This Privacy Policy explains how Catholica Ltd collects, uses, stores and shares personal data when you use the Catholica website, iOS application, Android application and related services (together, “Catholica” or the “Service”).

Catholica Ltd is a company registered in England and Wales under company number 16096313. Catholica Ltd is the controller of the personal data described in this Policy. Privacy questions and requests can be sent to legal@catholica.com.

1. Scope and language versions

Catholica is an all-in-one Catholic companion offering features that may include prayer experiences, Bible reading and commentary, spiritual routines, audio, reminders, parish-related preferences, account features and optional sharing with other users.

This Policy applies to personal data processed by Catholica Ltd through the website, iOS app, Android app and related support or communications. Features and data practices may differ by platform, account status, location and app version.

Catholica may make this Policy available through different language or regional versions of the website and app. Translations are provided to make the Policy accessible and are intended to describe the same core practices. A local version or privacy supplement may include additional information required by local law. No translation is intended to reduce rights given by applicable law.

Apple, Google, Facebook and other sign-in providers, app stores, device manufacturers, mobile networks and third-party websites may process personal data for their own purposes under their own privacy policies when you use their services.

2. Personal data we collect

The personal data we collect depends on whether you use Catholica anonymously, create an account, enable a feature, contact us or choose to share information.

• Account and contact data, including your email address, name, telephone number, profile image, language and Catholica account identifiers.
• Authentication and security data, including password hashes where you use email sign-in, identifiers from a sign-in provider, linked-provider details, sign-in dates and counts, session identifiers, refresh-session records, security tokens, account-confirmation information and account-recovery information.
• Preferences and settings, including timezone, parish selection or parish requests, display and prayer-bead preferences, commentary choices, notification preferences, routine settings and language choices.
• Prayer, routine and Bible activity, including prayer-library choices, prayer sessions and progress, intention selections, prayer history, Bible-reading activity, routine membership, routine schedules and related history.
• Content you create, including prayer-intention titles and descriptions, reflections where available, profile content, visibility choices, moderation status, archive status and other information you submit through Catholica.
• Social and sharing data, including prayer-circle or prayer-connection invitations, memberships, relationships, shared intentions, prayed-for activity, and the users with whom content is shared.
• Notification data, including device push tokens, device platform, notification preferences, delivery data, notification content and read status where an in-service notification feed is available.
• Technical, network and usage data, including IP address, which may indicate an approximate location, device and browser type, operating system, app version and build, network and request information, cookie or local-storage identifiers, error information, diagnostic and performance data, and security logs.
• Communications data, including support requests, privacy requests, account-deletion requests and other messages you send to us.

3. Data Catholica does not currently request

For the features described in this Policy, the Catholica mobile applications do not currently request access to your precise device location, contacts, camera or microphone, and Catholica does not currently use advertising identifiers for targeted advertising.

Your device, operating system, app store, sign-in provider or mobile network may independently collect device or usage information. Their collection is governed by their own settings and privacy information.

4. How we obtain personal data

We obtain personal data directly from you when you create or update an account, choose preferences, create content, join or use a prayer circle or connection, enable notifications, contact us or otherwise use Catholica.

We obtain limited data automatically from your device, browser and use of the Service, including through necessary cookies, application storage, server logs and error or performance monitoring.

We may obtain data from the sign-in provider you choose, from an app store or platform where needed to operate the app, and from another Catholica user when that user invites, connects with, mentions or shares information with you.

When you sign in through a third party, we may receive a provider-specific identifier and, depending on your provider settings, your email address, name or profile image. We do not receive the password you use with that provider.

5. Religious beliefs and other sensitive information

Your use of a Catholic service, parish selection, prayer activity, prayer intentions, prayer-circle or prayer-connection participation, reflections and similar choices may reveal religious or philosophical beliefs. Under UK and some other data-protection laws, this is sensitive or special category data and receives additional protection.

Prayer intentions, reflections and messages can also contain health information, family circumstances or other sensitive information about you or another person. Please provide only information that is reasonably needed for the feature and avoid including unnecessary sensitive information.

For processing that requires a special-category condition under UK law, we identify both an ordinary lawful basis and a separate special-category condition. Where required, we normally rely on your explicit consent. Explicit consent must be requested separately and clearly; merely accepting the Terms or generally using Catholica is not treated as explicit consent.

You may withdraw consent at any time through the relevant setting where available or by contacting legal@catholica.com. Withdrawal does not affect processing already carried out lawfully, but it may mean we must stop providing, remove or restrict the feature that needs the information.

Do not provide another person’s personal data unless you have a lawful reason to do so and their permission where required. If you make information public yourself, it may remain sensitive information even though you chose to publish it.

6. How and why we use personal data

We use personal data only for the purposes below and where we have a lawful basis. The basis may vary according to the feature, the data and the law that applies.

• To create and administer your account, authenticate you, link or unlink sign-in providers, maintain sessions and provide the features you request. We generally rely on performance of our contract with you.
• To synchronise and personalise prayer, Bible, routine, parish, audio, language and preference features across your devices. We generally rely on our contract with you and, for sensitive information, an additional condition such as explicit consent where required.
• To store and display content according to the visibility choices you make, operate prayer circles or connections, send invitations, record prayed-for activity and support reflections or moderation where available. We rely on our contract with you, our legitimate interests in operating safe sharing features and, where required for sensitive information, explicit consent or another lawful condition.
• To send account confirmation, password reset, email-change, security, service, legal and other essential communications. We rely on our contract, legal obligations and our legitimate interests in administering and protecting the Service.
• To send optional routine reminders, prayed-for alerts, push notifications or other notifications that you enable or permit. We rely on consent where required and otherwise on our contract with you.
• To provide support, respond to privacy requests, investigate faults, monitor availability and performance, prevent fraud or abuse, enforce our Terms, moderate content and protect Catholica, its users and others. We rely on our legitimate interests in running a reliable, safe and secure Service and in establishing, exercising or defending legal claims.
• To understand how features perform and improve Catholica using limited diagnostic, performance, usage, aggregated or de-identified information. We rely on our legitimate interests, while minimising the data used and obtaining consent where applicable law requires it.
• To comply with legal, regulatory, tax, accounting, court, law-enforcement or public-authority requirements. We rely on legal obligations or another basis permitted by law.
• To plan or complete a financing, reorganisation, merger, acquisition, sale or transfer of all or part of Catholica Ltd, subject to confidentiality and data-protection safeguards. We rely on our legitimate interests in managing our business.

7. Our legitimate interests

Where we rely on legitimate interests, those interests include keeping Catholica secure and available, preventing misuse, supporting users, improving performance and usability, administering the business, protecting legal rights and enabling carefully controlled product development.

Before relying on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights, expectations and the nature of the data. We apply additional care to children’s data and sensitive information. You may object to processing based on legitimate interests as explained in section 20.

8. Data you must provide and choices you can make

You may use public or anonymous features without creating an account where Catholica makes them available. An email address or supported sign-in-provider credential is required to create and secure an account. If you do not provide required account data, we cannot provide features that require sign-in, synchronisation, sharing or account recovery.

Profile details, telephone number, profile image, parish selection, prayer intentions, reflections, prayer circles or connections, routines, offline downloads and notifications are optional unless a particular feature clearly requires them. You can change many settings, remove optional content, disable notifications through Catholica or your device, unlink a sign-in provider where available and stop providing optional data.

9. Prayer connections, sharing and public content

When you join a prayer circle or connection, share a prayer intention, post a reflection or use another sharing feature, the information identified by the feature and its visibility setting is made available to the intended users. Your name, profile information or activity may also be shown so participants know who they are interacting with.

Content marked public, where that option is available, may be visible to anyone, including people without a Catholica account, and may be indexed, copied, quoted or redistributed. Public reflections may be reviewed by moderators before or after publication.

Choose visibility settings and notification content carefully. Other users may copy, save, screenshot or disclose information they can see, and Catholica cannot control what they do outside the Service. You can archive or delete content where the feature allows, but copies already made by another person, search-engine caches or external disclosures may remain.

If another user shares your personal data with Catholica, we process it to provide the requested invitation, connection, notification or sharing feature and to protect the Service. You may contact us if you believe someone has shared your data improperly.

10. Communications and notifications

We may send essential messages about account confirmation, password or email changes, security, service availability and material policy changes. You may not be able to opt out of messages that are necessary to administer or protect your account.

Optional routine reminders, prayed-for alerts and other notifications are sent only when the relevant feature, device token, setting or permission is enabled. You can change Catholica notification preferences, withdraw consent where applicable or disable push notifications in your device settings.

Push notifications are delivered through platform providers, including Google Firebase Cloud Messaging and the notification services used by Apple or Google devices. The provider receives the device token and the message data needed to deliver the notification.

A push notification may include a prayer-intention title, another user’s display name, a routine item or other content connected with the feature. Notification previews may be visible on a locked device or to anyone with access to it. Use your device settings to hide previews or disable notifications if this creates a privacy concern.

11. Cookies and information stored on your device

The website uses cookies or similar browser storage that are necessary for authentication, OAuth sign-in, security, session management, language and preferences. Where Web authentication uses a cookie, it is configured as an HttpOnly cookie so application JavaScript cannot read the refresh credential.

Catholica does not currently use non-essential advertising cookies or cross-site tracking cookies. If we introduce non-essential cookies or similar technologies, we will provide any notice and consent choice required by law before using them.

On iOS and Android, Catholica stores the native refresh token in protected operating-system storage. The app may also store settings, session progress, artwork and audio that you choose to download on your device. Web audio is streamed rather than managed as an offline download.

Clearing browser data, removing downloads, deleting app data or uninstalling the app may remove information stored only on that device. It does not automatically delete information held in your Catholica account.

12. When we share personal data

Catholica Ltd does not sell personal data, does not rent personal data and does not share personal data for cross-context behavioural advertising or targeted advertising based on activity across unrelated services.

We disclose personal data only as reasonably necessary for the purposes described in this Policy.

• Hosting, database, storage, content-delivery, network-security and media-delivery providers that operate Catholica.
• Email providers, currently including SendGrid for deployed account emails, and other communications providers used to deliver messages you request or that are necessary for your account.
• Push-notification providers, including Google Firebase Cloud Messaging and the relevant Apple or Google device-notification services, which process device tokens and notification content for delivery.
• Error, performance, logging and security providers, currently including Sentry for production server monitoring, which may receive request, network, diagnostic, error, trace or performance information according to our configuration.
• Authentication providers you choose. Depending on the platform and providers made available, these may include Apple, Google, Facebook, Microsoft, X, Telegram, Snapchat, Reddit or Pinterest.
• Other Catholica users and, for public content where available, the public, when you deliberately use an invitation, prayer-circle, prayer-connection, reflection or sharing feature.
• Professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies or public authorities where disclosure is lawful and necessary.
• A buyer, investor, lender or successor if Catholica Ltd is involved in a financing, reorganisation, merger, sale or transfer, subject to appropriate confidentiality and data-protection safeguards.

13. How service providers must protect data

Where a service provider acts as our processor, we require it by contract to process personal data only on documented instructions, use appropriate security, keep data confidential, control subprocessors, help with rights and deletion where required, and return or delete data when the service ends, subject to lawful retention.

Some third parties, such as sign-in providers, app stores, device platforms and public authorities, act as independent controllers for their own processing. Their privacy policies apply to that independent activity.

14. Sign-in providers, app stores and external services

A sign-in provider processes information about your use of its sign-in service and may know that you signed in to Catholica. Review that provider’s privacy information and account permissions. You can remove a provider from your Catholica account where that feature is available, but removing it does not automatically delete information held independently by the provider.

Apple App Store, Google Play, your device manufacturer or mobile network may separately process information about downloading, installing, updating and using the app. Catholica Ltd does not control personal data collected independently by those services.

Catholica may contain links to external content or services. This Policy does not cover a third party’s own processing when you leave Catholica or interact directly with that third party.

15. International transfers

Catholica Ltd is established in the United Kingdom and offers Catholica internationally. Our service providers, sign-in providers and other recipients may process personal data in the United Kingdom, the European Economic Area, the United States and other countries where they or their approved subprocessors operate.

Privacy laws in those countries may differ from the law where you live. Where a transfer is restricted by applicable data-protection law, we use an approved transfer mechanism where required, such as an adequacy regulation or decision, the UK International Data Transfer Agreement or UK Addendum, European Commission standard contractual clauses, or another lawful safeguard. We also carry out any transfer-risk assessment and adopt supplementary measures required by law.

You can contact legal@catholica.com for more information about safeguards relevant to your personal data or to request a copy of the relevant safeguard, subject to lawful redactions.

16. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing Catholica, meeting legal obligations, resolving disputes, enforcing agreements and protecting the Service. We consider the amount, sensitivity and risk of the data, the purpose, whether we can achieve the purpose another way and applicable legal requirements.

Account details, preferences, linked providers and account content are generally kept while your account is active and are deleted or irreversibly anonymised after account deletion, subject to the exceptions below. Content you delete may remain briefly in caches and until scheduled backup deletion.

Device push tokens are kept until you unregister them, they become invalid, your account is deleted or they are no longer needed. Authentication sessions and recovery or confirmation tokens expire, rotate or are revoked according to their security purpose. Consumed token digests or limited security records may be kept for a period needed to detect replay, fraud or abuse.

Security, diagnostic, monitoring and support records are kept on a rolling or event-based schedule for the period needed to investigate incidents, maintain reliability and establish, exercise or defend legal claims. Provider-side retention may also apply according to our configuration and contracts.

Backups are deleted through scheduled retention cycles and may not be removed immediately from every backup copy. We do not restore deleted data for ordinary use merely because it remains in a backup.

We may retain limited information for longer where required by law, necessary to prevent fraud or abuse, needed to respond to a regulator or required for legal claims. Where possible, we minimise, separate or anonymise that information.

17. How we protect personal data

We use technical and organisational measures designed to protect personal data. These include encrypted network connections, access controls, password hashing, protected native token storage, HttpOnly browser credentials, expiring and revocable per-device sessions, security monitoring, restricted administration and controls intended to keep authentication credentials out of public account responses.

We review access and security measures in light of the nature of the data, including religious and other sensitive information. Where service providers act for us as processors, we select providers that can give appropriate protection and require contractual data-protection safeguards.

No website, application, transmission or storage system is completely secure. Use a strong and unique password where password sign-in is available, protect access to your device, review lock-screen notification settings and contact legal@catholica.com promptly if you believe your account or personal data has been compromised.

If a personal-data breach creates a risk requiring notification, we will notify the relevant regulator and affected individuals within the period required by applicable law.

18. Aggregated and de-identified information

We may create statistics, aggregated information or de-identified information from personal data for security, service measurement, research and product improvement. We use reasonable measures intended to prevent this information from identifying you and do not attempt to re-identify it except to test whether de-identification is effective or where law permits.

Information that is genuinely anonymous and cannot reasonably identify a person is not personal data. If we combine it with data that can identify you, we treat the combined information as personal data.

19. Automated decision-making

Catholica does not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects for you, and does not use sensitive personal data for such decisions.

Catholica may use ordinary automation to authenticate requests, detect security events, schedule reminders, order content or provide preferences. These operations do not make legal or similarly significant decisions about you. If this changes, we will provide the information and safeguards required by law before that processing begins.

20. Your privacy rights

Depending on where you live and the basis on which we process your data, you may have rights to be informed, access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing, receive portable data and withdraw consent.

Your right to object is especially relevant where we rely on legitimate interests. You can object by emailing legal@catholica.com and explaining the processing you want us to stop. You may also object to direct marketing at any time; Catholica does not currently use personal data for third-party behavioural advertising.

Withdrawing consent does not affect processing carried out before withdrawal. Some rights are not absolute, and we may need to retain or continue using information where law permits or requires it.

To exercise a right, ask a privacy question or make a complaint, email legal@catholica.com. We may need to verify your identity, confirm your authority where you act for another person and clarify your request. We normally respond within one month under UK law, subject to any lawful extension, and within the period required by any other law that applies. We do not ordinarily charge a fee.

21. Additional information for United States residents

This section applies only where a United States state privacy law applies to Catholica Ltd and gives you the relevant right. Terms such as personal information, sensitive personal information, sale, sharing and targeted advertising have the meanings given by the applicable law.

During the preceding 12 months, Catholica may have collected the categories described in section 2: identifiers and contact information; account credentials and security information; internet or electronic network activity; device and diagnostic information; preferences and activity; user-generated content; social or sharing information; approximate location inferred from IP address; communications; and sensitive information such as account credentials, religious or philosophical beliefs, prayer content and health information you choose to include.

We obtain those categories from the sources described in section 4, use them for the purposes described in sections 6 and 7, and disclose them to the recipient categories described in sections 9 to 14. We retain them as described in section 16.

Catholica has not sold personal information for money and has not sold or shared personal information for cross-context behavioural advertising during the preceding 12 months. We do not use sensitive personal information to infer characteristics about you for advertising, and we do not offer financial incentives in exchange for personal information.

Where applicable, you may have rights to know or confirm processing, access categories or specific pieces of personal information, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising or qualifying profiling, limit certain uses of sensitive personal information, and appeal a decision. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Because we do not currently sell or share personal information for cross-context behavioural advertising, an opt-out preference signal such as Global Privacy Control does not change our current practices. Where applicable law requires recognition of such a signal, we will honour it.

You or an authorised agent may submit a request to legal@catholica.com. We may verify your identity and the agent’s authority. If we deny an appealable request, you may appeal by replying to our decision and stating that you wish to appeal.

22. Account deletion

You can request deletion of your Catholica account and associated personal data by emailing legal@catholica.com from the email address connected with your account. Where Catholica provides an account-deletion control, you may also use that control. This section is intended to provide an external web route for account-deletion requests even if you no longer have the app.

After verifying the request, we will delete or irreversibly anonymise personal data associated with the account and ask relevant processors to do the same, unless we must retain limited information for security, fraud prevention, legal claims, regulatory compliance or another lawful reason.

Deleting the app, clearing app data, signing out or closing a sign-in-provider account does not by itself delete your Catholica account. Removing your Catholica account does not require you to close the independent account you hold with a sign-in provider.

Information copied by another user, disclosed outside Catholica or stored in an external notification may remain outside our control. Public content will be removed from Catholica where reasonably possible, but temporary caches or search-engine copies may persist.

23. Children

Catholica is a general-audience religious service and may include content of interest to families. Children’s personal data deserves specific protection, particularly because prayer activity and content may reveal sensitive information.

A child who is not old enough to consent to the use of an online service under the law where they live should not create an account or submit personal data without the involvement and authorisation of a parent or guardian where required. In the United Kingdom, parental authorisation is required for a child under 13 where consent is the lawful basis for an online service.

We do not knowingly seek to collect a child’s personal data in breach of applicable law, sell children’s data, use it for targeted advertising or make significant automated decisions about children. We ask children and parents to avoid putting unnecessary personal or sensitive information into prayer intentions, reflections or public content.

A parent or guardian who believes a child has provided personal data without the required permission can contact legal@catholica.com to request review, correction or deletion. We may take reasonable steps to verify the requester’s identity and relationship to the child.

24. Complaints

Please contact us first at legal@catholica.com so we can investigate and try to resolve your concern. We will handle privacy complaints fairly and respond within the period required by applicable law.

Because Catholica Ltd is established in the United Kingdom, you may complain to the UK Information Commissioner’s Office at ico.org.uk. If you live elsewhere, you may also have the right to complain to the data-protection, privacy or consumer-protection authority in your country or region.

25. Changes to this Policy

We may update this Policy when Catholica, our service providers, the law or our data practices change.

We will publish the updated Policy with a new effective date and provide additional notice where required, including before a material new use of personal data begins or where a change materially affects your rights.

We keep our app-store privacy disclosures and Google Play Data safety information under review and aim to keep them consistent with this Policy and the actual behaviour of the website and mobile applications.

26. Contact Catholica Ltd

Catholica Ltd is registered in England and Wales under company number 16096313.

Privacy questions, rights requests, consent withdrawals, account-deletion requests and complaints can be sent to legal@catholica.com.