Privacy Policy

This policy explains what happens to your data when you use the Emmaus app (iOS, Android and web) and the website emmausapp.co. We wrote it to be read. Where a feature is not live yet, we say so.

1. Who we are

Emmaus is operated by THA MOTORS TRADING - FZCO, Dubai Digital Park, Dubai Silicon Oasis, Building A1, Dubai, United Arab Emirates. We are the controller of the personal data described here. For any privacy question or request, write to support@emmausapp.co.

2. The short version of how Emmaus is built

Faith is personal. In European law (GDPR Article 9) and Turkish law (KVKK Article 6), information about religious belief is a special category of data that deserves extra protection. Emmaus is designed around that:

• What reveals the most about you stays on your device.
• Anything that leaves your device does so because you turned a feature on.
• The Bible text is bundled with the app, so reading does not require a connection or an account.

3. What stays on your device

The following is stored only in the app's storage on your phone, tablet or browser. It is not sent to us:

• Your tradition (Catholic, Orthodox, Protestant or other), your calendar choice and your depiction preference.
• Your burdens and intentions, and the answers you write during a ritual.
• Your private prayer journal, candle intentions, ink prayers and evening examen entries.
• Memorization cards and your app settings.
• Usage events. The app keeps a short local log of recent actions (for example, that a ritual was completed) to drive its own screens. This log never contains your tradition, burdens or prayers, and it is not transmitted.
• Reminders. Notifications are scheduled on the device itself. We do not run a push notification service and do not collect a push token.
• Motion data. If you allow it, the engravings shift slightly as you tilt the phone. The sensor reading is used in the moment and never leaves the device.
• Crisis check. If text you write suggests you may be in danger, the app shows a card with help lines. The check runs on your device; the text is not sent anywhere.

Until you sync them, your reading progress, highlights, bookmarks and verse notes are on your device too.

You can export your local data as a file, or erase it, in Settings → Privacy & data. Device backups made by Apple or Google, and files you export, are under your control and outside ours.

4. Optional account

You do not need an account. If you create one, we use Firebase Authentication (Google) to process:

• your email address and a password that Firebase stores in hashed form (we never see it), or
• if you choose Google or Apple sign-in where it is offered, the identifier, email address and name that provider shares with us. With Apple's Hide My Email, we receive the relay address;
• an account ID, sign-in method, verification status, and technical sign-in records such as timestamps and IP address, which Firebase uses to protect accounts.

We send account emails (verify address, reset password, address change) from support@emmausapp.co.

5. Optional sync

Sync is off until you turn it on, and it requires a verified email address. When you enable it, these records are stored under your account so your devices can share them:

A few things worth knowing:

• Synced records are stored in Google Cloud Firestore in Frankfurt, Germany (europe-west3) and are reached only through our server functions, which check your sign-in on every request. The app cannot read or write the database directly.
• We also store the fact and time of your sync choices, record revision numbers, and short-lived counters that limit how fast a client can write.
• Data is encrypted in transit and at rest. It is not end-to-end encrypted: it is protected by access controls, and it is technically accessible to the operator.
• Highlights, bookmarks and notes on Bible passages can say something about your faith. We store them only because you asked us to, on the basis of your explicit consent, and you can withdraw it.
• Turning note sync off and choosing to remove cloud notes deletes the cloud copies; notes on your devices stay.
• Pausing sync or signing out stops sharing from that device. It does not delete local records.

6. Subscriptions and purchases

Emmaus+ is sold through the Apple App Store and Google Play. Apple or Google takes the payment; we never receive your card details.

To know whether a subscription is active, we use RevenueCat, which processes an app user identifier, the product purchased, transaction and renewal status, store, country and basic device and app version information. We do not send RevenueCat your tradition, prayers, notes or reading records.

7. App integrity checks

To keep our servers from being abused, requests to them carry a Firebase App Check attestation: Apple App Attest on iOS, Google Play Integrity on Android, and reCAPTCHA Enterprise in the web app. These services confirm that a request comes from a genuine copy of Emmaus. To do so, Apple and Google process device and app integrity signals under their own terms.

8. Ask (AI) — not yet available

Launch-conditional section. Ask is not live today; in current builds it is a preview that sends nothing off your device. This section describes how it will work and will be finalised before the feature is switched on.

Ask lets you put a question about Scripture to an AI model. It will work only after you give a separate consent inside the app. When you ask, the text of your question will be sent through our servers to an AI service provider to produce an answer. Verses shown in an answer always come from the translations bundled in the app, never from the model. We will not add your tradition, burdens or journal to the request. Before launch, this section will name the provider and state how long it retains requests.

9. Circle (prayer with friends) — not yet available

Launch-conditional section. Circle is hidden in current builds. This section describes the intended design and will be finalised before the feature is switched on.

Circle will let you share prayer requests with people you invite. What you post to a circle will be stored on our servers and shown to that circle's members, together with the name you choose to display. You will be able to report content, block a member and leave a circle. Your private prayer journal will remain separate and on your device.

10. This website

• No cookies. emmausapp.co sets no cookies and has no advertising pixels.
• Hosting. The site is served by Cloudflare, which processes technical request data (IP address, requested page, browser and connection details) to deliver pages and protect the site.
• Visit statistics. We use Cloudflare Web Analytics, which counts page views in aggregate without cookies, without fingerprinting and without following you across sites.

11. Support email

When you write to support@emmausapp.co, we process your address, your message and anything you attach in order to answer you. Our mailbox runs on Google Workspace. Please do not send passwords, and share only what the question needs.

12. What we do not do

• We show no ads in the app or on this site.
• We do not sell or rent personal data, and we do not share it for targeted advertising.
• We do not track you across other companies' apps and websites, and the app does not ask for the tracking permission.
• The app contains no third-party advertising or analytics SDK.
• We do not use your data to train AI models.

If we ever measure how installs relate to our own advertising, we will use only the privacy-preserving tools that the platforms themselves provide (such as Apple's AdAttributionKit or Google Play's install referrer), which do not identify you to us, and we will update this policy first.

13. Why we are allowed to process this (legal bases)

Where synced content may reveal religious belief, we rely on your explicit consent (GDPR Article 9(2)(a); KVKK Article 6).

14. Who else processes data for us

We may disclose data when the law requires it, or as part of a lawful transfer of the service to a new operator, limited to what is necessary. In that case this policy continues to protect your data unless you are told otherwise in advance.

15. Where data is processed

Our company is in the United Arab Emirates. Synced records and our server functions are located in Frankfurt, Germany. That does not mean every provider processes data only in the EU: Firebase Authentication, RevenueCat, the app stores, Google Workspace and Cloudflare may process data in other countries, including the United States. Where the law requires safeguards for such transfers, such as standard contractual clauses, we rely on them. You can ask us for details.

16. How long we keep data

• On your device: until you delete it or remove the app.
• Account: until you delete the account.
• Synced records and notes: until you delete them, turn off note sync with removal, or delete the account.
• Server and security logs: a limited period set by the provider, then deleted.
• Support email: as long as needed to handle your request and any follow-up.
• Purchase records: as long as the stores, RevenueCat and tax or accounting rules require.

17. Deleting your account and data

In the app, go to Settings → Privacy & data → Delete my account and data. If you are signed in, the app asks you to confirm your identity again, then removes your synced records and notes from our servers, deletes your sign-in account, and clears the records on that device. A server-side cleanup runs again automatically as a backstop.

If you are not signed in, the same option clears the device only; there is no online account to delete.

Deleting an account does not cancel a subscription. Cancel it in the App Store or Google Play. If you cannot open the app, write to support@emmausapp.co from the account's email address and we will delete the account for you.

18. Your rights

Depending on where you live, you may have the right to:

• know whether we process your data and get a copy of it;
• have it corrected or deleted;
• restrict or object to processing, and withdraw a consent you gave;
• receive data you provided in a portable form;
• complain to your data protection authority.

EU, EEA and UK (GDPR): all of the above apply. Türkiye (KVKK Article 11): you may also learn the purpose of processing and the third parties data is transferred to, request notification of corrections and deletions to those parties, and claim compensation for unlawful processing; you can complain to the Personal Data Protection Board. California (CCPA/CPRA): you have the right to know, delete and correct, and not to be treated differently for using these rights. We do not sell or share personal information as those terms are defined there.

Write to support@emmausapp.co. We will ask only for what we need to confirm it is you, never your password, and we will answer within the time the law sets. Most of your data is on your device, where the export and delete tools work without us.

19. Children

Emmaus is not directed to children under 13, and we do not knowingly collect their personal data. In countries where the age for consenting to data processing is higher (up to 16 in parts of Europe), a younger person may create an account or enable sync only with a parent's or guardian's permission. If you believe a child has given us data, write to us and we will delete it.

20. Security

We use access controls, verified sign-in on every server request, app integrity checks and encryption in transit and at rest. No system can be guaranteed secure. Protect your device with a lock and keep your password to yourself.

21. Changes to this policy

When the app, a provider or the law changes, we update this page, its date and its version. For important changes we will tell you in the app or by email before they take effect, and we will ask again where a new consent is needed. A consent you gave for one purpose is not stretched to cover another.

22. Contact

THA MOTORS TRADING - FZCO, Dubai Digital Park, Dubai Silicon Oasis, Building A1, Dubai, United Arab Emirates. Email: support@emmausapp.co. See also the Terms of Use and Support.