Your data
Privacy
No ads. No tracking. We collect as little as we can, and what you write in your journal is yours.
Last updated 12 October 2026.
Who we are
Mastery of Faith (masteryoffaith.com and @masteryoffaith on TikTok) is run by APPS 365 LTD, a company registered in England and Wales. We are the data controller. Contact: hello@masteryoffaith.com.
What we collect, and why
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Nothing, if you just read, search or listen | - | - | - |
| Your email address (if you sign in) | To send your sign-in code and run your account | Contract | Until you delete your account |
| Your journal and prayer list (only if you choose to keep them online) | So they are safe and on all your devices | Your explicit consent (this is special category data: it may show your faith, and other people's names or health) | Until you delete them, withdraw consent (deleted within 24 hours) or delete your account |
| Your email for the morning prayer (only if you tick the box and confirm) | To send the morning prayer | Your consent | Until you unsubscribe |
| Your time zone (a session cookie) | To show the right prayer for your time of day | Strictly necessary for the service you asked for | Until you close the browser |
| Your IP address, for a moment | To stop abuse (rate limits) and to show the right Bible translation in your country | Legitimate interests | Rate-limit counters are deleted within 3 days; the country lookup happens on our own server and is not stored |
| Messages you send us | To reply | Legitimate interests | Up to 2 years |
Before you sign in, anything you write is kept only in your own browser. We never see it.
Things we never do
- No advertising, no ad networks, no analytics or tracking companies, no Google Analytics.
- We never sell or share your data.
- No AI ever reads your journal or prayer list, and no voice service ever hears them.
- Our fonts are hosted on our own server, so loading a page does not tell any other company about your visit.
How we keep it safe
Journal and prayer-list entries are encrypted on our server (AES-256-GCM). The key is kept apart from the data and is never included in the same backup. Sign-in codes are stored only as one-way keyed hashes, and the emails that carry them are blanked on our side once sent. We keep nightly backups for 14 days, so something you delete (or data removed when you withdraw consent) can stay in an encrypted backup for up to 14 days before it is gone for good. Our site is hosted in the United Kingdom by Fasthosts Internet Limited.
Who processes data for us
- Fasthosts Internet Limited (UK) - hosting, including our email server.
- When we launch them, and only for those features: a payment provider (merchant of record) for Pro on the web; Anthropic (USA) for "Ask", only for questions you choose to send, with your consent; RevenueCat for app subscriptions; a content delivery network for narrated audio. This notice will be updated before any of these start.
Cookies
We use only cookies that are strictly necessary, so there is no cookie banner:
| Cookie | Purpose | Lasts |
|---|---|---|
| mof_csrf | Protects forms from being submitted by other websites | 30 days |
| mof_s | Keeps you signed in (only if you sign in) | 90 days |
| mof_nonce | Makes your sign-in code work only in the browser that asked for it | 15 minutes |
| mof_tz | Your time zone, for the right prayer at the right time | Until you close the browser |
On https these cookies have the __Host- prefix. Your light/dark reading choice is kept in your browser's local storage, not a cookie. How someone arrived (for example from our TikTok bio) is passed in the page address, not stored in a cookie.
Your rights
You can download all your data, delete your account, and withdraw consent at any time from your account page (in the phone app: More, then Your account, then Delete my account). Deleting your account also stops the morning prayer email. You also have rights to access, correct, restrict or object, and to complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Children
Anyone can read, search and listen. Accounts are for people aged 16 and over.
Changes
If we change how we use your data, we will update this page before the change takes effect, and ask again where the law requires it.