Effective date: [[EFFECTIVE DATE]]
Vigil is a prayer app. People write things in it that they would not say out loud. This policy explains, in plain words, what Vigil collects, where it goes, and what you can do about it. It describes the Vigil app for iPhone and Apple Watch, version 1.0.
Vigil is published by [[LEGAL ENTITY NAME]], [[POSTAL ADDRESS]] ("we", "us"). You can reach us about anything in this policy at [[CONTACT EMAIL]].
When you first open Vigil, it creates an anonymous account for you automatically. It is just a random identifier. It lets your Vigils and your record work before you sign in.
At the end of setup you can sign in with:
We use your email address to sign you in and to keep your Vigils on your other devices. When you sign in, what you did under the anonymous account is moved to your named account, and the anonymous account is then deleted.
So that Vigil works, and works the same on your other devices, our servers keep:
The prayer themes you choose, and what you write, may reveal your religious beliefs. We treat them as sensitive information. We use them only to run Vigil for you. They are never part of our usage analytics (§4.7), and we never use them for advertising.
An Intention is what you are carrying: the free text you write about it. Vigil encrypts each Intention on your iPhone, with AES-256-GCM, using a key that is kept in your iPhone's Keychain. That key syncs through your iCloud Keychain so your own devices can read your Intentions. We never hold it.
Your encrypted Intentions are stored on our servers so they are not lost. We cannot read them. Their text is never logged by us and never sent to our analytics.
There are exactly two cases. Neither happens before you have answered the screen "What happens to what you write".
a) The safety check. Everything you write in Vigil is checked for signs that you may need help. A simple check on your iPhone always runs, and cannot be switched off. In addition, while Prayers written for you is on in Settings, text you write is sent to our server, which asks Google's Gemini to check it, or Anthropic's Claude on Amazon Web Services if Gemini is unavailable. This happens only if the check on your phone found nothing. Our server does not store or log the text it checks, and it does not tell any person about the result.
b) Prayers written for you (Premium only). If you have Premium, have Prayers written for you on, and have chosen Use what I have written (shown in Settings as Send what I have written), the words you wrote for that prayer are sent to our server and on to Google's Gemini, which writes the prayer. With it we send the themes, length, voice and language you chose. If you have not chosen to share your words, your words are not sent and no prayer is written from your themes: you get a prayer from our reviewed library instead. The one exception is when you ask for a prayer about a Bible passage: then we send the passage's reference, never your words, with the themes, length, voice and language you chose, and Gemini writes a prayer about that passage. On Standard, nothing you write is ever sent to write a prayer.
The prayer that comes back is kept with your account so you can return to it. It is stored on our servers as readable text, not encrypted like your Intentions, and it may reflect what you wrote. It is deleted with your account. Our record of the request keeps a one-way fingerprint of your words, not the words themselves. Every Bible verse in a prayer written for you is checked word for word against our own Bible text. If one does not match, the prayer is discarded and you get one from our reviewed library instead.
[[PROVIDER TRAINING TERMS]]
Your first prayer, during setup, always comes from our reviewed library. No AI service writes it. If you chose Use what I have written during setup, the Intention you wrote there is sent to our server with that request, where a simple word check looks for signs you may need help. It is not sent to any AI service for this, and it is not stored.
To stop the free prayer and our servers from being abused, Vigil uses a random identifier made for this installation and Apple's App Attest service, which lets our server check that a request comes from the real Vigil app. This identifier is not your device's advertising identifier, and it is not used to track you.
You subscribe through Apple's App Store. Apple handles payment, and we never see your card details. We use RevenueCat to keep track of whether your subscription is active. RevenueCat receives your purchase information from Apple and your Vigil account identifier. RevenueCat's software in the app starts when Vigil opens, before you sign in, and sends RevenueCat information about your device and the app, and your IP address. Our server also asks RevenueCat about your subscription using your account identifier. We store your subscription status and the purchase notices RevenueCat sends us.
Where available, if you tap Speak what's on your heart, Vigil uses your microphone and Apple's speech recognition to turn what you say into text you can edit. Vigil requires the recognition to run on your iPhone. The recording is not sent to us or anyone else. What happens to the resulting text is the same as if you had typed it. Repeat-after-me does not use the microphone at all.
To understand whether Vigil works (for example, whether Vigils start on time and run for the length shown), the app sends us short usage events from a fixed list, such as "a Vigil started" or "a Vigil finished", or that a safety screen was shown (§6). Each event carries a random event identifier, an identifier for that run of the app, your language setting and your plan, and details of the event, such as which Form, speed, prayer or voice it concerns, plan changes, and, if the safety screen was shown, which of its buttons you tapped. On our server your account identifier is replaced by a pseudonymous code before the event is stored, so events are not linked to your account.
Usage events never record which prayer themes you chose or which kind of help a safety screen offered. They never contain anything you wrote, or the text of any prayer, and our server refuses any event that tries to carry text, a prayer theme or the kind of help a safety screen offered. There is currently no setting in the app to turn analytics off.
When your iPhone talks to our servers, they see its IP address, as every internet service does. To limit abuse, our server keeps counters keyed by a one-way code made from your IP address, or by your account identifier. Each counter covers a short period, at most a day, and is deleted automatically once that period ended more than 7 days ago; we check daily, so a counter is gone within about 9 days. The counters keyed by your account identifier are deleted when you delete your account. Our hosting providers also keep ordinary request logs as part of running their services. [[RETENTION: BACKUPS AND LOGS]]
If you invite someone to keep a Vigil with you, and they accept, each of you can see: the display name you chose for that link (up to 24 characters), the name the two of you gave the shared Vigil, and whether each of you prayed it today. Day records are deleted after a few days. Your companion never sees your Intentions, your prayers, your times, or your account details. Either of you can leave at any time.
If you report a prayer, we receive which prayer it was and the reason you picked.
Vigil invites you to write to a person at Vigil. If you write to us, we keep your message and email address so we can answer you. [[RETENTION: SUPPORT MESSAGES]]
We use these service providers to run Vigil. They process your information on our behalf and for no other purpose we allow.
The narration in Vigil uses synthetic voices recorded ahead of time from our own library text. The voice provider that renders them (Deepgram) receives none of your information.
We may disclose information if the law requires it, or to protect someone's safety. If Vigil is ever sold or transferred, your information would go with it, under this policy's promises.
If a check finds signs that you may be in crisis, Vigil shows you people you can call or text right now, such as a crisis line or your local emergency number. This is never behind the paywall. Vigil does not contact anyone and does not alert anyone at Vigil about you. Our analytics count that this screen was shown and which of its buttons you tapped, under the pseudonymous code described in §4.7. They do not record which kind of help it offered, and they never include what you wrote.
Vigil is not an emergency, medical, counselling or crisis service, and no one monitors what you write. If you or someone else is in danger, call your local emergency number.
These stay on your phone:
Vigil 1.0 does not read from or write to Apple Health. It does not collect your location, contacts, photos, browsing history or advertising identifier, and it includes no crash-reporting or advertising software.
In Settings, tap Delete your account. To protect you, Vigil asks you to confirm who you are again. Then your account and everything in it (your Vigils, Intentions, record, saved prayers and the prayers written for you) is deleted from our servers right away, and Vigil erases its data from your iPhone. If you had an anonymous account before you signed in, it is deleted too. In the rare case our server cannot finish at once, the deletion completes automatically within 30 days.
What remains afterwards: usage events stored under a pseudonymous code, not linked to your account; abuse-prevention counters keyed by an IP code or an installation identifier, which are not linked to your account, until they are deleted on schedule (§4.8); and records of purchases, which we, Apple and RevenueCat keep.
Deleting your account does not cancel a subscription. Cancel it in your Apple Account settings first, or Apple will keep billing you.
Depending on where you live, you may have the right to ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to take it with you. Write to [[CONTACT EMAIL]] and we will answer within [[RESPONSE TIME]]. We may need to confirm that the request comes from you. We will not treat you differently for using these rights.
Because your Intentions are encrypted with a key only your devices hold, we cannot read or export them for you. You can read them in the app.
If you are in the European Economic Area or the United Kingdom. [[LEGAL ENTITY NAME]] is the controller of your information. We rely on: performing our agreement with you (running Vigil and your subscription); your explicit consent, for sending what you write to the safety check and to write prayers, which you can withdraw at any time with the switches in §9; and our legitimate interests, for security, abuse prevention and understanding whether the app works. You may complain to your local data protection authority. [[EU/UK REPRESENTATIVE, IF ANY]] [[DATA PROTECTION OFFICER, IF ANY]]
International transfers. Our servers and providers are in the United States. If you use Vigil from elsewhere, your information is transferred there, with the safeguards the law requires.
All traffic between Vigil and our servers is encrypted. Intentions are encrypted on your phone before they leave it. Each person's data in our database is walled off so that only their own account can reach it. No AI or voice provider key is ever stored in the app. No system is perfectly secure, and if a breach affects you, we will tell you as the law requires.
Vigil is not directed to children under [[MINIMUM AGE]], and we do not knowingly collect information from them. If you believe a child has given us information, write to [[CONTACT EMAIL]] and we will delete it.
If we change this policy, we will post the new version at this address with a new effective date. If a change is significant, for example sending what you write somewhere new, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.
[[LEGAL ENTITY NAME]]
[[POSTAL ADDRESS]]
[[CONTACT EMAIL]]