Privacy Policy

Who runs Koinonia

Koinonia is built and operated from Romania. Everything below is the practice of this one app, not a template. Write to [email protected] with any question about your data, and you will get a person rather than a form.

What Koinonia keeps about you

Your account: your email address, the name you chose, and your password. The password is never stored. What is stored is a bcrypt hash of it, which cannot be turned back into the password, so nobody at Koinonia can read it or tell you what it is.

If you sign in with Google: Google tells Koinonia your name, your email address, and an identifier for your Google account, and nothing else. The identifier is kept so the same Google account finds the same Koinonia account next time. Your Google password, your contacts and everything else in your Google account are never seen, and no Google access token is kept, so Koinonia cannot reach into your Google account afterwards. An account made this way has no password here at all.

What you tell it on the way in: your denomination, your role in your church if you gave one, what you are hoping for, how often you read, how well you know Scripture already, and anything you wrote about what you are struggling with. This is used for one thing, which is knowing where to start with you. In European law this counts as data about religious belief, and it is treated as the sensitive thing it is: it is never sold, and it leaves this server only in one way, alongside the messages you send the assistant, so that it knows where to start with you. What happens to it there is set out under “Who else sees your data”.

What you study: which chapters you opened and when, your highlights, your notes, your journal entries, your bookmarks, your reading plans, your quiz answers, and the daily record that produces your streak.

What you write to the assistant: every message you send it, and every answer it sends back, kept so a conversation is still there tomorrow.

Anything you make: your documents, and your posts.

The feed: everything you post there, any photograph you attach to a post, any study you attach to a post, which posts you have said amen to, any report you make about a post, and anybody you have blocked. A post carries your name and your picture, and a post is public to everybody signed in to Koinonia. A study attached to a post is a copy of it as it was when you posted: changing or deleting your own document afterwards does not change the copy, and deleting the post deletes it.

Your picture, if you set one. It is stored on this server, resized, and served to anybody who can see a post of yours.

If you subscribe: which plan, when the period started and ends, and a count of messages used. Card details are never seen by this app and never touch this server.

What Koinonia does not do

There are no adverts in this app and no advertising network in it. Nothing about you is sold, rented, or handed to a data broker, at any price.

There is no analytics kit. No Google Analytics, no Firebase Analytics, no Sentry, no Facebook SDK, no third party tracker of any description. Nobody is watching which button you pressed. The Android app carries one part of Firebase, Cloud Messaging, and only to deliver the notifications you switch on; until you do, it does not register your phone.

Your location is never requested and never recorded. The app asks for no advertising identifier, no contacts, no calendar, no files, and no phone state.

Koinonia does not use your Bible study to train a model, and does not sell it or license it to anybody who would. The company whose model answers the assistant is another matter, and it is said plainly under “Who else sees your data”: what is sent to it may be used to improve its models.

Pictures you upload

A photograph you attach to a post, or set as your picture, is decoded on this server and written out again as a new file. Only that new file is kept; the one you sent is never stored.

That matters for one reason above all. A photograph taken on a phone carries hidden information with it, and the most serious of it is the exact latitude and longitude where it was taken. Somebody posting a picture of their open Bible has not agreed to publish the address of the room they were sitting in. Re-encoding the picture throws all of that away, along with the make and model of the phone, the date, and everything else the camera wrote into the file.

Pictures are served publicly, without a session check, because a picture on a post has to be visible to everybody who can see the post. Each one is named after a fingerprint of its own contents, so the address of a picture cannot be guessed and does not identify you.

The camera and the microphone

The camera is never used and never asked for. The Android app does not even declare the permission, so the request cannot be made.

The microphone is asked for in one place: dictation, when you choose to speak a question to the assistant instead of typing it, and only at the moment you press it. Every other part of the app runs without ever asking, and everything in it can be done by typing.

Speech is turned into words as you speak and the words become your question. No recording is made, on the phone or on this server, and Koinonia stores no sound at any point. The sound itself goes, as you speak, to the company that turns it into words (named below). When you stop speaking there is nothing left here but the text you can see.

Notifications

Notifications are off until you switch them on, on each phone or browser separately, and your phone or browser asks you first. They are a reminder to read and to study each day, and now and then a message from Koinonia to everybody. They are never used to advertise.

To reach a device, Koinonia keeps the address its push service gave it: a registration token on an Android phone, a push subscription in a browser. It also keeps the language the device was last used in, so a notification arrives in it, and your time zone, so a reminder chosen for eight in the morning comes at eight where you are. Neither the token nor the subscription says anything about you, and neither can be used by anyone but this server.

Your reminder times and switches are kept with your account, so they follow you from the phone to the computer. A daily reminder is only sent on a day you have not already read or studied, and to decide that the server looks at whether you opened a chapter or asked the assistant a question that day. A record is kept of which reminder went out on which day, so that none is sent twice.

Switching notifications off on a device deletes its address from this server. Deleting your account deletes every device, every setting and every record of a reminder.

Who else sees your data

The assistant. Koinonia does not run its own language model, so when you send the assistant a message, that message and the recent conversation around it are sent to the company whose model is answering. Today that is DeepSeek, whose servers are in China, reached through OpenRouter, in the United States. When DeepSeek's own service cannot take a request, OpenRouter may pass the same request to another company running the same model (first GMI Cloud or Novita, and failing those another host of it). An administrator account can also choose other models, among them Google, Moonshot, Z.ai, xAI and Anthropic.

With each message the assistant is also given what it needs to know who it is talking to: the name on your account, so that it can call you by it, and the answers you gave when you joined, if you gave any. Nothing is remembered about you from one conversation to the next. It is never given your email, your password, or your account number.

DeepSeek's terms allow it to use what it is sent to improve its models. So the words of your conversations with the assistant, and what is sent with them, may be used by DeepSeek to train its models. Koinonia does not control that and cannot undo it once a message has been sent.

This is the single most important thing on this page, so it is worth being plain about it: do not type anything to the assistant that you would not be willing to have left this country. It reads Scripture with you very well. It is not a confessional.

Everybody else on Koinonia, if you post. A post on the feed is public to every signed-in reader, and it carries your name and your picture. It is not a message to a friend. Write it as something said out loud in a room.

Before a post appears, its words, and the whole of any study attached to it, are sent to the same model company described above, which decides whether it can be published and, like everything sent there, may use what it reads to improve its models. That is how a stranger is stopped from putting something in front of a fifteen-year-old that nobody chose to show them. The picture is not sent, and neither is your name.

If you buy a plan, the payment is taken by Google Play when you bought it on the phone, or by Stripe when you bought it on the website. Koinonia never sees your card. What reaches this server is which plan you hold and when it renews, and on the website a Stripe customer number so that cancelling works. The billing address and tax details you give at checkout stay with the company that took the payment.

If you dictate a question, the sound of your voice is streamed, while you speak, to Soniox, in the United States, which turns it into words and sends them back. Only the sound goes, not your name or your account. Koinonia keeps no recording of it.

If you switch notifications on, the words of each one pass through the service that delivers it to your device: Google's Firebase Cloud Messaging for the Android app, and on the website the push service of your browser's maker (Google, Mozilla, Apple or Microsoft). They carry the notification and nothing else about you.

If you sign in with Google, Google knows that you signed in to Koinonia, as it does for any app you use your Google account with. Koinonia tells Google nothing else about you.

Cloudflare sits in front of the website and carries the traffic between your phone and this server. Hostinger provides the machine the server runs on. Neither is given an account of who you are beyond what carrying a request requires.

Nobody else. There is no other recipient, no partner, no affiliate, and no onward sale.

How it is kept

Everything between your phone and the server travels over HTTPS, and nothing in this app is sent unencrypted, on any screen, at any time.

Passwords are hashed with bcrypt at a work factor of 12. Sessions are signed tokens that expire, not passwords held anywhere.

The database sits on a single server in Europe, reachable only from that machine. Backups live under the same protection.

How long it is kept

For as long as you have an account, because all of it is your study and the point is that it is still there next year.

When you delete your account it goes, in the manner set out on the deletion page. Nothing is kept on a timer against your wishes, and there is no shadow copy held back for analysis.

Deleting your account

In the app, open Settings and use Delete account. It is immediate and it does not ask twice after you have confirmed once.

Without the app, or if you cannot sign in, the deletion page linked at the foot of this document does the same thing and can be used by anybody, on any device.

Your rights

Koinonia is operated from the European Union, so the GDPR applies to everybody who uses it, wherever they are. You may ask what is held about you, ask for it in a portable form, ask for a correction, ask for it to be deleted, and object to a use of it. Write to [email protected] and it will be answered within thirty days, usually far sooner.

You may also complain to a supervisory authority. In Romania that is the ANSPDCP.

Children

Koinonia is not directed at children and is not designed for them. An account should not be created by anyone under 13, or under the age of digital consent where they live, which is 16 in much of Europe, without a parent doing it with them. If you believe a child has made an account, write and it will be removed.

Changes

If this policy changes in a way that affects what is collected or who sees it, the date at the top of this page moves and the change is announced in the app before it takes effect. A change that only makes the wording clearer will move the date and nothing else.