Privacy policy

Who is responsible for your data

Lectio Daily (lectiodaily.com) is an independent project. Whoever maintains it is responsible for the data described here, and you can write to privacy@lectiodaily.com.

What we store

Only what the app needs to work:

• Your account: name and email address. If you sign up with a password it is stored hashed, never in the clear — nobody, us included, can read it.
• If you sign in with Google: the identifier that service assigns you, the permissions you granted, and the basic profile it hands us (name, email and picture). We never see your Google password.
• Your reading: which chapters you mark as read, where you left off, your streak, your daily goal, your time zone and your language.
• What you write: bookmarks, highlighted verses, notes and prayer requests. It is yours, it is private, and it is shared with nobody.
• Groups: if you create or join one, its name, its join code and who belongs to it.
• Notifications: if you turn them on, your preferences, the hour you want them, and — for push notifications — the delivery address your browser generates.
• Sessions: when you sign in we store the IP address and browser you used, so you can review and revoke open sessions from your account.
• Abuse protection: we use your IP address briefly to rate-limit bulk sign-up and sign-in attempts. Those counters are deleted within minutes.
• An internal identifier reserved for future purchases inside the mobile apps. It is unused today.

What we use it for

We do not use your data for advertising, we do not sell it, and we do not hand it to anyone to profile you.

• So your progress, notes and streak follow you from one device to another.
• To send the emails you ask for: verifying your address, resetting your password and, if you enable them, the daily or weekly summaries.
• To protect the site from automated sign-ups and abuse.
• To know how many people use the site. We count the days each account was active; we do not follow your browsing or build a profile of you.

Who it is shared with

We use no third-party analytics, no ad networks and no tracking pixels. No third-party script measures your visit.

• Cloudflare: hosts the site, the database and the images. All data lives on their infrastructure.
• Cloudflare Turnstile: checks that whoever signs up is not a bot. It receives your IP address and signals from your browser.
• Cloudflare Email Service: delivers the emails we send you.
• Google, only if you choose to sign in with it: it hands us your name, email and profile picture. Their own policy governs what they do.
• Your browser's notification service (Google, Mozilla or Apple, depending which you use): it receives the already-encrypted message in order to deliver it, if you enable push notifications.

Cookies and data in your browser

None of that leaves your device, and all of it disappears if you clear your browser data. On a shared computer, sign out — that is what removes the local copy. There are no advertising or third-party cookies — which is also why you will not see a cookie banner: we do nothing that requires asking your permission.

• One session cookie, to keep you signed in. It cannot be read from JavaScript and cannot be used to follow you across other sites.
• Preferences kept on your device: light or dark theme, the reading typeface and size, where you were reading, and a "signed in" marker used to render the page without waiting for the network.
• A copy of your data, on your own device: once you sign in we keep a copy there of what is already in your account — progress, bookmarks, highlights, notes and prayers — so the app opens instantly and keeps working offline. Signing out deletes all of it.

How long we keep it

• While your account is open, we keep your data so we can give it back to you every time you sign in.
• Sessions expire on their own after a while.
• Abuse-protection counters are deleted within minutes.
• If you delete your account, everything attached to it is deleted immediately and in cascade.

How to delete your account and your data

Write to privacy@lectiodaily.com from the email address you registered with and ask us to delete it. We process it within 30 days at the latest and confirm when it is done.

Deletion covers everything: your profile, your reading progress, your notes, your prayers, your bookmarks, your highlights, any groups you created, and your notification subscriptions. It is final — there is no trash and no backup we could restore afterwards.

If you signed in with Google, deleting your account here deletes nothing at Google. That is handled from your Google account settings.

Your rights

You can ask us for a copy of your data, have it corrected if it is wrong, or have it deleted. Write to us and we will sort it out; you do not need to explain why.

Children

Lectio Daily is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has given us theirs, write to us and we will delete it.

Changes to this policy

If it changes, we update the date at the bottom of this page. If a change affects you significantly, we will tell you by email.

Contact

For anything to do with your data: privacy@lectiodaily.com