Quiet Rosary Privacy Policy

Effective date: 9 November 2026

Which version. This policy describes Quiet Rosary 1.1.0 and later. Usage statistics and crash reports (§3.7) and ad measurement (§3.6) start with version 1.1.0; version 1.0 of the app sends neither.

1. Who we are

Quiet Rosary is published by the developer named as the seller and trader on the app’s App Store and Google Play pages (the “controller”, “we”, “us”). We are the data controller for the processing described here. Contact: support@quietrosary.app.

We are established in Italy, so the EU General Data Protection Regulation (GDPR) applies to our processing wherever you live.

2. What stays on your phone

These records are created and stored on your device, and we cannot access them. Usage statistics (§3.7), unless you turn them off, report some events about them (for example a novena day completed), never your intentions or anything you write:

• your Rosary sessions, prayer history and statistics;
• your novenas (which novena, start date, current day) and any intentions you write;
• your reminder times and app settings;
• your answers to the onboarding questions, until you give consent (see §3.1). Your answer to “How did you hear about us?” is also part of the usage statistics (§3.7), as the option you chose.

Widgets, the Lock Screen and notifications show content from this on-device data (for example the current mystery and bead, or “Day 4 of 9”). This content can be visible to people near your phone. Your written intentions never appear on the Lock Screen or in notifications, and appear in widgets only if you turn on “Show my intention on widgets” (off by default). You can also hide the prayer names on the Lock Screen (iPhone) or in the Rosary notification (Android) in Settings.

Reminders are scheduled locally on your device. We do not use a push-notification server.

Backups: if you use iCloud Backup or Google’s device backup, your device’s backup (including this app’s data) is stored in your own Apple or Google account under their terms. We never access it.

3. What we process, why, and on what legal basis

3.1 Subscriptions and purchases (only if you consent)

If you choose to buy or restore Quiet Rosary Plus, we first ask for your explicit consent. Only after you agree does the app connect to RevenueCat, Inc. (USA), which processes purchase data on our behalf as our processor.

Once the app has recorded a purchase, Apple and Google also notify RevenueCat when that subscription renews, is cancelled or is refunded. A purchase you make outside the app (for example an offer code redeemed through Apple’s link) reaches RevenueCat only after you agree in the app.

Your payment itself is handled by Apple (App Store) or Google (Google Play). They are independent controllers under their own privacy policies. We never receive your payment details.

3.2 When you write to us

If you email us, we process your email address, your message and the technical details the app adds to support emails:

• app name, version and bundle;
• device model and operating-system version;
• language;
• your plan;
• your purchase ID (a random code).

You can delete any of these before sending. We use them only to answer you.

• Legal basis: Art. 6(1)(b) (helping you with our service) and Art. 6(1)(f) (our legitimate interest in answering messages).
• Anything sensitive you choose to include, you share by your explicit choice (Art. 9(2)(a)).

3.3 App stores

Apple and Google run the app stores, process your downloads, payments and refunds, and may give us aggregated statistics (such as numbers of downloads) and crash reports from users who chose to share diagnostics with developers in their device settings. These reports do not identify you to us.

3.4 Age checks required by law

Where a law requires it (for example in Texas, USA), the app asks the App Store or Google Play for your age category and, for minors, whether a parent has approved the app. We use this only to comply with the law and adjust the app (for example, we skip optional onboarding questions for minors, and turn off usage statistics, crash reports and ad measurement, §9). We do not store the age category after the check, and we never share it.

3.5 Test versions (only if you join a test)

If you test a pre-release version of Quiet Rosary through Apple TestFlight or a Google Play testing track, Apple or Google gives us your tester email address (and your name, if we invited you by name), your device and app version, crash reports and any feedback you send. We use them only to run the test, and we remove you from the tester list within 30 days after the test ends. Apple and Google process your data under their own terms.

• Legal basis: your explicit consent, which you give when you ask to join (GDPR Arts. 6(1)(a) and 9(2)(a)), because testing a prayer app can reveal your faith.

3.6 Ad measurement with TikTok and Meta (only if you allow it)

We tell people about Quiet Rosary with short videos on TikTok, Instagram and Facebook. To learn which videos work, the app can use measurement tools from TikTok and Meta, but only if you allow it. The app shows a screen that explains this; then your iPhone asks whether to allow tracking (Apple’s App Tracking Transparency prompt). The tools start only if you tap Allow. If you choose Ask App Not to Track, if your iPhone doesn’t let apps ask, or if you are under 18, they never start, and nothing else changes in the app. In some EU countries (Italy, France, Germany, Poland and Romania), on iPhones with iOS 27.2 or later, Apple’s prompt is a full page that shows our own explanation, naming TikTok and Meta.

If you don’t allow it. Apple’s own ad attribution (AdAttributionKit and SKAdNetwork) may still tell an ad network, in grouped form and without any identifier, that one of our ads led to an install and whether a trial or payment followed. Neither we nor the ad network can tell who you are. The app uses Apple’s attribution for everyone, whatever you answer and wherever you live, because it carries no identifier; on devices the app treats as belonging to a minor, it reports only the install.

3.7 Usage statistics and crash reports (Google Firebase; on unless you turn them off)

From the first time you open it, Quiet Rosary sends usage statistics and crash reports to Google Firebase, unless you turn them off in Settings → Privacy and data → Usage statistics and crash reports. We do not ask for your consent for them. They are off on devices the app treats as belonging to a minor (§9).

4. What we never do

• No accounts, no sign-in.
• No ads in the app. The advertising identifier is used only if you allow it, and only by TikTok’s and Meta’s measurement tools (§3.6).
• Usage statistics and crash reports are on by default and you can turn them off (§3.7). No tracking across apps and websites unless you allow it (§3.6).
• No location, contacts, photos or microphone access.
• No artificial intelligence features.
• We do not sell personal information. We disclose it for advertising only to TikTok and Meta, and only if you allow it (§3.6). We don’t build profiles of you ourselves.

5. Links to other websites

Some features open other websites (for example, daily readings on the US Conference of Catholic Bishops’ site) in your browser. Those websites have their own privacy policies; we send them nothing except the link you open.

6. International transfers

RevenueCat and its sub-processors (including cloud providers) process data in the United States. We rely on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), which are incorporated in RevenueCat’s Data Processing Addendum, and on minimizing the data we send. You can ask us for a copy of the relevant safeguards.

Usage statistics and crash reports (§3.7) may be processed by Google in the United States and other countries; Google LLC is certified under the EU-U.S. Data Privacy Framework, and its data processing terms include the Standard Contractual Clauses.

If you allow ad measurement (§3.6), TikTok and Meta may process the information outside the EU, including in the United States, under the safeguards in their own terms (such as the Standard Contractual Clauses; for Meta, its European Data Transfer Addendum).

7. How long we keep data

8. Your rights and choices

Under the GDPR you have the right to:

• access your data;
• rectification;
• erasure;
• restriction;
• portability;
• object;
• withdraw consent at any time (Arts. 7(3) and 15-21).

How to exercise them:

• Withdraw consent: Settings → Privacy and data → turn off “Subscription processing”. Plus you have already paid for stays active until the end of the current period (Lifetime stays active). The app then can’t check renewals or restore purchases until you turn it back on. To stop paying, cancel the subscription in your App Store or Google Play account. While a subscription stays active, Apple or Google keep notifying our subscription service of its renewal, cancellation or refunds; we keep those records only for support, refunds and disputes (GDPR Arts. 9(2)(f) and 17(3)(e)), and delete them when you ask, as described below.
• Object to usage statistics and crash reports: Settings → Privacy and data → turn off “Usage statistics and crash reports” (§3.7).
• Withdraw consent to ad measurement: Settings → Privacy and data → turn off “Ad measurement”, or iPhone Settings → Privacy & Security → Tracking. The app stops sending at once. For what TikTok and Meta already hold, you can also contact them directly (§3.6); we hold only totals, which don’t identify you.
• Access, erasure and other requests: email support@quietrosary.app with your purchase ID (for usage statistics, the Statistics ID), shown in Settings → Privacy and data. We have no accounts, so these IDs are how we find your records. We reply within one month.
• Complaints: you can complain to a data-protection authority. Our lead authority is the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it). You may also contact the authority where you live or work.

We do not make decisions about you based solely on automated processing.

9. Children

Quiet Rosary is suitable for all ages but is not directed to children. In-app purchases by minors require the approval of a parent or guardian through the App Store’s or Google Play’s family features. In the EU, a child under 16 (under 14 in Italy and Spain) should ask a parent or guardian before giving the consent described in §3.1. If you believe a child has given us personal data without permission, contact us and we will delete it.

Usage statistics and crash reports (§3.7) are off on devices the app treats as belonging to a minor. That happens where the law gives the app the user’s age, for example in Texas. Ad measurement (§3.6) is never used for anyone under 18: the app skips it in minor mode, and Apple doesn’t let accounts of people under 18 allow tracking.

10. Notice for US residents

• Categories collected in the last 12 months:
  • from users who consented and bought or restored Plus: identifiers (a random app user ID; IP address as connection data), commercial information (purchase history) and attribution answers you chose to give;
  • from users who haven’t turned off usage statistics and crash reports (§3.7): identifiers (a random app ID), internet or app activity (screens and features used, including which prayers and novenas), commercial information (purchases in the app), diagnostics (crash reports) and approximate location (country or region). Google receives them as our service provider; we don’t sell or share them;
  • from users who allowed ad measurement (§3.6): identifiers (advertising identifier and app-level identifiers, IP address), internet or app activity (installing and opening the app), commercial information (trial start, first payment amount and currency) and approximate location derived from the IP address by the recipients.
• Sources: you and your device, through the app.
• Purposes: as in §3.
• Sale and sharing: only if you allow ad measurement, we disclose the information above to TikTok and Meta, which may use it for cross-context behavioural advertising. Under some state laws this can count as “sharing” or a “sale”. You can opt out at any time as described in §3.6 and §8; we never do it without your opt-in.
• Sensitive personal information: purchase records, the fact that you use a prayer app, and which prayers and novenas you use could be considered information about religious beliefs. Purchase records are processed only with your consent, to provide Plus; ad measurement only if you allow it; which prayers and novenas you use is sent by default to our service provider for statistics, and you can turn this off at any time (§3.7).
• Your choices: you may request access, deletion or correction as described in §8, and we will not discriminate against you for doing so.
• Do Not Track and Global Privacy Control: these are browser signals the app doesn’t receive. In the app, your iPhone’s tracking setting and our “Ad measurement” switch do the same job: if either is off, nothing is sent to TikTok or Meta. Usage statistics have their own switch (§3.7).

11. Security

The app stores your prayers locally. Connections to RevenueCat, Google, TikTok and Meta are encrypted (HTTPS). Access to the RevenueCat dashboard and our support mailbox is limited to the publisher and protected with two-factor authentication. No system is perfectly secure; if a breach affects your data, we will notify the authority and, where required, you.

12. Changes to this policy

If we change this policy, we will update the effective date and tell you in the app. If a change affects what we collect or why, we will ask for your consent again where required. Where the law requires it (for example in Texas), we also notify the app stores before significant changes.

13. Our website and launch waitlist

This section applies to our website quietrosary.web.app and its launch waitlist, not to the App.

• Website. The site uses no cookies, analytics or advertising tags. Fonts and images are served from our own site. Our hosting provider (Firebase Hosting (Google Ireland Limited, Ireland)) processes your IP address and browser details in its server logs on our behalf, only to deliver and protect the site; our legal basis is our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)). The host keeps these logs for a few months and may process them outside the EU under the safeguards in its data-processing terms (the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses). We don’t export or analyse them. The sign-up form is part of our own page: what you type leaves your browser only when you submit it, and goes straight to our email provider (below).
• Waitlist (only if you sign up).
  • Data: your email address, the language and phone type you choose, and whether you want to test the Android app; if you arrived through a campaign link (for example a creator’s or a parish’s), the name of that campaign. Our email provider also records when you confirmed your email and the IP address used.
  • Purpose: to email you when Quiet Rosary launches. That is at most 3 emails: the launch, the Android launch if you asked, and one reminder before the Advent or Christmas novenas. If you ticked the box, we also invite you to test the Android app (joining the test is described in §3.5).
  • Legal basis: your explicit consent (GDPR Arts. 6(1)(a) and 9(2)(a)). Signing up for a list about a Catholic prayer app may reveal your religious beliefs.
  • Email provider: Brevo SAS, France, acting as our processor in the EU.
  • Retention: we delete the list after the last launch email, and no later than 31 January 2027.
  • Withdrawal: use the unsubscribe link in every email, or write to support@quietrosary.app.

14. Contact

The controller: the developer named as the seller and trader on the app’s App Store and Google Play pages.
Privacy: support@quietrosary.app · Support: support@quietrosary.app

Other languages: Italiano · Español. If the versions differ, the version in your language prevails where the law requires; otherwise the English version prevails.