Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how the Dova mobile application ("Dova", the "App") collects, uses, and shares information. Dova is the name you see in the App. The App is still published under the Holy365 technical identity (bundle identifier com.holy365.app, website https://get-dova.com). "We", "us", and "our" mean Hughes Zane Ltd., the controller of your personal information, at 128 City Road, London, EC1V 2NX, United Kingdom. Contact: admin@holy365.app.

This policy is written to match the App as of 16 October 2026 and Apple's App Store Review Guidelines as updated on 8 June 2026, including Guidelines 5.1.1 and 5.1.2. It replaces the policy last published on 11 June 2026.

If you do not agree with this policy, do not use the App.

1. What Dova is

Dova is a daily Scripture walk for Christians. You follow a guided path, keep personal prayers, and, if you choose, share encouragement with people you invite or with other signed-in members.

Dova is not a therapy, medical, or crisis service. It is not an AI chat. It does not include a Bible reader, verse highlighter, or saved-verse library. It is not a public social network.

2. Information you give us

2.1 Account

An account is required. You can sign in with an email one-time code, Sign in with Apple, or Google. We receive:

• Your email address. If you use Sign in with Apple and choose Hide My Email, we receive Apple's private relay address, not your personal inbox.
• Your name, if Apple or Google provides it.
• A unique identifier from the sign-in provider.
• The sign-in method (email, Apple, or Google).

We do not receive or store your Apple, Google, or email password. Email sign-in uses a one-time code.

2.2 Profile and onboarding

• The name you ask us to call you (your display name).
• The answer you give about what is drawing you to Scripture, and similar onboarding answers you choose to give. We use these to shape Dova's tone and the path, not to advertise to you.

Your display name is shown to members of a circle you join and on posts you publish in Circles or Community.

2.3 Your writing

• Reflections, prayers, and gratitude you write in a path lesson. These are saved to your journal archive.
• Older journal entries already in your account, including earlier SOAP or free entries and any pastoral note that was stored with them.
• Personal prayer intentions, edits, deletions, and prayers you mark answered.
• The English Bible translation you pick for the passage shown in a lesson.

We do not grade your journal or your prayers. A chapter review may record whether a knowledge question was answered, so the path can advance. That record is not a judgment of your writing.

2.4 Circles and Community

Circles are invite-only groups. Community is a separate feed for signed-in members. If you use them, we store:

• Circle membership, the circle name, your role, and invite codes the circle owner or an admin creates.
• Posts you write (prayers, answered prayers, celebrations, or short encouragement), support you give or remove, and posts you delete.
• Whether you allow your circle to see that you finished today's path node. This shares completion only. It does not share your writing, answers, XP, or prayer text. You can turn it off for a circle.
• Community totals such as how many people walked today. Those totals do not include names and are not a ranking.
• Reports you submit, people you block, and moderation actions on those reports.

Other members can see the posts and display name you choose to share in that space. They cannot see your private journal or your private prayer list.

2.5 Progress

We store path position, completed steps, XP, Dova stage, badges, streak, and grace days. These stay on your account so the path and Dova's growth persist across devices.

2.6 Notifications and feedback

• Whether reminders are on, the times and windows you choose, your time zone, and, if you allow notifications, a push token so we can deliver them.
• Messages you send from Support or feedback, and whether you send them with your display name or anonymously.

2.7 Purchases

Subscriptions and optional tips are processed by Apple (or by Google, where the App is offered on Google Play). We receive a user id, product identifier, subscription status, and whether you are in a trial. We do not receive your full payment card number.

3. Information collected automatically

• App events such as screens viewed, features used, lesson completion, and subscription steps. These events store counts, lengths, and categories. They do not include the words you write in a journal, prayer, circle post, or community post.
• Device type, operating system, app version, locale, time zone, and screen size.
• An IP address, which our analytics provider may use to estimate a coarse region such as a country. We do not collect GPS or precise location.
• Crash and performance reports, which may include an error message and a stack trace.
• Purchase and restore events needed to unlock the subscription.

4. Advertising measurement

We advertise Dova on Meta (Facebook and Instagram) and TikTok. We measure which ads lead to an install, sign-up, trial, or subscription.

On iPhone and iPad, Apple's App Tracking Transparency prompt asks permission before we share data with those partners to measure ads across other companies' apps and websites. Tracking is off until you allow it. The App works the same if you decline.

If you allow tracking, we may share:

• Your device advertising identifier.
• A one-way hash of your email address (a scrambled value that we cannot turn back into the address), so a sign-up can be matched to an ad.

We share that information with Meta and, for the advertising identifier, with TikTok and with RevenueCat's ad-measurement tools. We do not send your journal, prayers, circle posts, or community posts to these partners.

If you decline, we do not share your advertising identifier or email hash for advertising. You can change this later in the device Settings app, under Privacy & Security, then Tracking. Apple's SKAdNetwork may still give us aggregated install counts that do not identify you.

We do not sell your personal information. We do not require tracking in order to use Dova.

5. AI

The daily path does not send your writing to an AI provider. There is no AI conversation in the App.

Entries saved in an earlier version of the App may still show a pastoral note that was generated then and stored with that entry. We keep that note as part of your journal. We do not send it back to an AI provider when you open the archive.

We do not use your journal, prayers, or posts to train AI models.

If we later offer an AI note or Scripture explanation, we will ask your permission before any writing is sent to an AI provider, name that provider, and update this policy first. That is required by App Store Guideline 5.1.2(i).

6. How we use information

We use information to:

• Create and secure your account.
• Show today's path node, save what you write, keep your prayers, and sync them across your devices.
• Run Circles and Community, including invite codes, posts, support, reports, and blocks.
• Show progress, streaks, badges, and Dova's stage.
• Fetch the Scripture passage for a lesson in the translation you chose.
• Send reminders you turned on.
• Provide, restore, and check your subscription or tip.
• Answer support messages.
• Measure how the App is used, fix crashes, and prevent abuse.
• Measure our own advertising, only as Section 4 describes.
• Tell our own admin inbox when a new account is created, so we can operate the service.

We do not use your spiritual writing for advertising.

7. Who we share information with

These providers are required to protect information in line with this policy and with App Store Guideline 5.1.1(i).

• Supabase stores your account, journal, prayers, progress, circle and community data, and preferences, and handles sign-in. https://supabase.com/privacy
• Apple provides Sign in with Apple, the App Store, subscriptions, and notifications permission. https://www.apple.com/privacy/
• Google provides Google sign-in and, where the App is on Google Play, payment processing. https://policies.google.com/privacy
• RevenueCat manages subscription status and entitlements. If you allow tracking, it may also receive device identifiers for ad measurement. https://www.revenuecat.com/privacy
• PostHog (United States) receives usage events, crash reports, your user id, and sign-in method. It does not receive the text you write. https://posthog.com/privacy
• Expo delivers over-the-air updates and push notifications. It receives the push token and app version. https://expo.dev/privacy
• Meta receives the advertising data in Section 4, and only if you allow tracking. https://www.facebook.com/privacy/policy
• TikTok receives the advertising data in Section 4, and only if you allow tracking. https://www.tiktok.com/legal/privacy-policy
• Resend delivers email to our admin inbox when you create an account (email, user id, and sign-in method) and when you send feedback (the message, and your display name and user id unless you chose anonymous). https://resend.com/legal/privacy-policy
• HelloAO Bible API (https://bible.helloao.org) returns the passage for a lesson. The request is the translation and the passage reference. It does not include your account id or your writing.
• Other members see only what you post in a circle or in Community, your display name there, and, if you leave circle walk-sharing on, that you finished today's node.
• Authorities when we believe disclosure is required by law, or to protect users, the public, or our rights.

We do not sell personal information. We do not share your journal or private prayers with other users or with advertisers.

8. Sharing from your device

You can use the system share sheet to share a streak, a circle invite, or a Scripture image. If you save an image, the App asks to add that image to your photo library. It does not read your photo library. After you share, the other app handles the content under its own policy.

9. Sensitive information

Journal entries, prayers, and posts about faith can reveal religious belief. That information is sensitive. We process private writing because you asked us to keep it in the App. We process a post because you chose to share it with the people who can see that circle or feed. We do not use it to build an advertising profile, and we do not make automated decisions that produce legal effects.

10. Storage, security, and retention

Your account data is stored on Supabase. A copy may also sit on your device so the App can open offline and so reminders can fire. Traffic uses HTTPS. Database access rules limit each account to its own rows, except where you have chosen to share a post with a circle or the Community feed.

No method of storage or transmission is perfectly secure.

We keep account data while the account is open. When you delete the account in Settings, we delete the account and the personal data tied to it, including your journal, prayers, progress, preferences, circle membership, and posts you authored, and the App clears its local copy. Deletion does not cancel an App Store or Google Play subscription. Cancel that in the store account settings.

Provider backups are overwritten on the host's ordinary cycle. We do not use a backup to restore a deleted account. Analytics and advertising partners keep their copies under their own retention rules.

11. Your choices

• Access and correction. You can read your journal, edit or delete prayers, change your display name and translation, and delete journal entries in the App.
• Delete the account. Settings includes account deletion. You can also email admin@holy365.app.
• Notifications. Turn them off in the App or in the device settings.
• Tracking. Decline the tracking prompt, or switch it off later under Privacy & Security, then Tracking.
• Circle sharing. Turn off walk-sharing for a circle, leave a circle, delete your posts, report a post, or block a member.
• Community. Delete your own post, remove support, report a post, or block a person.
• Subscription. Manage or cancel it in your Apple ID or Google Play subscription settings. Restore purchases is available on the subscription screen.
• Export or other requests. Email admin@holy365.app. We may need to confirm it is your account.

12. Children

Dova is not for children under 13, and it is not in the App Store Kids Category. We do not knowingly collect personal information from a child under 13. If you believe we have, email admin@holy365.app and we will delete it.

13. International transfers

We and our providers may process information in the United States and in other countries where those providers operate. Those countries may have different privacy laws. Where required, we use appropriate safeguards for the transfer.

14. EEA, UK, and Switzerland

If the GDPR or UK GDPR applies to you, you can ask us to:

• Provide a copy of your personal data.
• Correct it.
• Delete it.
• Restrict or object to certain processing.
• Receive data you provided, in a portable format, where the law gives that right.
• Lodge a complaint with your supervisory authority.

Our bases are:

• Contract. Providing the account, the path, prayers, community features you use, and the subscription.
• Explicit request. Keeping the spiritual writing you choose to store, and showing posts you choose to publish.
• Consent. Tracking, notifications, and saving an image to your photo library. You can withdraw consent in the device settings. Withdrawal does not affect processing that already happened.
• Legitimate interests. Securing the App, preventing abuse, and understanding aggregate use of our own product, balanced against your rights. You can object.

We do not use your information for a decision that is based solely on automated processing and that produces a legal or similarly significant effect.

15. California

If the CCPA / CPRA applies to you, you can request to know, correct, or delete personal information, and you can opt out of sharing for cross-context advertising. We do not sell personal information. We do not share it for cross-context advertising unless you allow tracking in Section 4. Declining tracking is the opt-out. We do not discriminate against you for exercising these rights.

Categories we collect, depending on what you use, include identifiers (email, user id, display name), commercial information (subscription status), internet or device activity (app events), approximate region derived from IP address, and user content you submit (journal, prayers, posts). We use them for the purposes in Section 6.

Spiritual writing may be sensitive personal information under California law. We use it only to provide the feature you asked for, not for advertising.

To make a request, email admin@holy365.app.

16. Other U.S. state privacy laws

Residents of states with consumer privacy laws may have similar rights to access, delete, correct, and appeal a refusal. Email admin@holy365.app. We will not discriminate against you for a lawful request.

17. What we do not do

• We do not sell your personal information.
• We do not collect precise location, and we do not track you in the background.
• We do not access the camera, microphone, contacts, or calendar.
• We do not read your photo library.
• We do not offer a Bible highlighter, saved verses, or verse notes.
• We do not send your writing to an AI provider as part of the current daily walk.
• We do not use your writing to train AI models or to target ads.

18. Changes

We will post updates at https://get-dova.com/privacy and change the date above. If a change is material, we will also tell you in the App or by email when we have a practical way to do so. If we start sharing personal data with a new kind of third party, including an AI provider, we will ask permission before we do.

19. Contact

Hughes Zane Ltd.
128 City Road, London, EC1V 2NX, United Kingdom

Email: admin@holy365.app

Privacy Policy: https://get-dova.com/privacy

Terms: https://get-dova.com/terms