Last updated: September 26, 2026
Your private prayers are encrypted on your device. Your journal, reminder titles, small-group messages and Bible Chat history are encrypted before they leave your phone or browser, and we cannot read them. Some things are not encrypted because they are meant to be seen by others, such as posts on the public Prayer Wall and your church's announcements and events; this policy lists them. We do not sell your data, we do not show ads, and we do not track you across other apps or websites.
Praying (the app, the web app at app.praying-app.com, the church dashboard at church.praying-app.com and this website) is operated by Graystar Labs SRL, a company registered in Romania. Graystar Labs SRL is the data controller for the personal data described in this policy. You can reach us about anything in this policy at support@praying-app.com.
We do not collect your contacts, location, photos, microphone or advertising identifiers.
This content is encrypted on your device with keys we do not have, before it is uploaded. Our servers store only the encrypted version.
This is not a policy choice — it is an architectural decision. We do not possess the encryption keys needed to decrypt your private or small-group content.
Church feeds work differently. Feed posts are encrypted too, but so that every member of your church can read the feed, including people who join later, our servers keep an extra copy of each feed's key, locked in AWS Key Management Service. It is used for one thing only: giving that key to a verified member of the feed whose app doesn't have it yet. Nobody who isn't a feed member can obtain it through the app, including our own staff accounts, and every use is logged. So church feeds are private to your church, but they are not zero-knowledge the way your journal, Bible Chat and small groups are.
Reports. If you report a post, comment or message, the text you are reporting is sent to our moderators in readable form, even if it came from an encrypted group or feed, so they can review it. The app tells you this before you send a report.
The following is protected in transit and encrypted at rest on our servers, but it is not end-to-end encrypted, which means our systems can read it. Most of it is meant to be seen by other people.
Who can see what. Other members of a small group can see your name (never your email address). If you block someone, your block list is stored privately with your account so it applies on all your devices; the person is not told. Your church's leaders can see the names of its members, and church administrators can also see members' email addresses. Anyone can read the public Prayer Wall, including people without an account.
Not all content on the platform has the same privacy level. The level depends on what you choose to do with it:
You always choose the level. We never make private content public or share group content outside the group. If you share a journal entry to the Prayer Wall, the shared copy is public.
Before you first use Bible Chat, the app asks for your consent, and you can withdraw it at any time in Settings. When you send a message, the app sends it to our servers over an encrypted connection together with your last few messages in that conversation, so the answer has context. Our servers pass them to Amazon Bedrock, which runs Anthropic's Claude model inside AWS data centers in the European Union. Your name, email and account details are not sent to the model. A safety filter checks messages and answers for harmful content.
We do not store your messages in readable form after the answer is delivered. Your conversation history is encrypted on your device, and it syncs to our servers only in that encrypted form, so you get it back on your other devices. Amazon Bedrock does not use your messages to train models and does not share them with Anthropic. To apply your plan's limit we count how many chats you send each day and month; these counts contain no message text and expire automatically.
We do not sell or share your personal data for anyone else's own use. These companies process data on our behalf, only to run Praying:
Our own servers and data are in the European Union (AWS Frankfurt). Some of the providers above may process data in other countries, including the United States. Where they do, we rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
To understand how the app is used, the app sends us anonymous events such as "a journal entry was saved" or "the plans screen was viewed". We keep only daily totals per event and platform (for example, how many journal entries were saved on Android today), plus how many people who installed the app 1, 7 or 30 days ago opened it today. These totals contain no account ID, device ID or IP address, and they cannot be linked back to you. We use no third-party analytics or advertising tools.
If you allow push notifications, we store your device's push token so we can send reminders and updates from your groups and church. You can turn notifications off in Settings or in your device settings. We also send email through Amazon SES: sign-in and password-reset codes, prayer reminders, invitations, and announcements from churches you belong to. Our daily verse email is opt-in: new accounts are not subscribed, and you get it only if you turn it on while setting up the app or later in Settings. You can turn newsletters off in the app's Settings or unsubscribe from any email, and turn reminder emails off in the web app's Settings.
If you subscribe to our newsletter or send us a message through this website, we store your email address, your subscription preferences and, if you give them, your name and message. We use Amazon SES to deliver emails. You can unsubscribe at any time from any email.
We use the Apple App Store and Google Play for Personal and Family subscriptions (mobile only), managed through RevenueCat, and Stripe for Church subscriptions (web). We never see or store your credit card details. Apple, Google, and Stripe handle all card processing and invoicing on their own infrastructure.
Your encrypted data is stored as long as your account exists. You can delete your account at any time from Settings. Deletion removes your account and your data (encrypted entries, metadata, and profile) from our live systems right away. Copies may remain in encrypted backups for up to 35 days, after which they are permanently erased.
A few records that other people's content depends on, such as a "prayed" mark on someone else's post or a report you filed that a moderator has already reviewed, keep only an internal ID that no longer links to any account. If you pay for a church's subscription, cancel it before deleting your account; the church keeps its plan until the paid period ends.
Other retention periods: public Prayer Wall posts and their comments are removed after 30 days. Server logs are kept for up to 90 days. When you delete a single journal entry or conversation, an encrypted record of it may stay on our servers, still unreadable to us, until you delete your account, so that your other devices learn about the deletion. If you unsubscribe from a newsletter, we keep a record of the unsubscribe so we do not email you again. See Delete your account for every way to request deletion, including without the app.
Under the EU General Data Protection Regulation (GDPR) and similar laws, you have the right to access your data, correct it, delete it, receive a copy of it (portability), restrict or object to how we process it, and withdraw any consent you gave. You can do most of this yourself:
For anything else, email support@praying-app.com from your account's email address. We answer within one month. You also have the right to complain to a data protection authority; in Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
Why we process your data. We process your account, content and subscription data to provide the service you signed up for (performance of a contract). We process crash reports, server logs and moderation reports for our legitimate interest in keeping Praying secure and working. We rely on your consent for Bible Chat, push notifications and newsletters. We keep billing records where the law requires it.
You must be at least 13 years old to use Praying. If you are under the age of digital consent in your country (for example 16 in Romania and some other EU countries), you may use Praying only with the consent of a parent or guardian. If you believe a child is using Praying without that consent, email support@praying-app.com and we will delete the account.
All connections use TLS. Private content is encrypted on your device with AES-256-GCM, and our databases are encrypted at rest. If you turn on Face ID or fingerprint unlock, your password is kept in your device's secure keychain so it can unlock your prayers on that device. No system is perfectly secure, but because your most private content is encrypted before it leaves your device, a breach of our servers would not reveal it. See How Encryption Works for details.
We will update this policy if our practices change and change the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.
Questions about privacy, or a request about your data? Email us at support@praying-app.com. Praying is operated by Graystar Labs SRL, Romania.