Privacy Policy

Peter Leicht
Spitzwegstr. 12
84453 Mühldorf
Germany

Contact: [email address will be added soon]. We are not required to appoint a data protection officer.

• Account data: your email address and a password (stored only in encrypted form), or the identifier provided if you sign in with Google or Lovable.
• Country of residence: the country you state at sign-up, when you confirmed that you live there, and the country (not the IP address) your internet connection came from at that moment, because our terms and legal obligations depend on where you live. When you pay, we compare your residence with the country of your connection again, and Stripe asks for your billing address; both are plausibility checks only. If we personally admit you although you live outside the USA, we keep your email address on an internal list so that the app lets you in (legitimate interest, Art. 6(1)(f) GDPR); it is deleted when the exception ends.
• Consent records: that you confirmed you are 18 or older, which consents you gave and when.
• Learning data: your multiple-choice answers, results and the AI-generated reports and lessons.
• Settings: preferred Bible translation and, if you enter one, a name for personal address (pseudonym or first name). The display language is stored only on your device, not with your account.
• Session profile: optional age band, years of faith, whether you are new to the faith and, if you choose, one or more church traditions as a teaching filter. These stay only on your device and are sent with a request to tailor the questions; we do not store them with your account. Questions created for a tradition filter are kept in a shared pool for that combination, so the questions you answered can indirectly show which filter you chose.
• Payment data: which package you bought, amount, date and the payment reference. Card details are handled by Stripe, not by us.
• Gift vouchers: if you buy a voucher, your e-mail address, country of residence, voucher contents and code, to deliver the voucher, keep records and handle refunds (contract, Art. 6(1)(b) GDPR; tax records, Art. 6(1)(c)). When someone redeems it, we store which account redeemed it and when.
• Usage and technical data: pages visited, referring site, country, browser, device type, load times, clicks and errors (see “Visitor analytics”), plus server logs needed for security.

• Account, app functions, credit and the free course – performance of the contract (Art. 6(1)(b) GDPR).
• Learning data – your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), because it may reveal religious beliefs.
• Country of residence, residence confirmation, connection country and age confirmation – contract, legal obligations and our legitimate interest in offering the service only where our terms apply (Art. 6(1)(b), (c) and (f) GDPR).
• Payments and invoices – contract (Art. 6(1)(b)) and tax-law retention duties (Art. 6(1)(c) GDPR).
• Security, error analysis and cookieless visitor analytics – our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Your answers and reports may reveal religious or philosophical beliefs – a special category of data under the GDPR and sensitive personal information under US state laws. We process it only with your explicit opt-in consent, use it only to provide your learning pathway, and never for advertising or to infer characteristics about you. Choosing a church tradition as a filter is entirely optional (default: no filter); it is covered by this consent and is never used to judge you. You can withdraw consent at any time in your dashboard; this deletes your learning data. Withdrawal does not affect the lawfulness of processing before it.

To create questions, reports and lessons we send your quiz results (questions, answers, explanations and Bible references), a summary of your progress per subtopic, your optional session profile and, if you entered one, your chosen name for personal address to AI providers through the Lovable AI Gateway – never your email address or account ID. Providers: Anthropic (Claude) writes and OpenAI (GPT) reviews; for the free introductory lessons for people new to the faith a single low-cost OpenAI model (GPT-6 Luna) is used. Bible audio is generated once per verse with Google (Gemini) from the Bible text only – no personal data. No AI training: we do not use your data to train AI models and do not allow it. OpenAI does not keep this data beyond processing; Anthropic may keep it for a limited time under its own terms (e.g. safety review). The AI never evaluates your faith and makes no decisions with legal or similarly significant effect on you (Art. 22 GDPR).

We do not sell your personal information and do not “share” it for cross-context behavioral advertising. We use these providers:

• Lovable (Lovable Cloud): hosting, database, sign-in, file storage and visitor analytics – as our processor under a data processing agreement.
• AI providers via the Lovable AI Gateway: see “Artificial intelligence”.
• Google: only if you choose “Continue with Google”, to confirm your identity. Fonts are hosted by us; your browser does not contact Google to load them.
• Stripe: processes payments on its own page. For buyers living in the USA Stripe is our payment processor and collects your billing address; for purchases from other countries Stripe is the seller (merchant of record) and processes your name, email, billing country and payment as its own controller. We pass your email, user ID, product and country of residence to Stripe.

Links to Bible passages may open BibleGateway.com, a third-party website with its own privacy policy. We may disclose information if required by law.

Some providers (e.g. Lovable, OpenAI, Anthropic, Google, Stripe) process data in the United States. Transfers are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Lovable’s visitor analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable’s privacy policy explains how it handles the data.

It records pages visited, referring site, country, browser, operating system, device type, time on page, load speed, clicks and errors. Detailed data is kept for 90 days and daily summaries for a year.

We use no advertising or tracking cookies. Your browser stores in its local storage only what the app strictly needs: your sign-in token, language, country of residence and optional session profile. This is permitted without consent as strictly necessary (§ 25(2) no. 2 TDDDG); you can delete it at any time in your browser. Sign-in with Google or Lovable may set cookies from those providers during sign-in. We honor Global Privacy Control signals; since we neither sell nor share data, no further action is needed.

Account, settings and learning data: while your account exists. If you delete your learning data or withdraw consent, we delete it immediately. Account data is deleted when you ask us to delete your account. Payment records are kept as long as tax and commercial law requires (in Germany up to 10 years).

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21), and to withdraw any consent at any time (Art. 7(3)). Write to [email address will be added soon]. You may also lodge a complaint with a supervisory authority, for example the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. Providing account data is necessary for the contract; giving consent to learning data is voluntary, but without it the learning features cannot work.

Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas, Oregon), you may have the right to know and access, correct, delete and receive a portable copy of your personal information, to opt out of sale, sharing, targeted advertising and profiling, and to limit the use of sensitive personal information. We do none of these and use sensitive information only as described above. Contact [email address will be added soon]; we verify requests via your account email. You may use an authorized agent and appeal a denial by replying to our decision. We will not discriminate against you for exercising your rights.

iBibleSchool.org is only for adults aged 18 and over. We do not knowingly collect information from minors. If you believe a minor has created an account, please contact us and we will delete it.

We use encryption in transit, encrypted password storage and access controls so that only you can read your learning data. No system is completely secure.

If we change this policy in a material way, we will tell you in the app and ask for consent again where required.