Privacy Policy

What personal information Eastodox collects, why, who it is shared with, how long it is kept, and what you can ask of us.

Last updated 28 September 2026

What changed

On 28 September 2026 we updated this policy for the subscription that version 1.1 of the iPhone, iPad and Android applications introduces, released no earlier than 12 October 2026: what the subscription needs and who handles it, under “Subscriptions in the applications”. That includes the record our own database, on our server in South Africa, keeps of each subscription and payment RevenueCat tells us of, so that we can answer a question about a charge, a refund or access, keep accounts of what was sold, and see, in totals, how the subscription is doing. After an account is deleted, that record is kept under a random account identifier only and then deleted: a record that includes a payment or a refund until seven years after the end of the financial year of its last payment or refund or, if that is later, five years after we submit the tax return for that year, and for longer while an audit, objection or appeal about that year is still open; any other, for a shorter time. We also named the responsible party in full: earlier versions named “Eastodox”, with TenuTech operating the Service for it, and this version names Tenubah Technologies (Pty) Ltd, trading as TenuTech. Your information stays where it is, on the same server, under the same commitments. For accounts opened before 28 September 2026, these changes take effect on 12 October 2026. The website collects nothing new. Since then we have described the website’s own page counter more exactly: it counts the sign-in page and the prayer book as well as the public pages, your browser sends its random token to our server with each view it counts, and the server reads, but does not keep, the browser’s description of itself and the address of the site the request came from, to leave out automated traffic. The prayer book on the website can now save bookmarks too, kept with your account as the applications already kept them. We have also stopped saying that we keep your reading position in each office: neither the website nor the applications record it, so we hold none, and we would keep it only if a future version of the applications records it.

The principle

A record of what somebody prays, and when, is sensitive. It reveals religious belief, which South Africa’s Protection of Personal Information Act (POPIA), the European Union’s General Data Protection Regulation (GDPR) and nearly every other data-protection regime treat as a special category of personal information that needs particular care.

Eastodox is therefore built to hold as little as it can. There is no advertising, no advertising identifier, no data broker, and nothing is sold or shared for anyone else’s marketing. We build no profile of your devotional life, and nobody reads your bookmarks.

This policy applies to the website at https://eastodox.com, the Eastodox applications for iPhone, iPad and Android, and the application programming interface behind them (together, "the Service"). It explains what we collect, why, who receives it, how long we keep it, and the rights you have.

Who is responsible

The responsible party (the “controller”, in GDPR terms) for the personal information described here is Tenubah Technologies (Pty) Ltd, trading as TenuTech, a private company registered in South Africa under number 2020/255030/07, of 16 Longifolia, Paradyskloof, Stellenbosch, 7600, South Africa (“we”, “us”). We develop, operate and support the Service, and administer the server it runs on; the other parties that handle personal information for it, including the company that provides that server, are listed under “Who receives it”.

Questions, requests and complaints about personal information, including requests to our Information Officer under POPIA, go to admin@tenutech.com. We answer within thirty days, and sooner where we can.

At a glance

You need a free account to open the prayer book, on the website and in the applications. The public pages of the website can be read without one, and then we hold nothing about you beyond the server logs every website keeps.
With an account we hold your email address, a hash of your password (never the password), an optional name, your preferences, your bookmarks and notes, and the sessions that keep you signed in.
If you sign in with Google or Apple we hold the provider’s stable account identifier, and the email address and name they pass to us. We never see your Google or Apple password.
If you allow notifications on your phone we hold a push token, the platform, the app version, your locale and your time zone.
If you subscribe in the iPhone, iPad or Android application, you pay Apple or Google and we never see your card. RevenueCat keeps the record of your subscription for us, under a random account number rather than your name or email address, and tells our server of each purchase, renewal, cancellation and refund, which our own database records against your account.
The website counts its own page views with a random token kept in your browser, not a cookie, and without identifying you. It uses Google Analytics only after you accept it on the cookie notice. Until then, and if you decline, Google Analytics stores nothing on your device.
We do not sell personal information, do not share it for advertising, and do not use advertising cookies or identifiers anywhere in the Service.
You can delete your account, and everything in it, yourself, immediately, from the application or the website. Our own record of a subscription stays, but its link to your account, and so to your email address and name, is removed at once. A record that includes a payment or a refund is then kept under a random account identifier only, until seven years after the end of the financial year of its last payment or refund or, if that is later, five years after we submit the tax return for that year, and for longer while an audit, objection or appeal about that year is still open, as the law requires; any other is kept for a shorter time, as “How long we keep it” explains. Deleting the account does not cancel a subscription; cancel it with Apple or Google first.

What we collect, and why

The table lists every category of personal information the Service processes, whether it is held in our own database, kept by RevenueCat for us, or in the reports the stores send us: where it comes from, what it is used for and how long it is kept. There is nothing outside it.

An email address, and a password or a Google or Apple sign-in, are needed to open an account, and without an account the prayer book cannot be opened. From version 1.1 the applications also cannot open without the subscription record that RevenueCat keeps for us. Everything else in the table is optional, or is made as you use the Service.

What	Where it comes from	Why we hold it	How long
Email address	You, when you register; or Google or Apple, when you sign in with them	To identify your account, let you sign in, and contact you about the account or a material change to these documents	Until you delete the account
Password, hashed with Argon2id	You	To authenticate you. The password itself is never stored and cannot be recovered from the hash	Until you delete the account or the password is changed
Display name	You, if you give one; or Google or Apple, if you sign in with them	To address you in the application	Until you delete the account
Google or Apple account identifier	Google or Apple, in the signed identity token	So that a returning Google or Apple sign-in finds the same account even if the email address behind it changes	Until you delete the account
Preferences: calendar, theme, text size, language, prayer rule	You, in the settings	So your phone and your browser agree about which calendar you keep	Until you delete the account
Bookmarks and the notes on them, and, only if a future version of the applications records it, your reading position in each office	You, as you use the prayer book, on the website or in the applications	The feature you signed in for. Never read by us, never analysed, never shared	Until you delete them, or the account
Session records: a description of the browser or app (“Eastodox/1.1.1+8 (android; 14)”, for example), the IP address the session was opened from, and timestamps	Your device, when you sign in and each time the session is refreshed	To keep you signed in, to detect a stolen session token and sign it out everywhere, and to let us end a session you do not recognise	Sessions last 30 days and are rotated on each use; expired records are removed within 7 days
Push notification token, platform (iOS or Android), app version, locale and IANA time zone	Your phone, when the app registers for notifications	To deliver notifications to your device, in your language, at the right local time	Until you turn notifications off, uninstall the app, or delete the account. A token the delivery service reports as expired is removed
Subscription status: whether a subscription or a free trial is active, and the dates it began, renews or expires	Apple or Google, through RevenueCat, when you subscribe and each time the subscription renews, changes or ends	To open the applications to a subscriber, and to show you the state of your subscription. Held by RevenueCat on our behalf. Our own database keeps a record of it too, in the subscription and payment records below	Until you delete the account, or we close our RevenueCat project
Purchase records: the product identifier, the store (App Store or Google Play), the storefront country and currency, the price charged, and the store’s transaction identifiers, receipt or purchase token. Never your card or any other details of how you pay, which only Apple or Google sees	Apple or Google, through RevenueCat	To confirm with the store that a purchase is genuine, to restore it on another device, and to answer a question about a charge. Held by RevenueCat on our behalf. Our own database keeps the details of each charge too, in the subscription and payment records below	Until you delete the account, or we close our RevenueCat project. Apple and Google keep their own records under their own policies
Subscription and payment records in our own database: your Eastodox account identifier; the store and the product; the subscription’s status, whether it will renew, and the dates it began, renews, expires or was cancelled; whether a period was a free trial, an introductory or promotional offer, or the normal price; the country, as RevenueCat works it out from where the application was last used, and the currency; the price paid, in that currency and in US dollars; RevenueCat’s estimate of the tax and of the store’s commission, and our estimate of what is left; the store’s transaction identifiers; the reason a subscription was cancelled or ended, as the store reports it (for example, that you cancelled it, that the store could not take a payment, that it was refunded, or that you did not accept a price increase), the end of any grace period after a failed payment, and when a paused subscription will resume; how many times it has renewed, and any offer code used; whether it was a test purchase in the store’s sandbox; and the notice RevenueCat sent, kept for audit, which repeats these facts together with RevenueCat’s own identifiers for the notice, the app, the entitlement and the offer shown, and, if we test versions of the subscription screen, which version you were shown; any discount applied; whether the purchase was shared through Family Sharing; whether a price increase needed your agreement, and whether you gave it; and any other identifiers the subscription has been known by (the anonymous ones the purchases library used before you signed in and, when a subscription moves between accounts, the identifier of the other account). We keep the notice without the details RevenueCat attaches about the person and the device, such as the App Tracking Transparency status of an iPhone or iPad. Never your card or any other details of how you pay, and never your name or email address, since we give RevenueCat neither	RevenueCat, which tells our server each time Apple or Google reports a purchase, a renewal, a cancellation, a refund, a billing problem, an expiry or another change to the subscription	To provide and support the subscription, and to answer a question about a charge, a refund or your access; to keep accounts of what was sold, as tax and company law require; and to see how the subscription is doing, in totals: how many subscribe, renew and cancel, and what it earns. Only our super administrators can see these records, and they may download them as a spreadsheet to keep the accounts, as “Subscriptions in the applications” describes	While the account exists, the records are kept with it. When the account is deleted, the link between the records and the account, and so to its email address and name, is removed from our database at once, and the records are kept under the random account identifier only. The record of a subscription that was paid for or refunded, with each notice about it, is then kept until seven years after the end of the financial year of its last payment or refund or, if that is later, five years after we submit the tax return for that year, and for longer while an audit, objection or appeal about that year is still open, because the law requires us to keep the records of what was sold and refunded. The record of one that was not, such as a free trial that was never paid for, is kept until three years after the last notice about it, so that a question about a trial, a charge or access can be answered, and a claim about one met, for as long as such a claim could ordinarily be brought. A record that never belonged to one of our accounts, such as one RevenueCat reports under an anonymous identifier, is kept on the same terms. The record of a test purchase in the store’s sandbox, which charges nobody and is made only by people testing the application, or of a test notice from RevenueCat, is kept until 90 days after the last notice about it, whether or not the account still exists. Each record is then deleted. If the same Apple or Google subscription is later restored to another Eastodox account, its record moves to that account, and the store’s transaction identifiers connect it with the earlier records. A spreadsheet of these records is deleted when it is no longer needed for the accounts
Store sales and financial reports: for each sale, the product, the date, the country, the currency and the amount, and in some reports the store’s order number and the buyer’s state, province or postal code. Never a name or email address	Apple and Google, each month	Part of the accounting and tax records the law requires us to keep	For as long as South African tax and company law requires
Subscription identifiers and device details: your Eastodox account identifier (a random number, not your email address or name) or, before you sign in, an anonymous identifier made by the purchases library; your device model, operating system and app version; on iPhone and iPad, the device’s App Tracking Transparency status, which the library reports whether or not an application asks to track you (Eastodox never asks); and the IP address of each request, used to work out your country	The mobile application, with each request it makes to RevenueCat	So that one subscription follows your Eastodox account across iPhone, iPad and Android, and so that RevenueCat can answer the application with the store’s price for your country	Under your account identifier: until you delete the account, or we close our RevenueCat project. Under an anonymous identifier, which names no account: until we close our RevenueCat project
Website page views: the page path, without its query string, and a hash of a random visitor token together with the South African date and a secret held on our server, so the hash changes every day. The token itself is not kept	Your browser, which sends the token with each page view, on every page of the website except the administration console: the public pages, the sign-in page and, once you are signed in, the prayer book. Views by our own administrators are not counted once the website knows they are signed in	To know which pages are read and by roughly how many people each day. Because the date is part of the hash, nobody can be followed from one day to the next. To leave out crawlers, scripts and other sites pointed at our server, the server reads the browser’s description of itself and the address of the site the request came from, and keeps neither with the count	90 days
Google Analytics measurement (website only, and only if you accept it)	Your browser, through Google’s tag	To understand how many people find the site and which pages they read. See “Analytics” below	Google keeps user-level data for the property for at most 14 months; we keep aggregate reports
Server logs: IP address, request path, the page a request was made from, browser or app description, timestamps, status, and for some requests the account identifier and what was done, for example that a subscription notice was recorded or an account was deleted	Every request to the website and the API	Security, abuse prevention, rate limiting and fault diagnosis	No longer than 90 days
Administrative audit log: the administrator, the action, the record changed, what was changed, and the IP address	Administrators, when they change the corpus, the settings or an account	Accountability for changes to the liturgical texts, the settings and accounts. It records your account only if an administrator changes it, and then what was changed, which, if an administrator created the account or changed its email address or name, includes them	For the life of the Service. When an account is deleted, what was changed in it is removed from the log at once, and only which administrator acted, what they did and when is kept
Correspondence	You, when you write to us	To answer you, and to keep a record of how a request or complaint was resolved	For as long as needed to deal with the matter and to evidence its outcome

How we use it

We use the information above only for the following purposes:

to provide the Service: to compute the day, sign you in, and show you your own bookmarks and notes on whichever device you use;
to provide and support the subscription in the applications: to confirm your purchase with Apple or Google through RevenueCat, to open the applications to you while it is active, to restore it on another device, to answer a question about a charge, a refund or your access, and to keep the accounting and tax records the law requires;
to see how the subscription is doing, in totals: how many people subscribe, renew and cancel, and what it earns, so that we can keep the Service running;
to keep the Service secure: to detect misuse, enforce rate limits, investigate a fault, and sign out a session you do not recognise;
to deliver notifications you have allowed, on the platform and in the time zone you are in;
to understand, in aggregate, how the website is used, so that we know which pages matter and where people struggle;
to answer you when you write to us, and to tell you about a material change to the Service or to these documents;
to comply with the law and to establish, exercise or defend legal claims.

We do not use personal information for advertising, for profiling, for automated decisions that have a legal or similarly significant effect on you, or for any purpose incompatible with those above. If we ever needed to use it for something new, we would tell you first and, where the law requires it, ask.

Why we are allowed to hold it

POPIA, the GDPR and similar laws require a lawful justification for each kind of processing. Ours are these.

Account information, preferences, sessions and notification tokens are processed because they are necessary to perform the agreement between us: you asked for an account, or for notifications, and this is what they require (POPIA section 11(1)(b); GDPR article 6(1)(b)).
Subscription information, including the subscription and payment records in our own database, is processed because it is necessary to perform the contract for the subscription you chose to buy, and to answer your questions about it (POPIA section 11(1)(b); GDPR article 6(1)(b)). The records of each sale and refund are also kept because the law requires accounting and tax records: section 29 of the Tax Administration Act 28 of 2011 requires the records that support a tax return to be kept for five years from the date the return is submitted, and section 32 for longer while an audit, objection or appeal is still open; section 24 of the Companies Act 71 of 2008 requires a company to keep any record the law requires of it for seven years (POPIA section 11(1)(c); for readers the GDPR protects, our legitimate interest in meeting the law we are subject to, GDPR article 6(1)(f)). We use the same records, in totals, to see how the subscription is doing, in our legitimate interest in running the Service (POPIA section 11(1)(f); GDPR article 6(1)(f)). Because holding an Eastodox account or subscription can itself reveal religious belief, we also process this information with your explicit consent, given when you create the account or subscribe, having been shown this policy (POPIA section 27(1)(a); GDPR article 9(2)(a)). Deleting your account withdraws that consent, but not the obligation to keep the records of each sale and refund: those we keep because the law requires it (POPIA section 27(1)(b); for readers the GDPR protects, GDPR article 9(2)(f), the establishment, exercise or defence of legal claims), under the random account identifier only, and we use them only to keep the accounts, to answer a question about a charge or a refund, and in the totals of what was sold and of how many subscribed. The rest of a subscription’s record, such as a free trial that was never paid for, we keep for a shorter time, in our legitimate interest in being able to settle a question or a claim about a trial, a charge or access for as long as such a claim could ordinarily be brought (POPIA sections 11(1)(f) and 27(1)(b); GDPR articles 6(1)(f) and 9(2)(f)). The record of a test purchase in the store’s sandbox, which charges nobody, we keep until 90 days after the last notice about it, in our legitimate interest in checking that the subscription works (POPIA section 11(1)(f); GDPR article 6(1)(f)).
Bookmarks and notes, and reading positions if a future version of the applications records them, can reveal religious belief, which POPIA (section 26) and the GDPR (article 9) treat as special personal information. We process them on the basis of your explicit consent, which you give when you create an account, having been shown this policy (POPIA section 27(1)(a); GDPR article 9(2)(a)). You may withdraw that consent at any time by deleting your bookmarks or your account, which erases the content.
Server logs, session metadata and the audit log are processed in our legitimate interest in keeping the Service secure and working, and in being able to show who changed what, weighed against the minimal intrusion of what they hold (POPIA section 11(1)(f); GDPR article 6(1)(f)).
First-party page counting is processed in our legitimate interest in knowing whether the site is used, and is designed so that it cannot identify you.
Google Analytics is processed only with your consent, given on the cookie notice and withdrawable at any time (POPIA section 11(1)(a); GDPR article 6(1)(a)).
Correspondence and legal records are processed to comply with our legal obligations and to establish, exercise or defend legal claims.

Signing in with Google or Apple

You can create and use an account with an email address and password, or by signing in with Google or with Apple. Neither is required; the choice is yours.

When you sign in with Google, we ask Google only for your basic profile: your account identifier, your email address, and your name. When you sign in with Apple, Apple gives us your account identifier, your email address (which may be a private relay address that Apple forwards for you, if you chose to hide your email), and, on the first sign-in only, your name. In both cases the provider hands your device a signed identity token, the application forwards it to our server, and our server verifies its signature and that it was issued for Eastodox before opening a session. The provider does not see what you do in the Service, and we never see your Google or Apple password.

We use Google Sign-In and Sign in with Apple only for authentication. We do not use Firebase Authentication, and we do not read your contacts, calendar, files or anything else from either account. Your use of Google and Apple is governed by their own privacy policies.

A Google or Apple sign-in cannot currently be unlinked from an account on its own; deleting the account removes the link and the identifier with everything else.

Google user data

This section states, in one place, how Eastodox handles information received from Google, as Google’s API Services User Data Policy requires of every application that uses Google Sign-In.

Access. When you choose to sign in with Google, Eastodox requests only the “email” and “profile” scopes. From them we receive your Google account identifier, your email address, your name, and, if Google supplies it, the address of your profile picture, which we do not store. We request no other Google data and no access to Gmail, Drive, Calendar, Contacts, Photos or any other Google service.
Use. The information is used only to create your Eastodox account, to sign you in on later visits, to address you by name in the application, to contact you about your account, and to administer the account and answer your questions about it, including about its subscription. It is used to provide and improve the user-facing features of Eastodox and for nothing else.
Sharing. We do not transfer Google user data to anybody else. It is not sold, not shared with advertisers, data brokers or analytics providers, and not disclosed to any third party except where the law compels disclosure, with your explicit consent, or where it is necessary for a security investigation or to defend a legal claim. RevenueCat, which checks subscriptions for us, receives only our own random account identifier, never your Google account identifier, email address or name.
Prohibited uses. Google user data is never used for serving advertisements, for retargeting or interest-based advertising, for determining creditworthiness or lending eligibility, for developing, improving or training generalised or non-personalised artificial-intelligence or machine-learning models, or for any purpose unrelated to providing Eastodox to you. Our administrators can see the email address and name on an account, whatever their source, and use them only to administer the account and to answer a question about it. Our super administrators also see them beside the account’s subscription and payments, and use them only to answer a question about a charge, a refund or access. The spreadsheet of subscription records a super administrator can download also shows them; it never leaves TenuTech, and what we give our accountant or auditor carries the random account identifier only. Nobody else at TenuTech reads them.
Protection. Google user data is transmitted only over TLS, stored in a database reachable only from the application on the same server, and protected by the measures listed under “How it is protected” below.
Retention and deletion. Google user data is kept only for as long as your account exists, with the one exception below. When you delete your account, it is deleted from our database immediately and permanently, including from the administrative audit log if an administrator ever entered it there, and when you ask us to delete it, we do the same within thirty days. A spreadsheet of subscription records that a super administrator made to keep the accounts before the account was deleted may still show the email address and name until that copy is deleted, when it is no longer needed for the accounts. When the retention period expires for any type of data described in this policy, we delete or destroy it. You can also revoke Eastodox’s access to your Google account at any time at https://myaccount.google.com/permissions; if you do, your Eastodox account remains but Google sign-in will ask for your permission again.

Eastodox’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Subscriptions in the applications

The website takes no payment. From version 1.1, the iPhone, iPad and Android applications sell the Eastodox subscription through the App Store and Google Play, and this is how it is handled.

You pay Apple or Google, not us. They take your card or other payment details under their own terms and privacy policies, and we never see them. The store then issues a receipt or purchase token for the purchase. The application passes it to RevenueCat, Inc., the service we use to check purchases, and RevenueCat confirms it with the store and tells the application whether your subscription is active.

RevenueCat knows you by your Eastodox account identifier, a random number that is not your email address or your name. The fact that somebody subscribes to a prayer book can say something about their faith, so we give RevenueCat nothing that names you. Before you sign in, the purchases library in the application uses an anonymous identifier of its own, and it makes a new one each time you sign out; when you sign in, it switches to your account identifier.

RevenueCat keeps the subscription record for us: its status and dates, the product, the store, the country and currency, the price, and the store’s transaction identifiers. With each request from the application it also receives your device model, operating system and app version, on iPhone and iPad the device’s App Tracking Transparency status, and the IP address of the request, which it uses to work out your country. It acts only on our instructions, under its data processing addendum with us, and we give it no advertising identifier and none of your contact details.

RevenueCat also tells our server each time Apple or Google reports a change to your subscription: a purchase, a renewal, a cancellation, a refund, a billing problem, an expiry, a price increase that needs your agreement, or the subscription moving to another account. Our own database, on our server in South Africa, keeps a record of each notice against your account: the store and the product; the subscription’s status, whether it will renew, and the dates it began, renews, expires or was cancelled; whether a period was a free trial, an introductory or promotional offer, or the normal price; the country, as RevenueCat works it out, and the currency; the price paid, in that currency and in US dollars; RevenueCat’s estimate of the tax and of the store’s commission, and our estimate of what is left; the store’s transaction identifiers; the reason a subscription was cancelled or ended, as the store reports it (for example, that you cancelled it, that the store could not take a payment, that it was refunded, or that you did not accept a price increase), the end of any grace period after a failed payment, and when a paused subscription will resume; how many times it has renewed, and any offer code used; whether it was a test purchase in the store’s sandbox; and the notice RevenueCat sent, which repeats these facts together with RevenueCat’s own identifiers for the notice, the app, the entitlement and the offer shown, which version of the subscription screen you were shown if we test more than one, whether you agreed to a price increase, and any other identifiers the subscription has been known by. We keep the notice without the details RevenueCat attaches about the person and the device, such as the App Tracking Transparency status of an iPhone or iPad, and it carries no name or email address, because we give RevenueCat neither. The table under “What we collect” lists it in full.

We keep these records to provide and support the subscription, so that we can answer a question about a charge, a refund or your access; to keep accounts of what was sold, as tax and company law require; and to see, in totals, how the subscription is doing. Only our super administrators can see them. A super administrator can download them as a spreadsheet to keep the accounts, and the spreadsheet shows the email address and name on each account; such a copy is kept on our own equipment, used only for that, never leaves TenuTech, and is deleted when it is no longer needed. What we give our accountant or auditor carries the random account identifier only. While your account exists the records are kept with it. When the account is deleted, the link between the records and the account, and so to its email address and name, is removed from our database at once, and the records are kept under the random account identifier only. The record of a subscription that was paid for or refunded, with each notice about it, is then kept until seven years after the end of the financial year of its last payment or refund or, if that is later, five years after we submit the tax return for that year, and for longer while an audit, objection or appeal about that year is still open, because the law requires us to keep the records of what was sold and refunded. The record of one that was not, such as a free trial that was never paid for, is kept until three years after the last notice about it, so that a question about a trial, a charge or access can be answered, and a claim about one met, for as long as such a claim could ordinarily be brought. A record that never belonged to one of our accounts, such as one RevenueCat reports under an anonymous identifier, is kept on the same terms. The record of a test purchase in the store’s sandbox, which charges nobody and is made only by people testing the application, or of a test notice from RevenueCat, is kept until 90 days after the last notice about it, whether or not the account still exists. Each record is then deleted. If the same Apple or Google subscription is later restored to another Eastodox account, its record moves to that account, and the store’s transaction identifiers connect it with the earlier records. A spreadsheet made before the account was deleted is not changed by the deletion. If a subscription that was not cancelled goes on renewing after the account is deleted, and RevenueCat tells us of it, that record is kept in the same way.

Our own database never holds your card or any other details of how you pay, and our server does not check subscriptions: the website stays free whatever the state of your subscription. The one request our server makes to RevenueCat is to delete its record of you when you delete your account.

Analytics

The website counts its own page views, without cookies. Your browser keeps a random token in its local storage and sends it with each page view the website counts. Our server does not keep the token: it records the page path together with a hash of the token, the South African date and a secret held on the server. The result tells us that a day had a certain number of visitors and which pages they read; it cannot tell us who they were, and because the date is part of the hash, the same token hashes differently tomorrow, so nobody can be followed from one day to the next. A view is never linked to your account, even when you are signed in. The count covers every page of the website except the administration console: the public pages, the sign-in page and, once you are signed in, the prayer book. Views by our own administrators are left out once the website knows they are signed in. To leave out crawlers, scripts and other sites pointed at our server, the server reads the browser’s description of itself and the address of the site the request came from, and keeps neither with the count. No IP address or query string is kept with it either, and each recorded view is deleted after 90 days. The server logs described under “What we collect” record the request itself, as they record every other. This counting runs on the website only. The applications contain no analytics, advertising or crash-reporting software; they include RevenueCat’s purchases library solely to sell the subscription and check whether it is active, as described under “Subscriptions in the applications”.

The website also uses Google Analytics (GA4). It is not strictly necessary, so it is held behind an answer: the tag is loaded with Google Consent Mode set to “denied” for everything, and only pressing “Accept” on the cookie notice lifts that for analytics storage. Advertising storage, advertising user data and advertising personalisation stay denied permanently, because the site carries no advertising. If you decline, or never answer, Google Analytics sets no cookie and stores nothing on your device.

With your consent, Google receives the addresses of the pages you open on the website, the approximate location derived from your IP address, and general details of your browser and device. Google processes this on its own infrastructure, which may be outside your country, under the terms of the Google Analytics data processing terms. We have not enabled Google Signals, advertising features or personalisation, and we do not link Google Analytics to any other Google service. You can read how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites and its privacy policy at https://policies.google.com/privacy.

You can change your answer at any time with the “Cookie choices” link in the footer of the website, which asks the question again. Clearing the site data for eastodox.com in your browser also removes the stored answer and Google’s cookies.

Who receives it

We do not sell personal information, and we do not share it with anybody for their own marketing. Besides us, the only parties that process personal information from the Service are these.

Who	What they receive	Why
Our hosting provider (South Africa)	Everything our own database and server logs hold, because they are stored on the server it provides	Hosting: it provides the server and its network connection, and we administer everything that runs on it
RevenueCat, Inc. (United States)	Your Eastodox account identifier (a random number, not your email address or name), the receipts and purchase tokens Apple and Google issue, the subscription status and purchase records in the table above, your device model, operating system and app version, on iPhone and iPad the device’s App Tracking Transparency status, and the IP address of each request, which it uses to work out your country. Only if you use the mobile applications	Our operator for subscriptions: it checks each purchase with Apple or Google, keeps the subscription record, tells the application whether a subscription is active, and tells our server of each change to a subscription. It acts only on our instructions, under a data processing addendum
Apple Inc. and its affiliates: App Store purchases	Your payment for the subscription, which you make to Apple directly, and the record of the purchase. We receive, through RevenueCat, the purchase record described above, never your card details, your name or your email address	Taking payment, renewals, receipts and refunds for the subscription on iPhone and iPad. Apple does this under its own terms and privacy policy, as a responsible party in its own right, not as our operator
Google LLC and its affiliates: Google Play billing	Your payment for the subscription, which you make to Google directly, and the record of the purchase. We receive, through RevenueCat, the purchase record described above, never your card details, your name or your email address	Taking payment, renewals, receipts and refunds for the subscription on Android. Google does this under its own terms and privacy policy, as a responsible party in its own right, not as our operator
Google LLC: Google Analytics	Page addresses, approximate location, browser and device details, only if you accept analytics on the website	Audience measurement, as described under “Analytics”
Google LLC: Google Sign-In	The fact that you signed in to Eastodox, if you choose to sign in with Google	Authentication. Google issues the identity token that we verify
Google LLC: Firebase Cloud Messaging	Your push token and the content of each notification, if you allow notifications in the mobile application	Delivery of push notifications to Android and iOS devices. Firebase is used for messaging only, not for authentication, analytics or crash reporting
Apple Inc.: Sign in with Apple and Apple Push Notification service	The fact that you signed in to Eastodox, if you sign in with Apple; and the push token and notification content on iOS	Authentication and notification delivery on Apple devices
Apple App Store and Google Play	Whatever those stores collect about your download and use of the application under their own policies. We receive nothing from them about you beyond aggregate statistics, the purchase records above and the store sales and financial reports, which do not name you	Distribution of the mobile applications
Our accountant, and our auditor if we appoint one (South Africa)	The store sales and financial reports, and our records of payments and refunds under the random account identifier only, never your email address or name	To keep and check our accounts and to prepare our tax returns
Authorities, courts and legal advisers	What the law requires us to disclose, and no more	Only in response to a valid legal demand, or to establish, exercise or defend legal claims

If Eastodox were ever transferred to another organisation, personal information would be transferred with it, under the same commitments as this policy, and you would be told before it happened.

Where it is held

Personal information held by the Service lives on a server in South Africa that we administer. The database is not reachable from the internet; only the application on the same machine can read it. That includes the subscription and payment records our own database keeps. The exceptions are the subscription record RevenueCat holds for us, which is in the United States; any spreadsheet of our subscription and payment records that a super administrator downloads to keep the accounts, which is kept on our own equipment and deleted when it is no longer needed; and any copies of our records of payments and refunds that our accountant or auditor keeps in South Africa, which carry the random account identifier only.

Google and Apple process the information described above on their own infrastructure, which may be in the United States or elsewhere. Those transfers take place under the standard contractual terms the providers offer for the purpose, which meet the requirements of POPIA section 72 and, for readers in the European Economic Area and the United Kingdom, chapter V of the GDPR.

RevenueCat, Inc. processes the subscription information described above in the United States. Its data processing addendum with us binds it to act only on our instructions and to protect the information, which meets POPIA section 72(1)(a), and it incorporates the European Commission’s standard contractual clauses and the United Kingdom’s international data transfer addendum, which meet chapter V of the GDPR and of the UK GDPR.

If you use the Service from outside South Africa, your information is transferred to South Africa to be processed there. South African law, POPIA, gives it protection comparable to that of the GDPR.

How long we keep it

The retention periods are set out against each category in the table under “What we collect”. In summary: account content is kept until you delete it; sessions expire after 30 days and their records are removed within 7 days of expiry; website page-view counts are kept for 90 days; server logs for no longer than 90 days; Google keeps user-level analytics data for at most 14 months; and RevenueCat keeps the subscription record until you delete your account or we close our RevenueCat project, and the anonymous records the application makes before sign-in, which name no account, until we close the project. Our own subscription and payment records are kept while the account exists. Once it is deleted, they are kept under the random account identifier only: a record that includes a payment or a refund until seven years after the end of the financial year of its last payment or refund or, if that is later, five years after we submit the tax return for that year, and for longer while an audit, objection or appeal about that year is still open; any other, until three years after the last notice about it. The record of a test purchase in the store’s sandbox, or of a test notice from RevenueCat, is kept until 90 days after the last notice about it, whether or not the account still exists. A record that never belonged to one of our accounts is kept on the same terms. Each is then deleted. Expired sessions and page-view counts are removed from our own database automatically by a scheduled task, not by anyone remembering to do it.

Apple and Google keep their own records of your purchases under their own policies. The accounting records the law requires us to keep include the sales and financial reports Apple and Google send us, which record each sale’s product, date, country, currency and amount, and in some reports the store’s order number and the buyer’s state, province or postal code, but not the buyer’s name or email address; and our own records of each payment and refund, described under “Subscriptions in the applications”, from which we account for each charge and refund and check it against those reports. We keep the reports for as long as South African tax and company law requires, and our own records for the period given above.

When you delete your account, your user record, bookmarks, notes, preferences, sessions and notification tokens are deleted from the database immediately and irreversibly, and we ask RevenueCat to delete its record of your subscription. This is a hard deletion, not a flag: there is nothing to restore. The only traces that remain with us are these: lines in the server log that carry the account identifier, such as that the account was deleted at its owner’s request, whether RevenueCat confirmed its deletion, or that a notice about its subscription was recorded, which expire with the rest of the log; if an administrator ever changed the account, the audit log’s note of which administrator did what, and when, without what was changed, including any email address or name, which is removed from it at the same moment; the store reports above, which do not name you; our own subscription and payment records, if the account ever had a subscription; and any spreadsheet of those records that a super administrator made before the deletion to keep the accounts, which is deleted when it is no longer needed. Our own records lose their link to the account at the same moment, and each is kept under the random account identifier only, for the period described above, and then deleted. Nothing left in our database connects them with your email address or name, unless the same Apple or Google subscription is later restored to another Eastodox account: its record then moves to that account, and the store’s transaction identifiers connect it with the earlier records. If RevenueCat does not confirm the deletion of its record, we finish it by hand.

Your rights

Under POPIA, and under the GDPR, the UK GDPR, the California Consumer Privacy Act and similar laws where they apply to you, you have the right:

to be told what personal information we hold about you, and to receive a copy of it;
to have inaccurate or incomplete information corrected;
to have your information deleted. Deleting your account does this immediately, yourself, without asking us, except for our own subscription and payment records, which lose their link to you at once, are kept for the period “How long we keep it” gives, and are then deleted, and for the audit log’s note that an administrator changed the account, if one ever did, which keeps who did what and when but not what was changed, as that section explains;
to object to processing based on our legitimate interests, and to ask that processing be restricted while an objection is considered;
to withdraw consent at any time, without affecting the lawfulness of what was done before. Analytics consent is withdrawn with the “Cookie choices” link in the website footer; consent to hold your bookmarks is withdrawn by deleting them or the account;
to receive the information you gave us in a portable, machine-readable format;
not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. The Service makes no such decisions;
to know that we do not sell or share personal information for cross-context behavioural advertising, and never have, so there is nothing to opt out of;
to lodge a complaint with a supervisory authority.

To exercise any of these rights, write to admin@tenutech.com from the email address on your account, or tell us how we can confirm that you are the person the information is about. We do not charge for a request, and we respond within thirty days. We will not treat you differently for exercising a right.

In South Africa the supervisory authority is the Information Regulator, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, telephone 010 023 5200; complaints to POPIAComplaints@inforegulator.org.za, general enquiries to enquiries@inforegulator.org.za, website https://inforegulator.org.za. In the European Economic Area you may complain to the data-protection authority of the country where you live or work; in the United Kingdom, to the Information Commissioner’s Office at https://ico.org.uk. We would ask you to raise the matter with us first, so that we can put it right.

Deleting your account

You can delete your account yourself, at any time, without contacting us:

In the iPhone, iPad or Android application: open Saved, open the account menu, and choose “Delete account”; or, from the subscription screen, tap Account and choose “Delete account”.
On the website: sign in, open Settings, and under Account choose “Delete account”, then type the confirmation word.
By email: write to admin@tenutech.com from the address on your account and we will delete it for you in the same way, within thirty days.

Deletion is immediate. Your account, bookmarks, notes, preferences, sessions and notification registrations are removed from the database at once and cannot be recovered, and we ask RevenueCat to delete its record of your subscription. Your phone is signed out and its notification token is revoked. If an administrator ever changed the account, the administrative audit log keeps which administrator did what, and when, but what was changed, including any email address or name, is removed from it at the same moment. If the account had a subscription, our own records of it and its payments stay. When the account is deleted, the link between the records and the account, and so to its email address and name, is removed from our database at once, and the records are kept under the random account identifier only. The record of a subscription that was paid for or refunded, with each notice about it, is then kept until seven years after the end of the financial year of its last payment or refund or, if that is later, five years after we submit the tax return for that year, and for longer while an audit, objection or appeal about that year is still open, because the law requires us to keep the records of what was sold and refunded. The record of one that was not, such as a free trial that was never paid for, is kept until three years after the last notice about it, so that a question about a trial, a charge or access can be answered, and a claim about one met, for as long as such a claim could ordinarily be brought. A record that never belonged to one of our accounts, such as one RevenueCat reports under an anonymous identifier, is kept on the same terms. The record of a test purchase in the store’s sandbox, which charges nobody and is made only by people testing the application, or of a test notice from RevenueCat, is kept until 90 days after the last notice about it, whether or not the account still exists. Each record is then deleted. If the same Apple or Google subscription is later restored to another Eastodox account, its record moves to that account, and the store’s transaction identifiers connect it with the earlier records. Apple and Google keep their own records of your purchases under their own policies. The prayers themselves remain in the Service; they were never yours to lose. Anything stored only on your own device, such as the offline copy of the texts and your theme setting, stays on your device until you uninstall the application or clear the site data.

How it is protected

All traffic between your device and the Service is encrypted in transit with TLS, and the website is served over HTTPS only, with HTTP Strict Transport Security.
Passwords are hashed with Argon2id at parameters meeting current OWASP guidance and are never stored in a recoverable form. Registration and sign-in are rate-limited to slow guessing.
Sessions use short-lived access tokens and rotating refresh tokens. Only a SHA-256 digest of each refresh token is stored, so a database read cannot be replayed as a session. Re-use of a spent token reveals theft and revokes the whole session family, signing that session out wherever it is in use.
In the mobile applications, tokens are kept in the platform keychain or keystore, not in ordinary preferences. On the website the refresh token is an HttpOnly cookie that page scripts cannot read.
Identity tokens from Google and Apple are verified against the providers’ published signing keys and are accepted only if they were issued for Eastodox.
Payment for the subscription is made to Apple or Google, whose systems handle your card. We never receive your card or any other details of how you pay, so we hold none that could be lost.
Our server accepts RevenueCat’s notices about subscriptions only when they carry a secret that RevenueCat and our server share, and the subscription and payment records they create can be seen only by super administrators, not by other administrators.
The server accepts administrative access only by SSH key, runs a host firewall that admits only web traffic, applies security updates automatically, bans repeated failed logins, and binds the database to the local machine so it is not reachable from the internet. The API runs under a restricted system account.
Every administrative change to the liturgical corpus is recorded in an audit log with the actor, the time and the change.
No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and the Information Regulator as POPIA section 22 requires, and any other authority the law requires.

Children

The Service is suitable for family use. The account that the prayer book needs is not intended for anybody under eighteen unless a parent or guardian consents on their behalf, because POPIA treats anybody under eighteen as a child and requires a competent person’s consent for their information. The same consent is needed to buy a subscription, and Apple and Google let parents require approval for a child’s purchases. We do not knowingly collect personal information from a child without that consent. If you believe a child has created an account without it, write to us and we will delete the account.

What stays on your device

Both the website and the mobile applications keep some information on your own device so that they work offline and remember your settings. None of it is sent to us except as described above. The Cookies and Storage policy lists every item, its purpose and how to clear it.

Changes to this policy

We may update this policy when the Service changes or the law does. The date at the top shows when it last changed. If a change materially affects how your personal information is handled, we will tell you in the application, or by email to the address on your account, before it takes effect, and where the law requires it we will ask for your consent again.

Contact

For anything about personal information, including access, correction and deletion requests, complaints and questions for our Information Officer, write to admin@tenutech.com. The responsible party is:

Tenubah Technologies (Pty) Ltd, trading as TenuTech
A private company registered in South Africa, registration number 2020/255030/07
Director: Johannes Burger
VAT registration number: 4850307069
Physical address, and address for service of legal documents: 16 Longifolia, Paradyskloof, Stellenbosch, 7600, South Africa
Telephone: +27 79 874 9628
Email: admin@tenutech.com
Website: https://eastodox.com