Privacy Policy

1. Introduction

This Privacy Policy explains how Nosa Studio ("we", "us", "our") handles personal data when you use the Erstmal Beten mobile application ("the App", bundle identifier studio.nosa.erstmalbeten) for iOS and Android, distributed via the Apple App Store and Google Play. The App is developed and operated by Slaven Grubisic / Nosa Studio in Basel, Switzerland. We comply with the EU General Data Protection Regulation (GDPR) for users in the European Economic Area as well as the Swiss Federal Act on Data Protection (revFADP) for users in Switzerland.

The App is designed with privacy in mind: no account is required, no contact data is read, and the spiritual data you generate (prayer streak, jurisdiction preference, settings) stays on your device. We do not sell, rent, or share your personal data with third parties for marketing or advertising.

The App is available in 14 languages: German (DE), English (EN), French (FR), Italian (IT), Spanish (ES), Portuguese (PT), Croatian (HR), Polish (PL), Romanian (RO), Russian (RU), Ukrainian (UK), Greek (GR), Serbian (SR), and Bulgarian (BG). This Privacy Policy is provided in English; in case of discrepancy, the English version prevails.

2. Data We Collect

2.1 On-device data (never leaves your device)

The following data is created and used entirely on your device and is never transmitted to any server:

• Prayer streak — a daily counter that records whether you marked your prayer rule as complete. Stored only in the App's local database.
• Jurisdiction / language preference — your choice during onboarding (e.g. Catholic / Protestant) and the App's UI language.
• Settings — notification preferences, prayer-time choices, and other in-app preferences.
• App-blocker selection — the list of apps you choose to block during your prayer rule (iOS only — see Section 2.4).

All of the above is removed when you uninstall the App or clear its data.

2.2 In-app purchase data (RevenueCat + the store)

When you subscribe to the premium tier or make a one-time purchase, the transaction is processed by the platform store (Apple App Store on iOS, Google Play Billing on Android). We use RevenueCat as a subscription-management processor: it receives an anonymous customer identifier and the purchase tokens issued by Apple / Google so the App can verify your subscription status across devices that share the same store account. We do not see or store your payment card details, name, email address, or billing address.

2.3 Anonymous usage analytics (PostHog EU Cloud)

The App uses PostHog hosted on EU Cloud (Frankfurt) to collect anonymous usage analytics that help us understand which features are used and where users encounter issues. The PostHog integration is configured for GDPR compliance:

• No IP address is recorded.
• No personally identifying information is sent (no names, no email addresses, no contact data, no precise location).
• Each install is identified only by a randomly generated identifier, reset when the App's data is cleared or the App is uninstalled.
• Data is stored on PostHog's EU infrastructure and never leaves the EU.

Examples of events we may collect:

• Onboarding completion
• Selected jurisdiction / language
• Anonymous feature interaction counters (e.g. "prayer completed")
• Anonymous paywall conversion events
• Crash and error diagnostics

2.4 App-blocker feature (iOS only — Apple Family Controls)

The App offers a voluntary self-control tool that lets you choose certain apps to be temporarily blocked while you complete your prayer rule. This feature is built entirely on Apple's official Family Controls / Managed Settings framework. The list of apps you select is stored in an Apple-managed, opaque token on your device only — it is never sent to our servers and we never see which specific apps you chose. The block is voluntary and can be cancelled at any time. No equivalent feature is currently available on Android.

3. How We Use Data

• To provide the core features: rendering daily devotionals, prayer rules, and the on-device prayer-streak counter.
• To verify purchases: processing the platform store's purchase tokens (via RevenueCat) to enable premium features for paying users.
• To improve the App: analyzing aggregated, anonymous usage patterns to fix bugs and prioritize features.

4. Third-Party Services

The App relies on the following processors:

4.1 Apple App Store / Google Play

Apple Inc. (iOS) and Google LLC / Google Ireland Ltd (Android) handle app distribution, in-app purchase processing, and subscription management. Their processing of your payment and account information is governed by their respective privacy policies: apple.com/legal/privacy and policies.google.com/privacy.

4.2 RevenueCat (RevenueCat Inc.)

RevenueCat is our subscription-management processor. It receives anonymous customer identifiers and purchase tokens from Apple / Google to keep your subscription status consistent across devices that share the same store account. RevenueCat does not receive your name, email, or payment card details. RevenueCat's privacy policy is available at: revenuecat.com/privacy.

4.3 PostHog (PostHog Inc., EU Cloud)

PostHog is the analytics provider we use for anonymous product analytics and crash diagnostics. Our instance is hosted on PostHog EU Cloud (Frankfurt), is configured without IP collection, and stores no personally identifying information. PostHog's privacy policy is available at: posthog.com/privacy.

5. Data Retention

• On-device data (prayer streak, settings, app-blocker selection): kept on your device until you clear the App's data or uninstall the App.
• Subscription / purchase tokens: retained by RevenueCat and the platform store for as long as your subscription is active, and for up to 24 months thereafter for accounting and audit purposes.
• Anonymous analytics: retained by PostHog for up to 12 months, then aggregated or deleted.

6. Your Rights (GDPR / revFADP)

If you are located in the EEA, the UK, or Switzerland, you have the following rights regarding your personal data:

• Right of access — to confirm whether we process your data and obtain a copy.
• Right to rectification — to correct inaccurate data we hold about you.
• Right to erasure ("right to be forgotten") — to request deletion of your data.
• Right to restriction of processing — to limit how we process your data.
• Right to data portability — to receive your data in a machine-readable format.
• Right to object — to processing based on legitimate interests.
• Right to withdraw consent — at any time, where processing is based on consent.
• Right to lodge a complaint — with a supervisory authority. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local Data Protection Authority.

Because the App does not require an account and does not transmit identifying data off your device, the most direct way to exercise erasure is to uninstall the App or clear its data in iOS / Android system settings. For other rights, or if you want a record of any analytics events associated with your install, contact us at the address below.

7. Children's Privacy

The App is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has used the App in a way that resulted in data being collected, please contact us so we can remove the relevant data.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App's release notes on the App Store and Google Play, and/or via an in-app notice. The "Last updated" date at the top of this document reflects the most recent revision. The canonical URL of this policy is legal.nosa.studio/erstmalbeten/.

9. Contact Us

For data-protection requests (access, correction, deletion, portability, objection), please include "Privacy Request — Erstmal Beten" in the subject line and let us know which right you are exercising. We aim to respond within 30 days.