SanctuaryPrivacy &
your data.
Who is responsible, how Sanctuary handles your information, and how to exercise your rights.
Version 1.1 · Updated 12 October 2026
About this notice
Sanctuary Notes is an independently operated project based in Belgium. Operator and contact details appear below. Privacy and support contact: support@sanctuarynotes.app.
This notice covers the account website, Android app, mobile browser app, community features and support, including information retained from earlier versions. Older descriptions of a fully local, account-free app do not describe newer account features.
Information used by Sanctuary
| Information | Purpose |
|---|---|
| Email, authentication identifiers, email-verification status, Sanctuary ID, device/account links and sessions | Account creation, sign-in, password recovery and connecting the correct account with an installation. |
| Notes, dreams, prayer history, readings, fasting, calendar records, drafts, recordings and attachments | Requested app features, local saving, account saving and recovery when available. Records can be stored on your device and online. |
| Profile, Circle membership, posts, comments, prayer requests, reactions and shared files | Community features, communication, shared activities and moderation. |
| App version, platform, installation identifiers, last activity, feature counts, durations and errors | Service operation and troubleshooting. The diagnostics setting controls additional detailed support information in supported versions. |
| Support messages, reports, screenshots and request-verification information | Responding to questions, investigating problems and handling privacy or moderation requests. |
| Network requests, IP addresses, headers, timestamps and security counters | Delivering websites and APIs, preventing abuse and diagnosing failures. Infrastructure providers also process technical request information. |
Information comes from what you enter or share, your app and device, service requests, and people who communicate with you or submit reports. Support does not need your password.
Purposes and legal grounds
For ordinary personal information, the following GDPR grounds apply to these purposes:
| Purpose | Legal ground |
|---|---|
| Requested account, saving, recovery and community features, and support necessary to deliver them | Performance of the service agreement, or steps you request before entering it: Article 6(1)(b). |
| Security, abuse prevention, necessary technical troubleshooting and moderation | Legitimate interests in keeping Sanctuary secure and usable: Article 6(1)(f), balanced against your rights. |
| Optional detailed diagnostics where you choose to share them | Consent: Article 6(1)(a). Change the supported app setting or contact support to withdraw it. |
| Meeting applicable legal duties, including handling privacy requests | Compliance with a legal obligation: Article 6(1)(c), where it applies. |
See the service terms. An email and authentication information are required for an account. Optional profile fields, posts and attachments are supplied by you. Declining optional diagnostics does not prevent account use.
Sensitive personal content
Entries, recordings, prayer requests and activity patterns can reveal religious beliefs, health information and other sensitive details. Article 9 of the GDPR gives this information additional protection. A service agreement or ordinary legitimate interest alone is not sufficient to authorise its processing.
Reading this notice, agreeing to service terms or creating an account is not treated as explicit consent to processing sensitive content. Any consent relied on for that content must be a separate, specific choice that can be withdrawn. The current account flow does not yet provide a dedicated sensitive-content consent control.
Review what you record or share, including information about other people. To restrict processing of existing sensitive information, withdraw previously given consent or request deletion, contact support@sanctuarynotes.app. Use Account & data deletion for an account-associated removal request.
Local saving, online records and security
The app stores entries and settings locally. Versions with account saving also send personal records and files to online storage when that service is available. Account saving can be paused during reliability work. An account or successful sign-in does not prove that every entry has been uploaded or recovered.
Current account-sync code encrypts personal record content and attachments before upload. The account service manages the keys for recovery. This is not a claim of end-to-end encryption that makes content inaccessible to Sanctuary. Identifiers, metadata and shared community information are processed separately.
Account requests use encrypted network connections and authenticated access controls; the website sign-in cookie is protected from page scripts. No storage or security measure guarantees that information can never be lost or accessed improperly.
Keep your existing installation when troubleshooting missing entries. Exported backups can contain sensitive information; keep them private. Signing out or uninstalling does not itself delete online information.
Recipients and sharing
Personal entries are separate from Circle posts. Registration does not publish your journal to a Circle. Content you share is visible to members or recipients under the applicable controls; they may keep copies.
Sanctuary’s operator handles support and moderation. Technical providers process information needed to deliver their services. Support messages and reported community content may be reviewed to resolve a request or investigate a report. Personal record storage and recovery are distinct from the ordinary administration screens.
Information may also be disclosed under a valid legal obligation or where necessary to establish, exercise or defend legal claims, assessed against applicable law.
Providers and international transfers
- Google Firebase: authentication, email-action validation and supported Android messaging. Google states that Firebase Authentication processes data in the United States. See privacy and security information and data-processing terms.
- Resend: confirmation and password-reset emails. See its data-processing addendum and privacy policy.
- Cloudflare: website/API delivery, databases and synced-file storage through the hosting environment. See its data-processing addendum.
- ChatGPT Sites / OpenAI: publishing and hosting management. See the EEA privacy policy. This does not mean entries are sent to ChatGPT for an AI response.
- Porkbun: the support mailbox and domain services. See its privacy policy.
- Bible and device services: requested references and translations go to the reader’s Bible service. Speech recognition, sharing and operating-system backups may use providers selected on your device under their own notices.
Processing is not restricted to Belgium or the European Economic Area. Providers use international infrastructure and subprocessors. Google, Resend and Cloudflare publish terms containing transfer provisions, including standard contractual clauses where applicable.
Those documents describe provider arrangements; they do not themselves establish contractual coverage or locations for every Sanctuary service. Contact support@sanctuarynotes.app for the safeguards applicable to your information and a copy or reference where available.
Cookies, permissions and diagnostics
The website uses the essential __Host-sanctuary_account sign-in cookie, with a maximum configured lifetime of 30 days. Sign-out or revocation can end it sooner. Browser storage also holds a sign-in-change timestamp; the website does not store passwords there.
The app uses device/browser storage for entries, settings and account state. Clearing it can remove local data. Browser controls let you remove cookies; export entries before clearing app storage. Blocking essential storage can prevent features from working. The public website code adds no advertising or audience-analytics tracker.
Microphone, camera and file permissions support features you choose, such as voice notes and attachments. Notification permission supports app messages. Manage these in your device settings.
Detailed diagnostics can include counts, durations, activity and errors, which can reveal religious-practice patterns. The diagnostics channel does not automatically send private journal text or recordings; account saving is separate. Changing diagnostics sharing does not erase synced entries or all ordinary operational records.
Retention and recovery copies
These criteria explain why information is kept. Fixed automatic expiry is not configured for every category. Session expiry does not delete an account.
| Information | Retention criteria |
|---|---|
| Local entries and exports | Controlled by your app/device storage and delete controls. Exports remain where you saved them until you remove them. |
| Authentication, identity links, profile and active online records | Kept to operate the account and requested features. A verified deletion request must address these and provider-held authentication data. |
| Historical sync versions, legacy backups and recovery copies | Kept for restoration and investigating data loss. Older copies can remain after an entry is deleted. There is no automatic age-based expiry; deletion and restriction requests must address these copies. |
| Circle contributions and membership | Kept for shared features and moderation while relevant. Deletion requests include assessing removal or anonymisation of associated contributions and effects on other members. |
| Diagnostics, security and operational records | Kept according to troubleshooting, abuse-prevention and security needs. Withdrawing diagnostics affects future detailed reports and supported diagnostic records, rather than all service records. |
| Support and privacy-request records | Kept to resolve the request and, where necessary, demonstrate its handling or deal with a dispute. Continued retention must be assessed when responding to deletion requests. |
If specific information must be retained after a request, the response will identify the information, reason, and period or criteria. Provider backup-removal periods can differ from active-account removal. Retained copies must not silently recreate a deleted account.
Your rights and requests
Subject to the conditions in data-protection law, you can request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests. You can withdraw consent where it is the basis; this does not invalidate lawful processing before withdrawal.
Email support@sanctuarynotes.app with your account email, Sanctuary ID if available, and what you want us to do. You do not need to sign in or reinstall the app. Proportionate ownership checks can protect your information; never send your password.
Prepare a privacy request email ↗This opens a draft. Review and send it from your email app; clicking does not submit a request.
Use Account & data deletion for account removal. The request must consider active information, recovery copies and relevant provider-held data, with lawful exceptions explained.
We will respond without undue delay and normally within one month of receiving a request. A permitted extension for complexity or the number of requests will be explained within that first month and can be up to two further months. Requests are normally free; any permitted refusal or charge must be explained.
You may complain to your local data-protection authority. In Belgium, contact the Belgian Data Protection Authority. Contacting Sanctuary first is not a condition of that right.
Changes and questions
This notice is dated and versioned. Material changes to information use require appropriate notice; updating this page does not replace any new consent required by law.
Questions: support@sanctuarynotes.app. For installation and account issues, visit Help. The privacy and legal page brings the notice, service terms and request routes together.
Operator details
Operator and data controller: Matthew Janssens, operating Sanctuary Notes personally in Belgium.
Contact: support@sanctuarynotes.app.