Privacy Policy

Who is responsible

Carinex AB (org. no. 559575-5603) develops OrthoLife and is the data controller for the personal data processed in the app and on this website.

Carinex AB
Turebergs Allé 43, Lgh 1209
191 64 Sollentuna
Sweden
Email: support@ortholife.app

Write to us at that address with any question about your data, or to use any of the rights described below.

What we process, why, and on what legal basis

Linked to your account:

• Account — your email address, your password (stored only in hashed form) and a random user ID. Used to create and run your account, sign you in, and send the emails the account needs, such as your sign-up code. Basis: performance of our contract with you (GDPR art. 6(1)(b)).
• Profile — the country you choose when you register and, if you add them, a display name and your city. Your display name is shown to other users next to what you write. Basis: contract (art. 6(1)(b)).
• Church tradition, church and parish — the tradition you choose when you register (Coptic Orthodox or Syriac Orthodox) and, if you add them, your church and parish. Used to give you the calendar, feasts, fasts and news of your own tradition. This is sensitive data; see the next section.
• What you save and read — saved verses and quotes, bookmarks, reading history, your progress, favourite churches and the users you have blocked. Synced to your account so that they follow you to a new phone. Basis: contract (art. 6(1)(b)).
• What you write and share — comments and likes on the news feed, messages and images in the parish chat, news posts if you are a church administrator, reports you send, and applications to become a church administrator. Used to show your content to the people it is meant for and to handle your application. Basis: contract (art. 6(1)(b)). Reviewing reports and moderating content rests on our legitimate interest in keeping the community safe (art. 6(1)(f)).
• Purchases — whether you have Premium, which plan, and the events of your subscription (purchase, renewal, cancellation, refund) as reported by the store through RevenueCat. Your user ID is also your customer ID at RevenueCat. We never see your card details. Basis: contract (art. 6(1)(b)), and legal obligation (art. 6(1)(c)) for accounting records.
• Server logs — when you register, sign in, renew your session, verify a purchase or delete your account, our server logs your IP address, your device’s user agent, the time and the outcome. Used to protect accounts and find faults. Basis: legitimate interest (art. 6(1)(f)).
• Emails to support — your email address and what you write to us. Used to answer you. Basis: legitimate interest (art. 6(1)(f)), or contract when it concerns your account or subscription.

Not linked to you:

• Activity counts — while you pray, fast or read, the app registers an anonymous session (a random token, the activity and the time) so that it can show roughly how many others are doing the same. The session carries no user ID and is deleted when the activity ends.
• Onboarding answers — your answers to the introductory questions are added to anonymous totals. They are not stored per person.

Only on your phone:

• Location — if you allow it, the app uses your phone’s location to show churches near you and sort them by distance. The location is used on the phone and is never sent to us.
• Calendar — if you turn on calendar sync, the app writes feast days into your phone’s calendar. Nothing from your calendar is sent to us.
• Notifications — reminders are scheduled on the phone itself. We do not collect a push token.

These three rest on your consent (art. 6(1)(a)), which you give in the phone’s permission dialog.

This website sets no cookies and has no analytics. To deliver the pages, the web server receives your IP address and may record it in its logs (legitimate interest, art. 6(1)(f)).

Your faith is sensitive data

Your church tradition, church and parish reveal your religious belief, which the GDPR treats as a special category of personal data (art. 9). We process them only to personalise the content of the app for you. We never sell them, never use them for marketing and never share them with anyone for marketing.

The legal basis is your explicit consent (art. 9(2)(a) and art. 6(1)(a)), which you give when you choose your tradition and when you add a church or parish. You can change your tradition, and change or remove your church and parish, in your profile at any time. You can withdraw your consent entirely by deleting your account or writing to us.

Because OrthoLife is a devotional app, the fact that you use it, and what you write in comments and chat, can also say something about your faith. We treat all of it with the same care.

Who receives data

We use the following providers. They process data on our behalf and only on our instructions — except Apple and Google as app stores, which handle your purchase as independent controllers under their own terms.

• Supabase — sign-in, database and real-time chat. Our project is hosted on Amazon Web Services in Ireland (EU). Supabase Inc. is a US company.
• Our own servers — the app’s API, our content system (Strapi) and file storage (MinIO) for chat images and audio. Hosted by Hostinger in a data centre in Vilnius, Lithuania (EU).
• RevenueCat (USA) — subscription status. Receives your user ID and the store’s information about your purchase.
• Apple and Google — payment and subscription management through the App Store and Google Play.
• Zoho (EU data centre) — our email: the support mailbox and the emails the app sends, such as sign-up codes.
• API.Bible (USA) and bible.helloao.org — Bible and commentary text. They receive the request for the text and, like any web service, your IP address, but nothing from your account.
• YouTube (Google, USA) and Vimeo (USA) — only when you play an embedded video. They then receive your IP address and information about the playback, under their own privacy policies.
• Apple Maps on iPhone and Google Maps on Android — the church map. The map provider receives the map area shown and your IP address.

Other users see your display name and what you post, in the place where you post it: the news feed or the chat room.

Every third party we share personal data with provides the same or equal protection of personal data as this policy. We share personal data with no one else unless the law requires it — for example on the order of a court or a public authority.

Transfers outside the EU/EEA

Our database and our servers are in the EU. Several providers are based in the USA — Supabase, RevenueCat, API.Bible, Apple, Google and Vimeo — and data may be transferred to or accessed from there, for example for support or maintenance. Such transfers rely on the European Commission’s standard contractual clauses and/or the EU–US Data Privacy Framework where the recipient participates in it.

Security

All traffic between the app and our servers is encrypted (HTTPS). Access to account data and private features is limited by sign-in and by access rules in the database.

Chat messages are encrypted on your phone (AES-256) before they are sent, and are stored encrypted. The key is derived from the chat room’s invitation code, which our servers also hold, so this is not end-to-end encryption: it protects the messages where they are stored, but it does not make them technically unreadable to us. We do not read chats in normal operation. When someone reports a chat message, their app sends us the text of that message together with the report, so that we can judge it.

Chat images are not encrypted in this way. They are kept in our file storage, and only members of the room can open them, through time-limited links.

How long we keep data

• Your account and what is linked to it — as long as you have the account. When you delete it, it is closed at once and erased together with its content after 14 days. Our support page lists exactly what is erased and what is kept.
• Church tradition, church and parish — until you change or remove them, or delete your account.
• Reports — while the report is being handled, and after that as long as needed to prevent abuse. They are erased when the account of the person who sent the report, or of the person whose content was reported, is erased.
• Purchases — our own record of your subscription is erased with your account. Information we must keep as accounting records is kept for seven years, as the Swedish Bookkeeping Act (bokföringslagen) requires. RevenueCat keeps the purchase history linked to your random user ID, and Apple and Google keep their own records under their own terms.
• Server logs — only as long as needed for operation and security, then deleted.
• Emails to support — as long as needed to handle your matter.
• Anonymous activity sessions — deleted when the activity ends. The onboarding totals contain no personal data.

Your rights

Under the GDPR you have the right to:

• access — receive a copy of the personal data we hold about you;
• rectification — have incorrect data corrected (most of it you can edit yourself in your profile);
• erasure — have your data deleted (you can delete your account yourself under Profile → “Delete your account”);
• restriction — have the processing limited, for example while a correction is being checked;
• data portability — receive the data you have given us in a structured, machine-readable format;
• objection — object to processing based on our legitimate interest.

Write to support@ortholife.app, preferably from the address linked to your account. We answer within one month. Uninstalling the app does not delete data stored on our servers, and does not cancel a store subscription.

Withdrawing consent

Where we rely on your consent, you can withdraw it at any time, as easily as you gave it:

• Location, calendar and notifications — turn the permission off in your phone’s settings.
• Church tradition, church and parish — change your tradition, or change or remove your church and parish, in your profile.
• Everything — delete your account in the app, or email us.

Withdrawing consent does not affect processing that took place before.

Complaints

If you think we handle your personal data wrongly, you have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) — imy.se — or to the data protection authority where you live. We would be grateful if you wrote to us first, so that we can put it right.

No ads, no tracking

OrthoLife shows no advertising and contains no analytics, crash-reporting or advertising tools. We do not track you across other companies’ apps or websites, we do not sell or rent out personal data, and we make no automated decisions about you.

Children

OrthoLife is for people aged 13 and over. We do not knowingly collect personal data from children under 13, and if we learn that a child under 13 has an account, we delete it. If the law where you live sets a higher age for giving consent yourself, a parent or guardian must give it for you. If you believe a child has given us personal data, contact us.

Changes

If this policy changes materially, we will say so in the app before the change takes effect. The date below shows when the policy was last updated.