Privacy Policy

PrayerSpace is a private place for prayer. What you write there is between you and God, and this policy explains exactly what we collect, why, where it goes, how long it stays, and what you can do about it. We wrote it to be read, not skimmed, so it is longer than most. Every statement in it is checked against the application's source code.

1. Who we are and how to reach us

PrayerSpace (prayerspace.ca) is operated by its owner, a private individual based in St. John's, Newfoundland and Labrador, Canada, on a non-commercial basis. There is no company behind it, no investors, and no advertising. The operator is the person accountable for your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA, Principle 1 — Accountability), the “person in charge of the protection of personal information” for the purposes of Quebec's Act respecting the protection of personal information in the private sector, and the “controller” for the purposes of the EU and UK General Data Protection Regulation (GDPR).

For any question, request or complaint about your personal information, write to no-reply@prayerspace.ca. We answer within 30 days. A postal address is available on request.

2. Scope

This policy applies to the PrayerSpace website at prayerspace.ca, to the installable web app (PWA) served from the same address, and to the e-mails we send you. It does not apply to third-party websites we link to, such as netbible.com or salvationarmy.org, which have their own policies.

This policy is written in English and also available in French. If the two versions disagree, the English version prevails.

3. What we collect

We collect only what the service needs. The tables below list every category of personal information the application stores, where it comes from, and whether it is encrypted.

3.1 Account information

3.2 Prayer content — your journal and prayer list

Your prayer journal entries (title, body, date) and your prayer list (groups and items) are the reason the service exists. They reveal your religious beliefs and are therefore sensitive personal information under PIPEDA and a special category of personal data under GDPR Article 9. We treat them accordingly:

• They are always encrypted at rest with AES-256-GCM before they reach the database.
• By default the encryption key is held by our server so that we can show you your entries on any device. In this mode the operator could technically read your entries with direct database access and the server key. We do not, we never have, and no administrative screen exists that displays another person's prayers.
• You can turn on end-to-end encryption (§10). Then your entries are encrypted on your own device with a key derived from a passphrase only you know, and we store ciphertext we cannot read — not with any tool, not under any request.
• The dates of entries and the time they were created or last edited are stored in plain text in both modes, because the calendar needs them.

We never send prayer content to any third party, never use it to train or query any AI system, and never analyse it.

3.3 Settings

3.4 Security and sign-in information

To protect your account we keep a short record of every sign-in:

You can see your sign-in history and end any session on your account page. We e-mail you when your account is used from a device or country we have not seen in your recent history.

3.5 Technical fault reports

When something breaks, the app records a fault report so we can fix it. A report contains the page path (never the query string), the error message and stack trace, your browser string, a handful of allow-listed metrics (for example, how many words a failed save contained), and a link to your account. Every report passes through a redaction step, twice, that strips e-mail addresses, encrypted blobs, tokens and recovery keys. Prayer text never enters a fault report — only its length. Reports are deleted with your account and, in any case, after 90 days.

3.6 Information kept on your device

The app stores some data in your own browser. It never leaves your device unless stated:

Shared or public computers: the draft store and the remembered encryption key stay on the device after you sign out. Clear the site data in your browser, or use a private window, on any device you do not control.

3.7 What we deliberately do not collect

No analytics or usage tracking. No advertising identifiers. No third-party cookies. No tracking pixels in e-mails. No payment information (the service is free). No precise location. No contacts, photos or files beyond the profile picture you choose. No push-notification tokens. No profiling. No data from children (§12).

4. Why we use your information, and on what legal basis

We do not make any decision about you by automated means, and we do not profile you.

5. Consent and your choices

• At sign-up you accept this policy and the Terms of Service by ticking a box; the version and time are recorded. If you sign up with Google, you are asked to accept them on your first visit instead.
• End-to-end encryption is opt-in. You can turn it on, change your passphrase, or turn it off at any time in your account settings.
• Time zone is detected automatically; you can override it in your account settings.
• Security e-mails (verification, password reset, sign-in links, new-device alerts) are part of operating your account and cannot be switched off while the account exists. We send no newsletters or marketing of any kind, so there is nothing to unsubscribe from. These are “transactional” messages under Canada's Anti-Spam Legislation.
• Withdrawing consent for anything else means deleting the information concerned or your account (§11).

6. Who we share your information with

We do not sell, rent, trade or otherwise disclose your personal information to anyone for their own purposes. The service runs on infrastructure from the following providers, who process data on our behalf and under their own security commitments:

Two further tools are used only by administrators to prepare the daily devotional content (doctrines, Scripture passages, hymns and historical quotations) and never receive any information about users: Google Gemini (an AI model that helps extract quotations from a public-domain doctrine handbook) and API.Bible (Scripture text lookup).

We will disclose personal information outside this list only if required by Canadian law or by a court order or other legally binding request, and only to the extent required. If that happens we will tell you, unless the law forbids it. Where the information is end-to-end encrypted, we can hand over only ciphertext, because that is all we have.

7. Where your information is stored, and international transfers

The database that holds your account and prayer content is located in Canada (AWS ca-central-1, Montréal, Quebec). Two of the providers in §6 process data outside Canada, in the United States: Vercel, through whose servers every request passes (so your IP address and the pages you request are handled there, and encrypted prayer content transits through them), and Google, which delivers our e-mails and handles Google sign-in. While information is in the United States it is subject to the laws of that country, and may be accessible to its courts, law-enforcement and national-security authorities under those laws. This is the disclosure the Office of the Privacy Commissioner of Canada asks organisations to make about cross-border processing.

If you use PrayerSpace from the European Economic Area, the United Kingdom or Switzerland: the European Commission and the UK recognise Canada's PIPEDA as providing adequate protection for data handled by organisations subject to it. Onward transfers to our United States providers rely on those providers' participation in the EU-US Data Privacy Framework and its UK and Swiss extensions, and on the Standard Contractual Clauses in their data-processing terms. End-to-end encryption, where you enable it, is an additional technical safeguard that makes your prayer content unreadable to any recipient.

8. How long we keep your information

When you delete your account (§11), the following are removed in one database operation: your profile, prayer journal, prayer list, encryption keys, sign-in sessions and history, Google account link, password hash, fault reports, any pending e-mail links, and your uploaded profile picture. The only trace that remains is in the audit trail of devotional content that an administrator account may have edited, where the author is replaced by “Deleted user”. Nothing about you is kept after deletion “for our records”.

9. How we protect your information

• Encryption at rest. Prayer journal entries and prayer lists are encrypted with AES-256-GCM before they are written to the database, each record with its own initialisation vector, and the journal and the prayer list under separate keys. The keys are kept in the server's environment configuration, never in the database and never in your browser.
• Passwords are hashed with Argon2id (64 MiB memory, 3 iterations, 4 lanes). The plain-text password is never stored and cannot be recovered by anyone, including us.
• In transit. Every connection to prayerspace.ca uses HTTPS (TLS). E-mails are handed to the mail server over an encrypted (SMTPS) connection.
• Sessions. Your session cookie is HttpOnly (invisible to scripts), Secure (HTTPS only) and SameSite (resistant to cross-site request forgery). Sessions expire after 7 days. A new sign-in from an unfamiliar device or country triggers an e-mail alert.
• Access control. Every database query for prayer content is scoped to the signed-in user. There is no code path by which one user can read another's entries. Administrators see the list of accounts (name, e-mail, status, sign-up and last-seen dates — never IP addresses or browser strings), aggregate statistics, and fault reports; they cannot open anyone's journal, and the ability for an administrator to “sign in as” another user is disabled.
• Rate limiting on sign-in, sign-up, password reset and e-mail sending slows down credential-guessing and e-mail bombing.
• Log hygiene. The fault-report pipeline enforces an allow-list of fields and strips secrets and e-mail addresses before anything is written (§3.5).
• Content-security policy and other browser hardening headers limit what scripts can run on the site.

No system is perfectly secure. §14 describes what we do if something goes wrong.

10. Optional end-to-end encryption

You can turn on end-to-end encryption in your account settings. When it is on:

• You choose a passphrase, separate from your password. Your device turns it into a master key using Argon2id; that key never leaves the device. From it, a key-encryption key is derived (HKDF) and used to wrap a random 256-bit data key that encrypts your journal and prayer list (AES-256-GCM).
• The server stores only the wrapped (encrypted) data key, a second copy of it wrapped with your recovery key, the random salt, and the Argon2id parameters. None of this lets us, or anyone with a copy of the database, read your entries.
• A recovery key (26 characters) is shown to you once, when you enable the feature. It is the only way back in if you forget your passphrase. We do not store it and cannot regenerate it.
• If you lose both your passphrase and your recovery key, your encrypted entries are gone. There is no support tool, administrative override or database query that can recover them. This is not a limitation we could remove; it is what makes the encryption end-to-end.
• The guarantee applies from the moment migration completes. Turning the feature on downloads your existing entries to your device, encrypts them there and re-uploads them. Copies made before that moment, including database backups within the window in §8, were protected by server-side encryption only. Turning the feature off reverses the process.
• “Remember this device” keeps your unlocked key in the browser's database in a non-extractable form (§3.6). The auto-lock setting clears it from memory after a period of inactivity. Locking and unlocking are synchronised across tabs on the same device; no key material crosses that channel.
• Your name, e-mail address, time zone, entry dates, and the number of entries stay unencrypted, because the service cannot operate without them (§3.2).

11. Your rights

Everyone

You can, at any time and free of charge:

• See and download everything we hold about you. The “Download my data” button on your account page produces a JSON file with your profile, all journal entries, your prayer list, your sign-in history (including IP addresses), your consent record and your encryption status. If end-to-end encryption is on, the file is decrypted on your device when your key is unlocked.
• Correct your name, time zone, language and picture in your account settings; change your password; end sessions.
• Delete your account and everything in it, from your account page (§8). If you signed up with Google you confirm by typing your e-mail address, and we may ask you to sign in with Google again first.
• Ask us to do any of the above, or ask any question, by e-mail (§1). We will verify that the request comes from the account holder — normally by asking you to write from the registered address — and reply within 30 days.

In Canada (PIPEDA)

You have the right to access your personal information, to challenge its accuracy and completeness, to withdraw consent (subject to legal or contractual restrictions and reasonable notice), to know to whom it has been disclosed, and to challenge our compliance with PIPEDA. If you are not satisfied with our answer you may complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, 1-800-282-1376, www.priv.gc.ca.

In the EEA, United Kingdom and Switzerland (GDPR)

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20 — the download in machine-readable JSON), objection to processing based on legitimate interests (Art. 21), and withdrawal of consent at any time without affecting earlier processing (Art. 7(3)). You may lodge a complaint with the supervisory authority of your country of residence, or with the UK Information Commissioner's Office. We have not appointed a representative in the EU or UK under Art. 27, relying on the exemption for occasional, non-commercial processing; you can reach us directly at the address in §1.

12. Children

PrayerSpace is not directed to children. You must be at least 16 years old to create an account. We do not knowingly collect personal information from anyone younger. If you believe a child has created an account, write to us (§1) and we will delete it and its contents.

13. Cookies and similar technologies

We use exactly two cookies and no tracking technologies of any kind:

During “Sign in with Google”, short-lived cookies protect the sign-in exchange itself and are removed when it completes. Local storage, the browser databases and the service-worker cache are described in §3.6. Because none of these are used for tracking or advertising, no cookie banner is required and none is shown. You can clear all of them at any time through your browser's site-data settings; doing so signs you out, forgets your remembered encryption key and discards unsaved drafts.

14. If a breach happens

If we learn that your personal information has been lost, accessed or disclosed without authorisation, we will assess the risk, contain it, and — where there is a real risk of significant harm to you — notify you and report to the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA section 10.1 requires, and keep a record of the breach for 24 months. For information about residents of the EEA or UK we will notify the competent supervisory authority within 72 hours where the GDPR requires it. Where your content was end-to-end encrypted, a breach of the database exposes only ciphertext, and we will say so in the notice.

15. Changes to this policy

The version and effective date are at the top of this page. We may update this policy when the service or the law changes. If a change reduces your rights or expands what we collect or share, we will e-mail you at your registered address and show a notice at sign-in at least 14 days before it takes effect; continuing to use the service after that date means you accept the change. Corrections and clarifications that do not affect your rights take effect when published. Earlier versions are available on request.

16. Notes for particular regions

• Quebec. The operator (§1) is the person in charge of the protection of personal information. This policy is available in French. You may address complaints to the Commission d'accès à l'information du Québec after contacting us.
• California. We do not sell or share personal information, do not use it for cross-context behavioural advertising, and have not done so in the preceding 12 months. The rights in §11 are available to you.
• Everywhere else. Where local law gives you rights beyond those listed in §11, contact us and we will honour them.

17. Contact

no-reply@prayerspace.ca — for privacy questions, requests and complaints. Please write from the e-mail address registered to your account so we can verify that the request is yours. A postal address is available on request.