DRAFT — not yet reviewed by a lawyer.

Cathora

Privacy Policy

What Cathora keeps about you, why, who helps us run it, and how to see, move or delete it.

Last updated 29 September 2026.

Cathora is a Catholic companion for prayer, formation and building a life of work well offered to God. Much of what you do in it is personal: your prayers, intentions and journal. We have built Cathora so that the most private things stay private by design, and we collect only what the app needs to work. This policy explains it plainly. If anything is unclear, write to [email protected].

1. Who we are

Cathora (the website at cathora.com, the web app at app.cathora.com and the Cathora apps for iPhone and Android) is made by Amaete Venture Studios, [Entity type — to confirm], [Registered address — to confirm] (“we”, “us”). We are the controller of the personal data described here. Our privacy contact is [email protected].

2. The short version

We do not sell your personal information, we do not share it for advertising, and Cathora has no ads.
We do not use third-party analytics or tracking. If we ever add analytics, we will update this policy first and tell you.
Confession notes never leave your device. Your journal and personal prayers are encrypted before they are stored.
Intentions are private unless you choose to share each one.
Cathora’s own staff tools never show your journal, personal prayers, private intentions or Confession notes.
You can export everything, or delete your account and all of its data immediately, from Settings → Privacy and data.

3. What we collect

Because Cathora is a Catholic app, simply having an account may reveal your religious beliefs, which data protection law treats as a special category. We ask for your explicit consent to this when you sign up, and we use it only to provide Cathora to you.

Account

Your name, email address and password. Your password is stored only as a secure hash by our authentication system; nobody at Cathora can read it. For each signed-in session the system also records the device and browser type, IP address and approximate country, so sessions can be secured and ended.

Why: To create your account, sign you in and keep it secure (contract; security is our legitimate interest).
How long: Until you delete your account. Session records end when you sign out or the session expires.

Profile

What you choose to show other members: display name, headline, company, location (a city you pick), patron saint, favourite devotions, what you can help with or are looking for, and who may see your profile (all members, only your connections, or only you).

Why: To let you take part in the community on your terms (contract).
How long: Until you change it or delete your account.

Preferences

Settings such as time zone, text size, theme, clock and weather choices (including the city you choose for weather), which reminders you want and at what times, and your newsletter choices.

Why: To make Cathora work the way you asked (contract; newsletter choices are your consent).
How long: Until you change them or delete your account.

Journal

Your journal entries, their dates and tags. Each entry is encrypted (AES-256) before it is stored and is readable only through your own account. If you add a passphrase lock, entries are encrypted on your device with a key only your passphrase opens, and we cannot read them at all.

Why: To keep your journal for you (contract, and your explicit consent for religious information).
How long: Until you delete an entry or your account.

Intentions

Prayer intentions you write, their category, and how widely you share each one: private (the default), your family, groups you choose, the whole community with your name, or anonymously. When someone prays for a shared intention, we record that privately so you can see a gentle count; we never show who.

Why: To keep and, only if you choose, share your intentions (contract and explicit consent).
How long: Until you delete the intention or your account.

Personal prayers

Prayers you write or save in Personal Prayers, and your prayer sets. The text is sealed (encrypted) before it is stored.

Why: To keep your prayers for you (contract and explicit consent).
How long: Until you delete them or your account.

Prayer progress and history

Where you are in a novena, the Rosary, the Stations or Adoration; private records such as “Rosary completed” or “Novena day 3”; and, only if you record them, the dates you went to Confession (dates only, never content).

Why: To pick up where you left off and show you your own history. We never score, rank or compare anyone’s prayer (contract and explicit consent).
How long: Until you delete your account.

Community

Posts, questions, prayer requests, testimonies, events and your RSVPs, comments, “I prayed for this” marks, 1:1 messages, connections and introduction requests, family and prayer-group memberships, prayer-cell “I prayed” marks, company listings, and members you block.

Why: To run the community features you use (contract). Blocking and moderation also protect members (legitimate interest).
How long: Until you delete them or your account (see section 10).

Reports and moderation

If you report something, the report (what, why, and any note you add). If content is reported, a moderator sees that content and, for a reported conversation, only the reported member’s messages to the person who reported them.

Why: To keep the community safe (legitimate interest; for serious harm, legal obligation).
How long: As long as needed for safety. If you delete your account, reports you filed are kept without your name.

Invitations and Founding Members

Your personal invite code, who joined with it and whether their invitation qualified, any free-month credit you earned, and your Founding Member number.

Why: To credit invitations fairly (contract). To check that an invitation qualified we look only at whether the new member prayed on three different days, never at what they prayed.
How long: Until you delete your account. Your Founding Member number is kept without any link to you so numbers are never reused.

Reminders (push notifications)

For each device where you switch reminders on: the address the device’s push service gives us and its encryption keys, or for our iPhone and Android apps the device token Apple or Google issues, plus the device type. We also keep a short log of which reminders were sent, to avoid duplicates. The log never holds message content.

Why: To send the reminders you asked for (consent, which you can withdraw by switching reminders off).
How long: Until you switch reminders off on that device, the push service tells us the device is gone, or you delete your account.

Your email address and the emails we send you (welcome, account and, if you chose them, newsletters). If you sign up for the newsletter on cathora.com without an account, we keep your email, optional first name, the editions you chose and when you confirmed or unsubscribed.

Why: To send account emails (contract) and newsletters you asked for (consent).
How long: Account emails: until you delete your account. Newsletter-only sign-ups: until you ask us to delete them; after you unsubscribe we keep a record only so we don’t email you again.

Technical and security records

Our network provider, Cloudflare, processes your IP address and request details (such as browser type and page requested) to deliver Cathora and protect it from attacks. Our own servers keep short-lived technical logs for troubleshooting. We keep an audit log of actions taken by Cathora staff in Cathora Admin (for example, hiding a post); it can include your account id if staff acted on your account.

Why: To run Cathora securely and hold our staff accountable (legitimate interest).
How long: Technical logs: a few weeks at most. The staff audit log is kept for accountability, also after an account is deleted.

Backups

A nightly backup of Cathora’s database, kept on our server and, when switched on, copied to a private Google Drive account controlled by us.

Why: To recover from failures (legitimate interest).
How long: The last 14 nightly backups on our server and the last 30 off-site. Data you delete disappears from backups as they rotate out, within about 30 days. We restore backups only to recover from a failure.

4. What stays on your device

Confession notes are encrypted in your browser or app and stored only on that device. They are never sent to Cathora and are not in exports or backups. You can erase them at any time from Confession. Deleting your account cannot reach them, so erase them on each device.
Offline copies: to work without a signal, Cathora may keep copies of pages such as today’s readings, prayers and your personal prayers on your device. They are removed when you sign out.
Location: if you let Cathora use your location (for weather, or to find churches near you), your device sends the coordinates to our server only to make that one lookup; weather uses coordinates rounded to about 1 km. We don’t store your device location, and results are kept briefly in memory without any link to you.
Small settings such as your theme or reading size may be remembered in your browser’s storage. Cathora uses one essential cookie to keep you signed in and, if you arrive through an invite link, a cookie that remembers the invite for 30 days. We use no advertising or tracking cookies.

5. How we use it and our legal bases

We use your information only to provide and improve Cathora for you, to keep it secure and safe, and to communicate with you. In the language of the GDPR and UK GDPR:

Contract: running your account and the features you use.
Explicit consent (Article 9(2)(a)): processing information that reveals your faith, which you give at sign-up and can withdraw at any time by deleting your account.
Consent: newsletters and reminders. Withdraw it any time in Settings or with the unsubscribe link.
Legitimate interests: security, preventing abuse, moderating the community, backups and our staff audit log. We weigh these against your rights, and you can object (see section 9).
Legal obligation: when the law requires us to keep or disclose information.

We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not build advertising profiles.

About AI in Cathora

Some editorial pieces, such as the daily Business Lens, are drafted with the help of AI models (through OpenRouter) from the day’s liturgical calendar and the public list of readings, and are clearly labelled as AI-drafted. No member data is ever sent to an AI service: not your name, journal, intentions, prayers, posts or messages.

Cathora runs on our own server using open-source software (including Appwrite for accounts and data). We share personal data only with the service providers below, only for the purposes shown, and we never sell it.

Cloudflare (network, security and content delivery): all traffic to Cathora passes through Cloudflare, which processes IP addresses and request details.
Verpex (email hosting): hosts our cathora.com mailboxes and sends Cathora’s emails, so it processes your email address, name and the email content.
Push notification services: Apple, Google, Mozilla or Microsoft (depending on your device and browser) deliver the reminders you switch on. Browser notifications are encrypted so the push service cannot read them; for our iPhone and Android apps, Apple Push Notification service and Google Firebase Cloud Messaging deliver the notification. Notifications carry reminder text such as a prayer or group name, never your journal, intentions or personal prayers.
Open-Meteo (weather, optional): receives rounded coordinates or the city you type, never your identity.
OpenStreetMap (maps on Find, optional): your device loads map images from OpenStreetMap’s servers, which see your IP address and the area you are viewing; place searches (what you type, or the area you search around) are sent from our server to OpenStreetMap’s search services without your identity.
Google Drive (off-site backups, when switched on): stores copies of our backups in our private account.
Apple and Google app stores: if you download our apps, Apple and Google process your download and purchase data under their own privacy policies.

Some features use public sources without sending anything about you: the list of daily readings is fetched by our server from the USCCB, and city suggestions come from a copy of the GeoNames database kept on our own server. AI drafting (section 5) sends no member data.

We may also disclose information if the law requires it, to protect someone’s safety, or as part of a merger or sale of Cathora (in which case this policy continues to protect your information and we will tell you).

7. What other members can see

Your profile, according to the visibility you choose. Choosing “Only me” hides it from the member directory.
Posts, comments, testimonies and events you share, with your name (prayer requests and intentions can be shared anonymously; anonymous items never show your name or account to other members).
Intentions you share, with exactly the people you choose. Messages are seen only by you and the person you write to, unless one of you reports them.
Group and family members can see that you belong to the group or family.
Nobody sees your prayer history, novena progress, journal or personal prayers. Prayer statistics appear on your profile only if you switch them on.

8. How long we keep it

We keep your information while you have an account and delete it when you delete your account, except as described in section 3 (staff audit log, anonymous reports, your unlinked Founding Member number) and backups, which rotate out within about 30 days. Content a moderator hides is kept, hidden, so the decision can be reviewed, and is deleted with the author’s account.

9. Your rights and choices

Wherever you live, you can:

See and take your data (access and portability): Settings → Privacy and data → Export my data gives you a JSON file of everything our servers hold for you. Journal entries and personal prayers are decrypted for you; entries under a passphrase lock stay encrypted in the file, and Journal settings can download a readable copy that is decrypted on your device.
Correct it: edit your name, profile, preferences and content in the app.
Delete it: delete single items, or your whole account (section 10).
Object or restrict: ask us to stop or limit processing based on our legitimate interests.
Withdraw consent: switch off newsletters or reminders, or delete your account to withdraw consent for religious information. This does not affect what we did before.
Complain: you can complain to your data protection authority (in the UK, the ICO; in the EU, your local authority). We would be grateful for the chance to put things right first.

To use any right you can’t exercise in the app, email [email protected] from the email address on your account. We reply within one month (45 days for US state requests) and may ask you to confirm it is you. We will not treat you differently for using your rights.

10. Deleting your account

In the app, go to Settings → Privacy and data → Delete my account and type DELETE to confirm. It happens straight away: your account and sign-in, profile, preferences, journal, intentions, personal prayers, prayer history, reminders and devices, invitations and credits, company listings and newsletter sign-up are deleted, and you are signed out.

Your community content is deleted, not anonymised: your posts (with the comments and prayers others added to them), your comments on other posts, your “I prayed” marks, your connections and introductions, and your 1:1 conversations, which are removed for both people. You leave every family and group; leadership passes to another member, and a group left with no members is deleted.

You can also ask us by email: see how to delete your account.

11. Where your data is stored

Cathora’s server is in [Server location: United States — to confirm]. If you use Cathora from elsewhere, including the UK or European Economic Area, your information is transferred there. Where the law requires, we protect such transfers with the European Commission’s Standard Contractual Clauses (and the UK Addendum) or rely on providers certified under the EU-US Data Privacy Framework and its UK extension.

12. Security

Cathora’s database is never exposed to the internet: only our app servers reach it, and all traffic is encrypted in transit (HTTPS). Journal entries and personal prayers are encrypted at rest, Confession notes never leave your device, passwords are hashed, and staff access is limited by role and recorded in an audit log. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

13. Children

Cathora is for people aged 13 and over, and everyone confirms their age when they sign up. We do not knowingly collect personal information from children under 13. If you live somewhere that requires a parent’s permission at an older age (up to 16 in some EU countries), please use Cathora only with it. If you believe a child under 13 has an account, email [email protected] and we will delete it.

14. California and US state privacy rights

In the last 12 months we have collected the categories described in section 3: identifiers (name, email, account and device ids, IP address); personal records; characteristics that may be protected (religious belief); internet activity within Cathora (pages used, for security); approximate location (a city you choose, rounded coordinates for weather); and the content you create. Sensitive personal information (your account login, and religious beliefs) is used only to provide Cathora to you, so there is nothing to “limit”.

We do not sell personal information and do not “share” it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the information of anyone under 16. Residents of California and other states with privacy laws have the rights in section 9, including to know, delete, correct and not be discriminated against; an authorised agent may act for you with your signed permission. We honour Global Privacy Control signals, though since we don’t sell or share data there is nothing for them to switch off.

15. Changes to this policy

We will update this policy when Cathora changes, for example before adding analytics or a new service provider. If a change is significant we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.

16. Contact us

Amaete Venture Studios, [Registered address — to confirm]. Privacy questions and requests: [email protected]. Anything else: [email protected] or our support page.