Privacy Policy

Last Updated: September 8, 2026 1. Introduction Welcome to TorchStep. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application (the "App") or our website at torchstep.app (the "Website"). For the purposes of this policy, the term "Service" means the TorchStep mobile application (the "App") and the TorchStep website at torchstep.app (the "Website"), together. Our Commitments: We do not sell your personal information. We do not run advertising, and we do not use your data for advertising or profiling. We do not use tracking cookies or device fingerprinting. 2. Information We Collect When you use the Service, we collect the following types of information: Account Information: To create an account and authenticate you, we collect your email address and password via Amazon Web Services (AWS) Cognito. Your email address is stored in AWS Cognito, and a salted one-way hash of your account identifier is stored together with your email address in a dedicated, access-restricted internal account-mapping table used solely to trace abuse back to an account during an investigation. Your email address is not written to any other TorchStep application database, such as your bookmarks, notes, or saved guidance. App/Website Data: When you use the Service, we securely store your Bible bookmarks, personal notes, and saved AI guidance sessions (including your prompts and the AI's conclusions) in AWS DynamoDB. Microphone and Audio Data: To utilize the built-in Speech-to-Text (STT) feature, the Service requires access to your device's microphone. On the App, voice dictation is processed locally on your device. On the Website, the feature uses your browser's built-in speech recognition (the Web Speech API), which may process your audio through the browser vendor's speech service. We do not record or store your raw audio data, and your raw audio is never sent to TorchStep's own servers. Subscriptions and Payment Data: TorchStep offers premium features through paid subscriptions. Payment processing is handled securely by third-party payment processors: Stripe for purchases made through the Website, and the Apple App Store or Google Play Store for purchases made through the App, where in-app purchases are offered. TorchStep does not collect, process, or store your full credit card number or billing address; those are processed and stored by the applicable payment processor under its own privacy policy. We store only the limited account and subscription identifiers needed to validate your subscription status (such as a Stripe customer or subscription identifier, or an app store receipt token). Feedback and Reports: If you submit a bug report or flag an AI response as inaccurate (for example, a theological or factual error), we store the content type, the verse reference or prompt involved, a copy of the flagged AI content, your selected reason, and any optional comment you provide. These records help our review process and persist so they can be triaged by our team. Sensitive Information: Your AI guidance prompts, saved guidance sessions, bookmarks, and notes may contain religious beliefs, prayer content, or other personal details that some jurisdictions treat as sensitive. We process this information only to provide the Service as described in this Policy, and we never use it for advertising or profiling. We do not collect analytics, advertising identifiers, device fingerprints, or any other tracking data, and we do not use advertising, analytics, or third-party tracking cookies. Cookies and Similar Technologies: On the Website only, we use a small number of first-party functional cookies (set by TorchStep and scoped to our domain) to provide core functionality: - Sign-in / "Remember Me": if you choose "Remember Me" at sign-in, we store your session tokens in a cookie (up to one year) so you stay signed in across browser restarts. If you do not choose "Remember Me," your session is kept in memory only and cleared when you close the tab. - Preferences: we store your selected Bible translation in a cookie (30 days). - Onboarding and notices: we store flags remembering that you have completed the onboarding tour or dismissed a one-time notice (such as a payment reminder). We do not use third-party cookies, advertising cookies, analytics cookies, or device fingerprinting. The App does not use cookies; it stores your sign-in tokens in your device's secure storage (iOS Keychain / Android Keystore). 3. How We Use Your Information We use your information exclusively to provide and improve the TorchStep experience: To authenticate you and secure your account. To sync your bookmarks, notes, and guidance sessions across your devices. To convert your voice dictations into text prompts using Speech-to-Text (STT). On the App this runs on-device; on the Website it uses your browser's speech recognition. Your raw audio is never sent to TorchStep's servers. To validate, manage, and support premium subscriptions, free trials, renewals, and cancellations using the limited account and subscription identifiers provided by our payment processors (Stripe, Apple, or Google). To generate AI responses based on your input. When you submit a prompt, the prompt and related scripture texts are sent to AWS Bedrock (Llama 3.3 70B), our third-party AI inference provider, solely to generate your response. AWS does not use customer content to train or improve its models. To review and address reports you submit about AI-generated content. Artificial Intelligence: We use artificial intelligence (AI) to generate the guidance responses you request and to power verse and chapter explanations. When you use an AI feature, your prompt and the related scripture texts are processed by our AI inference provider solely to generate your response; the AI provider does not train its models on your content. The Bible text displayed in the Service is never generated or altered by AI. 4. Data Sharing, Disclosures, and Third Parties We do NOT sell, rent, or share your personal data with third-party advertising or marketing companies, and we do not use your data for advertising or profiling. All user data is processed securely through Amazon Web Services (AWS) solely for the purpose of powering the Service's features: AWS Cognito stores your account credentials (email and password) and handles authentication. AWS Bedrock processes the prompts and scripture texts you generate guidance from, in order to produce AI responses. AWS does not train its models on this content. AWS DynamoDB stores the data you choose to save (bookmarks, notes, and saved guidance sessions) and any reports you submit. Stripe processes subscription and payment transactions for purchases made through the Website and stores any payment data under its own privacy policy. The Apple App Store and Google Play Store process payments for the App where in-app purchases are offered. Voice and audio data accessed via your microphone for Speech-to-Text dictation is processed on-device on the App. On the Website, the browser's speech recognition provider may process your audio; we do not transmit or store your raw audio data ourselves. Legal Disclosures: We reserve the right to access, preserve, or disclose your account information and data if we have a good faith belief that it is reasonably necessary to (a) satisfy any applicable law, regulation, legal process, or enforceable governmental request, or (b) protect against imminent harm to the rights, property, or safety of TorchStep, its users, or the public as required or permitted by law. 5. Data Retention and Deletion You have full control over your data and may revoke consent for future data processing at any time. You can permanently delete all your account data, credentials, and revoke consent for third-party AI processing by initiating an account deletion. How to delete: - In-app Deletion (on the App): Go to the "Settings" screen within the TorchStep App and tap "Delete My Account & Data". - Web-based Deletion (on the Website): Go to the "Settings" screen within the TorchStep Website and tap "Delete My Account Data", or visit the dedicated account deletion page directly at https://torchstep.app/delete-account. - Web-based Deletion Request (Alternative): You may also request the permanent deletion of your account and all associated data by emailing us directly at [email protected]. What happens: This action permanently deletes your account credentials and identity from our authentication systems, erases your saved guidance sessions, bookmarks, notes, and any associated records from our cloud servers and (for App users) from your local device, then signs you out. This cannot be undone. Fraud and Abuse Prevention: To prevent unauthorized multiple redemptions of promotional trials, trial eligibility for mobile in-app purchases is enforced directly by the platform provider (Google Play or Apple) under their account rules. For trials initiated through the Website, we collect payment card information via Stripe to generate an opaque card fingerprint and verify account novelty. Following account deletion, we retain a limited anti-fraud record consisting of this payment token fingerprint and related Stripe customer identifiers. This anti-fraud record does not contain your full card number, security code, or billing address, and it cannot be used to process transactions. Inactive Accounts: To minimize long-term data liability, we will retain your personal information only as long as your account remains active. We reserve the right to permanently delete account data for accounts that have been inactive or abandoned for an extended period (e.g., 24 months). 6. Children's Privacy The Service is not intended or directed at children under the age of 13 (or the age of digital consent in your jurisdiction, if higher), and we do not knowingly collect personal information from children under that age without required parental consent. Where required, parents or guardians may consent to a minor's use of the Service and are responsible for supervising that use. If you are a parent or guardian and believe we have inadvertently collected data from a child, please contact us immediately at the email provided below so we can promptly delete such information. 7. Your Privacy Rights Depending on your location, you may have specific legal rights regarding your personal data under international or state privacy laws (including, for example, the California Consumer Privacy Act (CCPA/CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act). These rights include: The right to access the personal data we hold about you. The right to correct inaccuracies in your data. The right to request deletion of your data (which you can perform directly via the Service). The right to data portability (exporting a copy of your data). The right to opt out of the sale or sharing of your personal data and of targeted advertising (we do not sell your data or engage in targeted advertising). To exercise these rights, please contact us using the information in Section 11. 8. Legal Bases for Processing We only collect and process personal data where we have a lawful basis to do so, such as your consent, the performance of a contract with you (providing the Service you request), compliance with legal obligations, or our legitimate interests in operating, securing, and improving the Service. 9. International Data Transfers TorchStep operates its infrastructure on AWS servers located in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and in the countries where our service providers operate. Where required, we rely on appropriate transfer mechanisms, including standard contractual clauses or similar safeguards. By using the Service, you consent to this transfer. 10. Security We implement industry-standard security measures to protect your data: AWS Cognito provides secure authentication using JWT (JSON Web Tokens), so your data is only accessible by you. All network communications with our servers are encrypted in transit using TLS. Data at rest is encrypted by AWS DynamoDB. Your identity is protected by a one-way salted cryptographic hash. Your bookmarks, notes, guidance sessions, and reports in our databases are keyed by this opaque hash rather than by your email address or raw account identifier. This means your content cannot be associated with your account by anyone browsing our databases, while still allowing us to investigate abuse if required by law or our Terms of Service. Our server logs record only basic request metadata (such as which endpoint was called and whether it succeeded). We do not log the contents of your bookmarks, notes, or guidance prompts. 11. Contact Us If you have any questions or concerns about this Privacy Policy or how your data is handled, please contact us at [email protected]