Last updated: November 11, 2026 · Version 2.1
This Privacy Policy describes how the Divine Stories app ("Divine Stories", "app", "we"),
identified in the stores by the technical identifier com.dumiyabible.app, handles data when it is
used. It was written to comply with Brazil's General Data Protection Law (LGPD, Law No.
13.709/2018) and, for people in the European Union, the General Data Protection Regulation
(GDPR, Regulation (EU) 2016/679), as well as the Apple App Store privacy guidelines
(Section 5.1) and, where applicable, the Google Play user data policies.
The controller of the data handled in this app is Matheus Lucas da Silva Costa, the developer responsible for Divine Stories (the "Controller"). Contact for any privacy matter: support@divinestories.app (the same address shown in Profile → Help and support, when configured).
The sections below detail each point, as required by law.
The following data is saved locally, using the system's own storage (AsyncStorage / iOS secure storage), and is not transmitted to, accessed by or processed by us on any server:
Because this data never leaves your device, there is no "processing" of it as personal data by the Controller within the meaning of the LGPD/GDPR: we simply do not have access to it. It is deleted when you uninstall the app.
Note on sensitive data (LGPD art. 5, II): some answers in the initial questionnaire (about anxiety or worries, for example) could in theory be considered sensitive health-related data if we collected them. Because they remain only on your device and never reach our servers, there is no collection or processing of that sensitive data by the Controller. If a future feature starts syncing those answers to the cloud, we will first ask for your specific and prominent consent, as LGPD art. 11 requires, and we will update this policy.
When anyone opens the app, we automatically create an anonymous session (a unique identifier generated by Firebase Authentication, a Google service), with no personal data attached, so that subscriptions work even without registration.
If you choose "Sign in with Apple", we receive:
We use this data only to identify your account, protect your subscription from being lost on reinstallation, and allow account deletion. Legal basis: performance of the service you requested (LGPD art. 7, V; GDPR art. 6(1)(b)) and, for the email, your explicit consent given on Apple's screen (LGPD art. 7, I).
Subscription purchases are processed entirely by Apple (App Store/StoreKit). We never receive your card or payment details.
We use RevenueCat (RevenueCat, Inc.) to validate your purchase and control Premium access. RevenueCat receives the same account identifier (anonymous or linked to Apple) and information about the purchased product and the subscription status and expiration.
A server of ours (a cloud function hosted on Firebase) receives notifications from RevenueCat about subscription changes and writes to your user document only: whether the subscription is active, which plan it is and until when it is valid. This server has no access to payment data, and you can only read your own document.
Legal basis: performance of the subscription service/contract you requested (LGPD art. 7, V; GDPR art. 6(1)(b)).
The daily reminder and the end-of-trial notice are local notifications, scheduled on your own device by the operating system. There is no remote ("push") delivery, we do not collect a notification token on any server, and these notifications only exist if and when you allow the app's notifications and turn the reminder on.
Story audio and the text-sync files are downloaded from a content delivery network (CDN) operated by Cloudflare. As with any request on the internet, standard technical data (such as your device's IP address) is processed by the network provider only to deliver the requested file. We do not associate this traffic with user profiles or use it for any other purpose.
To understand how Divine Stories is used and to fix errors, we use two Google (Firebase) services, which act as processors:
This data is associated with your account identifier (the same one described in 3.2), so that we can relate a crash to a subscription when you ask for support. We do not send to these services: what you read or search for in the Bible, your answers to the initial questionnaire, your favorites or your email. Collection of the advertising identifier (IDFA) is disabled in the app.
Legal basis: the Controller's legitimate interest in maintaining and improving the service (LGPD art. 7, IX; GDPR art. 6(1)(f)). You can object to this processing through the support channel.
We share only the minimum necessary, and only with processors (service providers) that handle data on our behalf, as defined by the LGPD (art. 5, VII):
| Processor | What it receives | Purpose |
|---|---|---|
| Firebase / Google Cloud (Google LLC) | Account identifier; email (if Sign in with Apple with email); subscription status | Authentication, account backend hosting and data deletion |
| Google Analytics for Firebase and Firebase Crashlytics (Google LLC) | Account identifier; app usage data; crash reports; technical device data | Measuring app usage and fixing crashes (section 3.6) |
| RevenueCat, Inc. | Account identifier; product/subscription data | Validating purchases and unlocking Premium content |
| Apple Inc. | Purchase/payment data (processed entirely by Apple); Apple sign-in data | Processing payments and Sign in with Apple authentication |
| Cloudflare, Inc. | Audio/text download requests (technical network data) | Delivering the app's content (CDN) |
None of these services is authorized by us to use your data for its own advertising purposes. We do not share data with data brokers.
Firebase/Google Cloud, RevenueCat and Cloudflare may process data on servers outside Brazil (for example, in the United States). When that happens, we rely on those providers' safeguards (standard contractual clauses and equivalent security certifications), as authorized by LGPD art. 33 for the international transfer of personal data.
deleteUserData) permanently erases your document and any associated
subcollection in the database, immediately and irreversibly.Under art. 18 of the LGPD and, for residents of the European Union, articles 15 to 22 of the GDPR, you have the right to:
How to exercise them: deleting your account and the associated data can be done directly in the app, in Profile → Delete account, with immediate effect. For any other request (access, correction, portability or questions), write to support@divinestories.app; we respond within a reasonable time, aiming to do so within 15 calendar days.
We do not make automated decisions about you with legal effects or that significantly affect your interests.
We adopt technical and administrative measures to protect your data, including: encrypted (TLS) connections for all communication with our servers; database access rules that let each person read only their own record; cryptographic validation (constant-time comparison) of the secret used to authenticate RevenueCat notifications; and isolation of administrative operations (such as data deletion) in server functions that are not publicly exposed.
No system is 100% free of risk; if you identify a vulnerability, please let us know at support@divinestories.app.
Divine Stories is not specifically directed at children and we do not knowingly collect data from children under 13. Use by minors should take place under the supervision of their legal guardians. We do not show advertising or use data for commercial profiling of any user, including minors.
Divine Stories is an independent product. The app has no affiliation, sponsorship, partnership or association with Amazon.com, Inc., its subsidiary Audible, Inc., or any other audiobook or streaming service from third parties. The internal technical project names "Bible Audible" or "Dumiya", which may occasionally be visible in development metadata and package identifiers, do not indicate any relationship with third-party trademarks; the app's public and official brand is Divine Stories.
We may update this Privacy Policy to reflect changes in the app or in the law. The "Last updated" date at the top of this document always indicates the version in force. Relevant changes will be communicated inside the app.
Questions about this policy or about how your data is handled: support@divinestories.app.