Privacy Policy
Divine Mercy Confession
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Divine Mercy Confession stores your examination selections and notes, confession drafts and dated history, journal text, dates and tags, prayer-reading completion dates, and reminder and sync preferences on your iPhone. These records can reveal religious beliefs and other sensitive information. The local records file is encrypted and excluded from device backups by the app. A device-only encryption key and an automatic installation credential are stored in Keychain. The app contacts our Railway-hosted service to obtain that credential and check the versioned prayer and guide library. Encrypted sync is off by default. If you enable it, journal and confession records are encrypted on your device before upload; the service receives ciphertext, random record identifiers, record kind, deletion markers, mutation identifiers and server timestamps. Examination drafts, prayer-reading history and reminder settings are not synced. The service stores a hash of the installation credential and a random installation identifier. Public requests pass through Cloudflare before reaching Railway. These requests expose ordinary connection information, including IP addresses, request times, paths and HTTP headers, to that infrastructure. For rate limiting, our service stores hashed IP-derived keys and request counts. No name, email address or account registration is requested.
How we use information
Local storage supports examination, confession preparation and history, journal editing and search, offline prayer and guide reading, and statistics calculated from your own saved activity. Notification preferences schedule reminders on your device. The installation credential authorizes access only to that installation's encrypted server records. Optional sync preserves an encrypted server copy, applies changes in server acceptance order, and retries queued changes after connectivity returns. Public content requests update the offline library. Rate limits and limited operational error logging protect service availability and help diagnose failures. We do not add advertising, analytics, purchases, outbound messaging or social sign-in services.
Service providers and sharing
The backend runs on Railway and uses a persistent Railway volume for its SQLite database. Cloudflare provides the public HTTPS reverse proxy, terminates TLS and forwards requests to the pinned Railway service origin over HTTPS. Cloudflare, Railway and their infrastructure providers process request headers, operational connection information and the encrypted payloads being transferred to deliver and secure the service. Neither provider receives the app’s record encryption key through the implemented protocol. Our application does not log authorization credentials or record payloads, and its HTTP access log is disabled; hosting infrastructure may maintain its own request and operational logs. The server does not receive your record encryption key and cannot read the encrypted journal or confession text through the app's implemented sync protocol. The app uses Apple's operating-system services for Keychain and local notifications. It includes no third-party advertising or analytics SDK. We do not sell personal data or send it to an email delivery service. We may respond to lawful requests as required by applicable law.
Data retention
Local records remain until you delete them or remove the app's local storage. The app excludes its records directory from device backup, and its encryption key is device-only. Keychain items may remain after app removal according to iOS behavior; the app does not promise cross-device recovery. Active server ciphertext and synchronization metadata remain until you delete the relevant records through sync or delete the server copy. Deleted individual records leave an identifier, deletion marker and sync metadata so older copies do not reappear; mutation receipts remain until installation deletion. Installation deletion removes that installation's active records and credential hash. Rate-limit rows older than two hours are removed when the service next processes rate limiting. We do not operate an app-managed backup or recovery feature. Cloudflare and Railway infrastructure log retention, and Railway backup retention, depend on their services and configuration; we do not state a fixed retention period that we have not verified. Deletion from the active database does not guarantee immediate removal from provider backups or logs, if any exist.
Deleting your information
You can delete individual journal entries and confession records in the app. With sync enabled, deletion is queued and applied to the server when a request succeeds. Turning sync off stops future automatic sync but does not itself delete an existing server copy. In Guide, open Privacy & Sync and choose Delete Server Copy to remove active server records and revoke that installation credential while keeping local records, or Delete All Local & Server Data to erase local records and reminders after server deletion succeeds. Server deletion needs an internet connection; a failed request leaves local records intact. Erase Local Records works offline with sync off and queues deletion markers for a later enabled sync. Without that later sync it does not remove an existing server copy. Erasure cannot be undone. If you lose the installation credential, we cannot identify or restore its encrypted records through an account, because there is no account or recovery system.
Permissions and your choices
The only optional permission requested is notification authorization, and it is requested when you enable a reminder. Reminders are local notifications with general wording; private confession or journal text is not included. Disable either reminder in the app to cancel its scheduled request, or withdraw notification permission in iOS Settings. Core examination, journal, prayer and guide features work without notification permission. The app does not request location, contacts, camera, microphone or photo-library access. You may disable optional sync in Privacy & Sync without losing offline functionality.
Your privacy rights
Depending on your location, you may have rights to access, correct or delete personal data, object to or restrict certain processing, or complain to your data-protection authority. You can inspect and edit your journal and delete records in the app. For privacy questions or rights requests, contact ned.wraith@icloud.com. This address is a public privacy contact; the app does not require your email or send email on your behalf. Please do not send confession details, journal text, encryption keys or installation credentials by email. Because the service stores encrypted records without a personal account, we may be unable to associate a request with an installation or recover content after credentials are lost.
Security
The app encrypts its local records and individual sync payloads with AES-GCM using an encryption key stored in device-only Keychain. The local file uses iOS file protection. Production requests use HTTPS to Cloudflare, which terminates public TLS and proxies to the Railway HTTPS origin. Private record contents remain separately encrypted with the device-held AES-GCM key while passing through this infrastructure. The backend hashes installation credentials, authorizes private operations per installation, validates request sizes and fields, uses transactional SQLite writes and idempotent mutation identifiers, and rate-limits requests. Private payloads and credentials are not written to application logs. Keep your device secure and avoid including unnecessary information about other people. No system can guarantee absolute security, and the app does not claim a security certification or guaranteed recovery.
Children’s privacy
The app is a general Catholic prayer and reflection companion and is not specifically directed to children under 13. It has no registration or age-verification flow and does not solicit a child's name or contact details. A parent or guardian who has a privacy concern may contact ned.wraith@icloud.com. Sensitive reflections should be entered thoughtfully, with appropriate guidance for younger users.
Changes to this policy
We may update this policy when the app's processing or hosting practices change. The current policy is available through the in-app Privacy Policy link and this public page. The effective date identifies the current version. Material changes will be reflected in an updated policy and, where appropriate, in the app. You can continue to use offline features with optional sync disabled.