliefs; health information you choose to write	You	Supabase; Anthropic (only the question or post text)

We do not sell or "share" (for cross-context behavioral advertising) personal information, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing data of consumers under 16. We honor the Global Privacy Control signal, although there is no sale or sharing to stop.
Sensitive data: we use sensitive personal information only to provide the service you requested, within the purposes permitted by CCPA Regulations §7027(m). We do not use it to infer characteristics about you.
Opt-in consent: in states that require consent before processing sensitive data (such as Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Indiana, Kentucky, Rhode Island, and others), we process that data on our servers only after you consent. We follow this practice for all US users, including in states with different rules (such as Utah, Iowa, and Maryland).
Rights and appeals: rights and deadlines are in section 13. If we deny a request, you can appeal by replying to our email with the subject "Appeal." If you disagree with the outcome of the appeal, you can complain to your state Attorney General. You may use an authorized agent with proof of authorization. We extend these rights to all US users, even if your state's law does not apply to us.
Shine the Light (Cal. Civ. Code 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.
Consumer health data (Washington — My Health My Data Act; Nevada — SB 370): we do not ask for health information, but you may write it in prayer requests, your journal, or questions. This data is processed only for the feature you use, with your consent (backup, AI, or community), is never sold, and can be accessed or deleted as described in section 13.

16. Additional information for users in the EEA and UK

Legal bases: see the table in section 3. Where we rely on legitimate interests (security, abuse prevention, moderation), you may object at any time. Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out.
Automated decisions: automated AI moderation can block or hide a post. It does not produce legal effects for you, and you can always ask for human review. We do not profile you.
Contact: requests and questions from users in the EEA and the UK are handled at contact@cultivaeapp.com (see section 1).
Terminal equipment (ePrivacy Directive): we access or store information on your device only when strictly necessary for the service you requested, or with your consent.

17. Cookies and tracking

The app does not use cookies and contains no advertising SDKs. We do not track you across other companies' apps or websites, and we do not share data with data brokers. For this reason, the app does not show Apple's App Tracking Transparency ("Allow app to track") prompt. The website cultivaeapp.com uses no cookies and no analytics or tracking tools. The company that hosts the website (Vercel) receives technical access data, such as your IP address, to deliver the pages and protect the service.

18. Changes to this policy

We may update this policy. When a change is material, we will tell you in the app before it takes effect. If a change affects consent-based processing, we will ask for new consent (a new version, such as sensitive-v2). The date and version are at the top of this document, and previous versions are available on request.

19. Contact

Data Protection Officer: contact@cultivaeapp.com
Support: contact@cultivaeapp.com
Controller: THE DELUSIONAL COMPANY DESENVOLVIMENTO DE SOFTWARE SOB ENCOMENDA LTDA, CNPJ 67.758.390/0001-34, with its registered office in São Paulo/SP, Brazil