Privacy Policy

1. Operator, scope and contact

CareVia Group LLC, a Texas limited liability company, operates CareVia Verse. Contact support@careviaverse.app for support or privacy@careviaverse.app for privacy requests. Mailing address: CareVia Group LLC, 5900 Balcones Dr #15924, Austin, TX 78731, United States. Do not send passwords, verification codes, payment-card details or unnecessary sensitive information.

This policy covers our Bible-reading and Bible-learning application, supporting website and associated account services. It describes our current processing and clearly identifies inactive features. It is not a claim of store approval or legal certification. Account registration is limited to users aged 13 and older; users under 13 may not register.

Bible Reading and core Bible Quest are free. Purchases are implemented and have been tested through Apple TestFlight sandbox and controlled Google Play testing; general production purchase availability remains restricted. The 32-avatar catalog and rewarded-ad integration are implemented but release activation remains disabled. Availability depends on platform, release and authorization; these descriptions do not activate a feature.

2. Accounts, free reading and information you provide

You may read the King James Version (KJV) and World English Bible (WEB) without an account, without advertisements or purchases in Bible Reading. Guests cannot save notes, bookmarks or highlights; guest reading history and position last only for the current session. Device appearance settings may persist. Quest and optional music require sign-in.

• Account and authentication: email address, Supabase Auth identifier, verification and session information, and profile/settings. Supabase handles authentication; sensitive changes require the existing recent-authentication and verification procedures.
• Reading: account-saved history, position, translation, bookmarks, highlights, notes and their text, and reading progress. Account-specific local caches and Supabase synchronization support returning to your saved reading.
• Quest and inventory: answers and attempt evidence, lesson results, XP, achievements, Quest Day Streak, coins, gems, hearts and regeneration timing, chests, equipment and reward records. When avatars are released, this includes ownership, equipped avatar and acquisition history for the 32-avatar catalog.
• Social and safety: chosen username/display name, visibility choices, friend requests and relationships, blocks, predefined encouragements, leaderboard participation, reports, restrictions, moderation decisions, appeals and audit records.
• Purchases: platform/product and transaction identifiers, RevenueCat customer identity associated with your account, environment, purchase intents, verification, delivery, refund and support-review records. Apple and Google handle payment. We do not receive or store complete payment-card details through this purchase flow.
• Communications and preferences: inbox messages, optional-email choices, unsubscribe and suppression state, delivery receipts, provider feedback and support correspondence; music, sound and reminder preferences. Optional music uses short-lived authorized playback links. Administrators manage shared music files; these are not personal user uploads.
• Technical information: network/IP information, device/platform and app version, request timing/status, authentication/security events and sanitized diagnostics used by the application or its providers. We do not claim that every provider log has the same retention or that every device cache is encrypted.

Bible notes and reading activity can reveal religious beliefs and other sensitive information. We use them to provide requested reading services, not to target advertising or infer an advertising profile.

3. Why we use information

We process information to authenticate and administer accounts; save and synchronize reading; operate and verify Quest, rewards and inventory; provide requested social features; verify purchases and prevent duplicate delivery or fraud; moderate abuse and review appeals; deliver authorized communications and support; protect security; and fulfill verified privacy requests and legal obligations. Optional announcements require applicable consent. Necessary individual support and operational notices do not rely on optional-announcement opt-in. Reminder preferences are separate, and automated reminder sending remains disabled.

4. Social visibility and your choices

Profiles start private; social, discovery and ranking opt-ins default off. Public rankings require the relevant public-profile and ranking choices. Friends rankings require accepted friendship and the applicable opt-ins. A private participant may share ranking statistics with eligible friends without exposing private cosmetics or reading information. Disabling social stops new interactions but does not erase previously shared friend identities. Blocking removes the relationship and prior encouragements and prevents further interaction. Encouragements use predefined phrases, not open chat. Reading notes and private reading history are not public leaderboard content. Others may remember information previously visible to them.

5. Providers and disclosures

• Supabase: authentication, account and application database, and private storage for administrator-managed audio; receives the information needed to supply those services.
• Apple App Store / Google Play and RevenueCat: store purchases, platform transaction validation and purchase/customer records used for fulfillment, recovery and refund review. Store and SDK technical data are governed also by their notices.
• Resend: authentication/verification mail and authorized application mail, including recipient address, message content, message identifiers and delivery/bounce/complaint information. Namecheap Private Email handles support/privacy correspondence. Optional email can be declined through the applicable settings or unsubscribe link; security and necessary service notices remain distinct.
• Replit and Expo: hosting/development infrastructure and native build/distribution tooling. Hosting can process requests and technical logs; Expo build tooling is not proof of an independent in-app analytics service.
• Google AdMob, only if activated: optional rewarded-ad delivery and consent tools. See the advertising section below.

We disclose information to service providers as needed for these purposes, to other users only through the social choices described above, and when legally required or reasonably necessary to protect security and legal rights. We do not sell Bible notes or use reading activity for behavioral advertising. This does not settle every state's legal definition of “sale” or “sharing”; advertising data flows and applicable opt-outs must be assessed before activation. Provider privacy information: Supabase, RevenueCat, Resend, Apple and Google.

6. Rewarded advertising — implemented, not activated

Only optional Quest rewarded ads are prepared; Bible Reading stays ad-free and core gameplay does not require watching ads. The disabled path does not initialize the ad SDK. The prepared flow uses self-declared age eligibility (not a date of birth or independent age verification), blocks unknown/minor age bands, refreshes Google's UMP consent information and uses nonpersonalized requests with a general-audience content rating. It does not request Apple tracking authorization or use Bible activity for targeting. Nonpersonalized ads can still involve device/ad identifiers, IP addresses, device characteristics, consent choices and ad interactions. Choosing a reward is not consent to unrelated tracking. Consent, regional privacy choices, platform declarations and the final SDK/provider data inventory require verification before activation. Google explains its processing at How Google uses information from apps that use its services. Prepared server-side reward verification uses account-bound sessions and signed completion evidence; a client event alone does not award a heart.

7. Security

Existing protections include HTTPS-facing endpoints, Supabase authentication, owner-scoped access and database policies, server-side verification of rewards and purchases, idempotency controls, restricted administrative membership and MFA/AAL2, and privileged credentials kept out of browser/mobile code. Native authentication uses secure device storage; other caches use account-scoped storage and are not all claimed to be encrypted. No system or transmission can be guaranteed absolutely secure.

8. Retention and deletion

Account information and saved activity are retained while needed to operate your account and the purposes described here, subject to available clearing controls and verified account deletion. Clearing reading history does not itself delete notes, bookmarks or the whole account.

• Pending moderation reports remain until resolved. Closed public-name reports and associated receipts are retained for 90 days after closure. The moderation appeal window is 14 days; resolved appeals and routine audit/reversal records have separate 30-day rules. Necessary active restriction state is not erased merely because a report expires.
• Eligible completed email history is deleted after 90 days, except emails explicitly marked Keep or under a valid hold. Pending, uncertain, scheduled and processing deliveries remain protected. Minimal provider-to-account safety linkage expires 120 days after confirmed delivery resolution, not 120 days after history deletion; it contains no message subject/body. Cleanup-health summaries expire after 30 days. Consent, unsubscribe and suppression records are separate from message history.
• Purchase verification and duplicate-grant history is not subject to the email-history timer. Account-owned purchase intents, delivery records and support records follow their deletion relationships, including cascading deletion of account-owned transaction hashes. Platform/RevenueCat records are also subject to their own retention. We do not invent a statutory purchase-record retention period or claim an independent permanent financial archive.
• The inactive rewarded-ad design retains resolved failed details for 30 days, delivered details for 90 days and minimal safety linkage for 120 days after resolution; unresolved verified pending benefits and review cases do not auto-expire. These rules do not imply ads are active.

How to request permanent deletion

In iOS or Android, open Profile → Settings → Account → Delete Account (Quest uses the Adventurer Profile). Reauthenticate with the account password, type DELETE and confirm Delete My Account. Use the app's status/recovery controls if interrupted; completion is shown only after confirmed cleanup.

The Account Deletion page and compatible deletion address lead to the existing protected web process. Public web submissions are currently disabled pending domain/HTTPS and verification-flow approval. When enabled, enter your account email, open the single-use expiring verification link in the same browser, then explicitly confirm deletion. Email verification alone never deletes an account. You do not need to reinstall the app to use the web process when available. Contact privacy@careviaverse.app for assistance while it is unavailable; a support email alone is not verified authorization to delete.

Data removed and consequences

Confirmed deletion permanently removes the Auth identity, profile/preferences, saved cloud reading history/progress, notes, bookmarks and highlights, Quest progress/attempts, achievements, personal wallet balances, owned/equipped avatars and collection records, social relationships and account-owned reward records. Account-owned communications and purchase-support records follow the existing deletion relationships. The app clears that account's local session/cache after confirmed completion; other/offline devices reconcile on reconnect, not by guaranteed remote erasure. Shared Scripture, lessons, artwork, shared administrator-managed music and other users' accounts are preserved. Registering again starts a new account.

Timing and narrowly limited retention

Processing starts promptly after verified confirmation; there is no mandatory 30-day waiting period. Interrupted requests retain minimal recovery state. The existing completion target is within 30 days of confirmation, subject to shorter legal requirements; retries do not restart the target, and overdue requests require operator escalation. This is not a guaranteed outage-free completion time.

Completed deletion request/status records and minimal hashed receipts expire 30 days after completion. Physical cleanup runs daily at 08:00 UTC, normally at the next successful run within a further 24 hours; outages can delay physical removal. Those completed records do not contain your email, Bible notes, Quest history or wallet balances.

Ordinary moderation reports do not block deletion. Only specifically authorized evidence required for a genuine legal obligation may be retained separately, with restricted access and an explicit expiry; this does not retain the entire account. Unexpected owned files or unresolved legal-preservation checks leave cleanup pending rather than falsely completed. Account-owned purchase intents and delivery records, including their transaction hashes, cascade with account cleanup; we do not claim a separate permanent financial archive. Deleting an account does not erase independent Apple, Google or RevenueCat records or issue a refund. Provider backups/logs and already delivered emails cannot be selectively erased by deleting live database rows; no unverified backup/log expiry period is promised.

Routine deadlines are eligibility/access-expiry rules; physical removal occurs on the next successful cleanup. Outages can delay cleanup. Provider backups/PITR, operational logs, mailbox content and third-party store records have separate settings; their actual durations remain a release-review item, not a promise that all copies disappear within a fixed period.

9. Privacy rights and requests

Depending on your residence and applicable law, you may have rights to access, correct, delete or obtain a portable copy of data, and to object to or restrict certain processing, withdraw consent, or opt out of sale, sharing, targeted advertising or certain profiling. Email our privacy contact. We verify identity proportionately without requesting passwords. An authorized agent may contact us; proof of authority may be required. We do not discriminate for exercising applicable rights. If we deny a request, ask the same address for an appeal/review; privacy-rights appeals are not limited by the separate 14-day moderation window. Applicable statutory response and appeal deadlines govern. You may also complain to the relevant state Attorney General or data-protection authority.

Texas Data Privacy and Security Act coverage and any small-business exemption depend on legal facts, not simply our Texas location or free reading model. Other U.S. state laws may apply. Sensitive-data treatment, including religious information, requires particular review; no blanket exemption is claimed.

Where the Texas Act applies, requests generally require a response within 45 days, with one additional 45-day extension when permitted and explained within the initial period. Appeals require a written decision within 60 days; if denied, you can complain to the Texas Attorney General. Other applicable laws can provide different deadlines and remedies. These legal deadlines are separate from routine data-retention timers.

10. Children and teenagers

Account registration is restricted to users aged 13 and older. Users under 13 may not register. The registration form requires affirmative confirmation of this eligibility and the app blocks signup requests without it. This is self-declaration, not independent age verification or a parental-consent system, and older installed builds may not contain this safeguard. Guest Bible Reading does not require registration. If you believe a child under 13 supplied personal data, contact privacy so we can investigate and take appropriate action, including deletion where required. COPPA can apply to actual knowledge of under-13 users even in a general-audience service. Teen privacy protections and regional requirements still apply. The separate inactive adult-only ad eligibility control is not account-wide age verification.

11. International users

We are based in the United States, and our providers may process data in the United States or other countries. UK distribution is not planned. If EU/EEA or UK law nevertheless applies, relevant purposes may rely on providing the requested service, legal obligations, legitimate interests assessed against your rights, or consent where required, including special-category and device-access rules. Reading data may reveal religious beliefs; a generic contract basis alone does not resolve special-category requirements. Before expanding to additional territories we must assess applicable lawful bases, contracts, transfer safeguards and representatives where required. Actual provider regions and backup/log settings are not confirmed by the application source; no processing-country guarantee is made. This policy does not claim GDPR/UK GDPR certification or that U.S. safeguards are identical to your local law.

12. Updates

We will update this notice when practices change, show the revision/effective date, and provide additional notice or seek consent where required. Material new uses are not authorized merely by silently changing this page. Contact privacy with questions.

See also Terms of Service, Support and Account Deletion.