Privacy Policy

In one sentence

Guiding Light is built so we can’t read your journal entries, and we don’t try.

In a few more

Your journal entries are encrypted on your iPhone with a key only you hold. We don’t have a copy of that key. We don’t run analytics on what you write. We don’t sell your data. We don’t show you ads. The few moments when something does leave your device — when you ask the reflective companion for a question, when you download narrated audio — we explain below.

What stays on your device

• Journal entries. Encrypted with AES-256-GCM. The encryption key lives in your iPhone’s Keychain, gated behind Face ID, Touch ID, or your device passcode. The key is bound to this device and never leaves it — not to iCloud, not to us, not to anywhere.
• Encrypted “looking back” reflections you write when marking a prayer answered. Same encryption.
• Audio downloads. Once an audio narration is on your phone, it stays there and plays without contacting us. You control which translations and voices are downloaded.
• Your master key. We can’t read your entries. Neither can anyone else with our cooperation, including in response to a legal request, because we don’t have access. If you lose your device and key, your encrypted entries cannot be recovered.

What is not encrypted on your device

A few pieces of metadata stay in plaintext on your phone so the app can function without unlocking on every screen:

• The date and time of each entry
• Which “mode” the entry was written under (e.g., Prayer Journal, Gratitude)
• The character count
• Detected theme tags (e.g., “anxiety”, “gratitude”) — extracted by simple keyword matching on this device, never sent anywhere
• Whether the entry has been marked as an answered prayer, and when

These never leave your device either, but they aren’t behind the encryption boundary.

What we collect

Effectively nothing about you, individually. No accounts in V1.0. No usernames. No analytics SDKs (no Mixpanel, no Amplitude, no Firebase Analytics, no Segment, no Sentry-with-user-attribution, no Google).

The only data ever sent off your device, and only when you take the corresponding action, is described in “Third-party services” below.

Third-party services

Anthropic — reflective companion

When you write a journal entry and Guiding Light shows you a reflective question or related scripture, the text of that entry is sent to Anthropic’s Claude API to generate the question. This is the only time the plaintext of an entry leaves your device.

Per Anthropic’s API terms in effect as of July 5, 2026, API submissions are not used to train Anthropic’s models. Anthropic retains data only for limited periods for abuse-detection and safety purposes. You can read their policy at https://www.anthropic.com/legal/privacy.

You can opt out of the reflective companion at any time by turning on Local-only mode in Settings → Privacy. When Local-only mode is on, no entry text is ever sent to Anthropic, full stop. You’ll see a small “Local-only mode” notice in place of the reflective companion’s questions.

OpenAI — audio narration (premium voices)

Premium narrated audio of public-domain Bible translations (WEB, KJV) is generated on demand using OpenAI’s text-to-speech API (gpt-4o-mini-tts). When you tap play on a passage in a premium voice for the first time, the passage text is sent to OpenAI, the audio it returns is cached on your device, and every replay from that point on is offline. Free-tier narration is rendered entirely on your device by Apple’s built-in speech synthesizer and involves no network call at all.

No journal content is ever sent to OpenAI — only the public-domain scripture text being narrated. Per OpenAI’s API terms in effect as of July 5, 2026, API submissions are not used to train their models. You can read their policy at https://openai.com/policies/privacy-policy.

(In a future release we plan to migrate premium narration to ElevenLabs, with audio generated once on our servers and bundled into a downloadable audio library — at that point no narration request will originate from your device at all. The local-playback promise is unchanged either way: we never see what you listen to.)

Apple — App Store and device services

When you install Guiding Light, Apple processes your purchase and download under Apple’s privacy policy. We receive only the aggregate, anonymous App Store reports Apple provides to all developers (downloads, crashes, country breakdowns). These reports never include who you are or what you wrote.

If you choose to share crash logs with developers in your iOS Settings, Apple may send us anonymized crash diagnostics. These contain no journal content and no personally identifying information.

No one else

We do not use any other third-party services that receive your data. No ad networks, no CRM, no marketing tools, no behavioral analytics.

Local-only mode

You can turn on Local-only mode in Settings → Privacy. When Local-only mode is on:

• Reflective companion is disabled (no entry text leaves your device for AI)
• No future cloud-sync feature will be enabled on your account

The app remains fully usable in Local-only mode. You give up AI-generated reflective questions; you keep everything else.

What we never do

• We do not sell, rent, or trade your data with anyone.
• We do not show you advertising, in-app or otherwise.
• We do not build a profile of you for targeting purposes.
• We do not transcribe voice journaling to any third-party speech-to-text service. Voice transcription, when added, will be on-device only.
• We do not pre-fetch or “warm up” your journal in the background. Decryption happens only when you open an entry.
• We do not include your journal content in crash reports.

Children

Guiding Light is intended for users age 13 and older. We do not knowingly collect any information from children under 13. If you believe a child under 13 has used the app, contact us at support@frozengrape.app and we will work to address it. Because we don’t have accounts or server-side data in V1.0, there is generally no information to delete — but we will help.

Your data is yours

• Export. Settings → Privacy → “Export as Markdown” or “Export as JSON” produces a complete copy of your decrypted entries to your iPhone’s share sheet. We never see the export.
• Delete. Settings → Privacy → “Delete all entries” permanently removes every journal entry from this device. Because the entries are encrypted with a device-only key, deletion is final — there is no backup we can restore from.
• Uninstall. Deleting Guiding Light from your iPhone removes all of its data, including the master key in the Keychain. After uninstall, encrypted entries on the device cannot be recovered.

Legal requests

If we are presented with a valid legal request for journal content, we can only provide what we have, which is nothing — we hold no copy of your entries, no key to decrypt them, and no server-side store of your activity. If you have asked the reflective companion a question, Anthropic may have retained that submission per their own retention policy; in that case, the request should be directed to Anthropic, not us.

International users

Guiding Light is operated from Texas, United States. If you use the app from another country, you understand that the app may transmit data (such as a Claude API request) across borders to the United States. Where the GDPR, UK GDPR, or comparable law applies to you, you have the rights described in those laws (access, rectification, erasure, restriction, portability, objection). Because we hold almost no data about individual users, most requests will be a matter of confirming that we have nothing to act on.

To exercise these rights, contact support@frozengrape.app.

Changes to this policy

We will update this policy when the app’s behaviour changes — for example, when cloud sync ships in a future version. We will note the new effective date at the top and, where the change is material, surface a notice inside the app the next time you open it. Continued use after a change means you accept it; if you don’t, you can uninstall the app and export your data first.

Contact

Questions or concerns about this policy:

Bergy Media
support@frozengrape.app

We read every email.