Privacy Policy

The short version

• There are no accounts. We don't ask for your name, email or phone number.
• Your conversations, optional memory profile and settings are stored on your phone. We don't keep your conversations on our servers.
• To answer you, your message and recent conversation history pass through our server to OpenAI, our AI provider. OpenAI doesn't use them to train its models and keeps them for no more than 30 days to detect abuse.
• Memory is off by default. It only runs if you switch it on, and you can switch it off and delete what it learned at any time.
• Voice recordings are turned into text and then deleted. We don't store them.
• Every message is checked automatically for signs that you may be at risk of harm, so we can show crisis support.
• No ads, no cross-app tracking, and we never sell your data.
• You can delete everything on your device from the app's settings with Delete Everything.

Who we are

BibleSpeak is provided by HAMPTON.IO LTD, a company registered in England and Wales (company number 15728356), whose registered office is at 139 Old Station Road, Solihull, West Midlands, B92 0HE, United Kingdom. We are the controller of the personal data described in this policy, which means we decide how and why it is used.

For any privacy question or request, email support@hampton.io. In this policy, "we", "us" and "our" mean HAMPTON.IO LTD.

Who BibleSpeak is for

BibleSpeak is for adults aged 18 and over. The app asks you to confirm that you are 18 or older before you can use it. See Children below.

What we process, why, and our legal basis

The legal bases below come from the UK GDPR and, for users in the European Economic Area, the EU GDPR.

Messages and conversation history

What: the messages you send and the replies you receive. With each new message, the app also sends your most recent messages from that conversation so the AI can follow it.

Why: to generate a reply. Our server passes the request to OpenAI and returns the reply to your phone. We don't store message content on our servers or write it to our logs.

Legal basis: performance of our contract with you (Article 6(1)(b)). Messages in a faith app often reveal religious beliefs, and sometimes health or other sensitive details. We process that information only with your explicit consent (Article 9(2)(a)), which you give when you accept the notice shown the first time you open the app, before anything is sent. See Religious beliefs and other sensitive information.

Personalised memory (optional)

What: if you switch memory on, the app builds a profile from your conversations. It can include your name, occupation, location, family situation, faith background and denomination, how long you've been a person of faith, favourite books and verses, current studies, prayer requests, struggles, areas you want to grow in, interests, challenges, conversation summaries and common topics, and your preferred reply style and Bible translation. You can also type or edit these details yourself. The profile doesn't include your age.

How: every few messages, the app sends recent messages to our server, which asks OpenAI to pick out these details. The result is stored on your phone. While memory is on, relevant profile details are sent with your messages so replies can be more personal, and are used to create a greeting and suggested topics. Prayer requests and struggles may include health or other sensitive information. Nothing is added to your profile from recent messages that our safety checks flag for self-harm.

Legal basis: your consent (Article 6(1)(a)) and your explicit consent for religious and other special category information (Article 9(2)(a)). You give this with the separate memory switch, which is off by default. Memory is available on every plan and you never have to use it.

Your control: you can view and edit the profile in Settings. Turning memory off stops all analysis immediately, stops profile details being sent, and offers to delete the stored profile.

Voice input (Premium)

What: a short audio recording of your voice (up to 60 seconds) when you tap the microphone.

How: the recording is uploaded to our server and passed to OpenAI to turn it into text. The text comes back to the app so you can check it before sending. The recording is deleted from your phone as soon as transcription finishes, and our server doesn't store it. We don't use your voice to identify you. Voice input currently works in English.

Legal basis: as for messages: contract (Article 6(1)(b)) and, for any sensitive information you speak, your explicit consent (Article 9(2)(a)). The app asks for microphone permission, and you can withdraw it in your phone's settings.

Spoken replies (Premium)

When you ask the app to read a reply aloud, the text of that reply is sent through our server to OpenAI to create the audio. The voices are AI-generated, not recordings of real people. If audio caching is on, the audio file is saved on your phone so it can be replayed. If caching is off, it is deleted after it plays. Legal basis: contract (Article 6(1)(b)).

Reports about AI replies

What: if you report a reply, we receive the text of that reply, the reason you chose (offensive, harmful, misquoted Scripture or other), any note you add, the time, the app version, your platform and a one-way hashed form of your app ID. If you are offline, the report waits on your phone and is sent later.

Why: to review problems with replies and improve accuracy and safety.

Legal basis: our legitimate interests in checking and improving the quality and safety of the service and meeting app store rules on AI content (Article 6(1)(f)). If the report contains sensitive information, we rely on the explicit consent you give by choosing to send it (Article 9(2)(a)). Please don't include details that identify you or others in the note.

Purchases and subscription status

What: whether you have Premium, which product you bought, when it started, renews or ends, and the store country and currency. Purchases are made through Google Play; we never see your payment details. The app and our server check your status with RevenueCat using an anonymous app user ID.

Legal basis: contract (Article 6(1)(b)), and legal obligation (Article 6(1)(c)) for accounting and tax records.

Technical, security and usage-limit data

With each request to our server, the app sends and our server uses:

• A random app ID: either the anonymous ID created by RevenueCat or a random ID created by the app when it is first installed. It isn't linked to your name, email or Google account.
• App version and platform (for example, 1.1.0 on Android), so we can keep older versions working and tell you when an update is needed.
• Your IP address, which your connection reveals to any server. We use it for rate limits, which protect the service from abuse.
• Your approximate country, which our host works out from your IP address. We use it only to show crisis resources for your region, and we don't store it.

Using the app ID, our server keeps short-lived counters for rate limits, counts free messages each day, records when your free trial started so it runs only once, and briefly caches your Premium status. We also send OpenAI a safety identifier: a one-way hash of your app ID (or IP address) that lets OpenAI spot abuse without knowing who you are. Our server logs record only technical details such as the route, status, time taken, app version, AI model, amount of text processed and which safety categories, if any, were flagged. They never record what you wrote, and they don't include your app ID.

Legal basis: our legitimate interests in keeping the service secure, preventing abuse, controlling costs and applying plan limits fairly (Article 6(1)(f)). You can object; see Your rights.

Safety checks

Every message, including text transcribed from voice, is checked by OpenAI's automated moderation model before a reply is generated. Replies are checked too. If a message suggests a risk of self-harm, the app shows crisis support instead of a normal reply. We keep only a monthly total of how often this happens, with no message content or identifiers. Read more on our Safety page.

Legal basis: our legitimate interests in protecting users and meeting the legal duties that apply to AI chat services (Article 6(1)(f)), together with your explicit consent for any sensitive information (Article 9(2)(a)).

App updates

The app checks with Expo for updates when it starts, and occasionally when you return to it. Legal basis: our legitimate interests in delivering fixes and security updates (Article 6(1)(f)).

This website

This website doesn't use cookies, analytics or advertising. Like any website, our host (Vercel) processes your IP address and request details to deliver pages and protect the site. Legal basis: legitimate interests (Article 6(1)(f)).

If you email us

We use your email address and message to reply and to deal with your request. Legal basis: legitimate interests (Article 6(1)(f)), or legal obligation when you exercise your data rights (Article 6(1)(c)).

Data stored on your device

These are stored in the app's private storage on your phone, and we can't access them:

• your conversations (up to the most recent 200 messages in each conversation);
• your memory profile, conversation summaries and topics, if memory is on;
• your choices from the first-run notice, including your age confirmation and memory setting;
• settings such as voice, reply style and audio caching;
• your plan, trial start time and today's message count;
• cached audio of replies you have played, if audio caching is on;
• the random app ID, and any reports waiting to be sent.

The app opts out of Android backup and device-to-device transfer, so this data isn't copied to your Google account or to a new phone. Reinstalling the app or moving to a new phone starts with an empty app, and your saved conversations and memory profile can't be restored. Anyone who can unlock your phone can open the app, so use a screen lock.

Religious beliefs and other sensitive information

Information about your religious or philosophical beliefs, health, sex life or sexual orientation, and some other categories is "special category data" under data protection law. Using a Bible conversation app will usually reveal something about your beliefs, and you may choose to share other sensitive details.

• We process this information only to provide the features you use, with your explicit consent: for messages and voice, the consent you give on the first-run notice; for memory, the separate memory switch.
• We never use it for advertising, and we never sell or share it for anyone else's purposes.
• You can withdraw consent at any time. Switch memory off in Settings to stop profiling, and use Delete Everything to remove what is stored on your phone. To stop all processing, stop using the app and uninstall it. Withdrawing consent doesn't affect processing already carried out.

Automated processing and profiling

Replies are generated automatically by AI. If you switch memory on, the app builds a profile of you automatically to personalise replies; this is profiling. Safety checks are also automated. None of this produces legal or similarly significant effects on you: no decisions about you are made from it, and the profile stays on your phone. Automated checks can be wrong, which is one reason we explain their limits on the Safety page.

Service providers and other recipients

We use the following providers to run BibleSpeak. Processors act only on our instructions under data processing terms.

We may also forward new reports to a private notification channel that we control, so we see them promptly. We may disclose data if the law requires it, to protect someone's safety, or to establish or defend legal claims. If BibleSpeak is ever sold or transferred, its data would pass to the new owner under this policy, and we would tell you first.

We don't sell personal data, share it for advertising, or use advertising or analytics SDKs.

International transfers

We are based in the United Kingdom. Our providers process data in the United States and may use other countries. When personal data leaves the UK (or the European Economic Area) for a country without an adequacy decision, it is protected by one of these safeguards, as set out in each provider's data processing terms:

• the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), where the provider is certified;
• the UK International Data Transfer Agreement (IDTA), or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
• for data from the European Economic Area, the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

You can ask us for more information about these safeguards using the contact details below.

How long we keep data

• Data on your phone: until you delete it (a single conversation, Delete Everything, or the memory profile when you switch memory off) or uninstall the app.
• Message content on our servers: not stored. It is held in memory only while a reply is generated, and is never written to our logs.
• OpenAI: up to 30 days for abuse monitoring, then deleted unless the law requires otherwise.
• Voice recordings: deleted from your phone as soon as transcription ends. We don't store them; OpenAI as above.
• Server logs (Vercel): technical metadata and IP addresses, kept for no more than 30 days.
• Rate-limit counters: expire automatically within two hours.
• Daily free-message count: expires automatically after two days.
• Cached Premium status: five minutes.
• Trial start record (random app ID and a timestamp only): deleted automatically after 400 days. We keep it that long so that a trial can't be restarted.
• Reports: kept so we can review and act on them. Our database holds only the 5,000 most recent reports, and older ones are deleted automatically as new ones arrive. We delete a report sooner if you ask us to (see Your rights).
• Crisis-support totals: monthly counts with no personal data, kept for reporting on our safety protocol.
• Purchase records (Google Play and RevenueCat): while your subscription is active, then as long as needed for tax and accounting law (usually six years) and to handle refunds or disputes.
• Emails to us: until your request is resolved, then up to two years in case you follow up.

Security

All traffic between the app, our server and our providers is encrypted with HTTPS. Secret keys for our providers are kept on our server, not in the app. We collect as little as we can, keep message content out of our logs, and limit access to our systems to the people who run BibleSpeak. No system is perfectly secure; if a breach affects your data, we will tell you and the regulator where the law requires it.

Your rights and how to delete your data

You have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• have your data deleted;
• restrict or object to our processing, including processing based on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, without affecting processing already done;
• complain to a data protection regulator (see Contact and complaints).

Doing it yourself in the app

Because most of your data is on your phone, you can manage it directly:

• See and edit your memory profile: Settings.
• Stop profiling: switch memory off in Settings and choose to delete the profile.
• Delete one conversation: from the conversation list.
• Delete everything: Settings, then Delete Everything. This removes your conversations, memory profile and cached audio from the phone. It keeps your first-run choices and your plan and trial status, so that deleting data doesn't restart the free trial.
• Remove all app data: uninstall the app, or clear its storage in Android settings.
• Cancel a subscription: in Google Play, under Payments & subscriptions. Deleting data or uninstalling does not cancel a subscription.

Data on our servers and with our providers

We hold very little on our servers, and none of it includes your name or contact details. To make a request about it, email support@hampton.io. Because there are no accounts, we may need your help to find your records: for reports, tell us roughly when you sent them and what they said; for purchase records, send the Google Play order number (it starts with "GPA."). We reply within one month. We won't ask for more information than we need to confirm the records relate to you.

Children

BibleSpeak is for adults aged 18 and over, and it may not be suitable for some minors. The app asks every user to confirm they are 18 or older before first use, and we don't knowingly process children's data. If you believe a child has used BibleSpeak, delete the app's data from Settings or uninstall it, and contact us about any report they may have sent, and we will delete it.

Notice for US residents

We don't sell personal information or share it for cross-context behavioural advertising, and we use sensitive personal information only to provide the service you ask for. The categories we process are described above: identifiers (random app ID, IP address), commercial information (subscription status), audio (voice recordings, briefly), sensitive personal information (such as religious beliefs you choose to share) and inferences (the optional memory profile, stored on your phone). Depending on your state, you may have rights to know, correct and delete this information. Contact us to use them; we won't treat you differently for doing so.

Older versions of the app

Version 1.0.0 of the app, released in October 2025, worked differently. It analysed conversations and sent a stored profile automatically, without a separate memory switch or first-run consent. Our server now applies the protections in this policy to every version, but the on-device controls described here, including the memory switch, need version 1.1.0 or later. Please update from Google Play.

Version 1.0.0 also didn't opt out of Android backup, so if your phone backs up to your Google account, a backup made while you used that version may still contain its app data until Google replaces or removes it. Google manages those backups and we can't access them. Version 1.1.0 doesn't restore from them, and you can delete device backups from your Google account.

Changes to this policy

We will update this policy when the app or the law changes, and change the date at the top. If a change affects how we use your data in a significant way, we will tell you in the app before it takes effect and ask for your consent again where the law requires it.

Contact and complaints

HAMPTON.IO LTD
139 Old Station Road, Solihull, West Midlands, B92 0HE, United Kingdom
Email: support@hampton.io

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area, you can complain to the data protection authority in your country.

See also our Terms of Use and Safety page.