Efatah privacy policy

Version 0.8, draft dated 2026-10-18. This version takes effect on the date the optional account (saving progress with Apple or Google) launches in the apps. Until then, what it says about the app without an account already describes how it works today; sections marked "coming soon" or "when available" do not apply yet.English translation of the Portuguese policy, which prevails in case of conflict. It supplements the Gracefold privacy policy, which applies to everything not covered here.

1. Who is responsible

Efatah is published by GRACEFOLD TECH LTDA, CNPJ 69.276.507/0001-79, SAUS Quadra 4, Bloco A, s/n, Sala 513 Parte 1002, Plano Piloto, Brasília/DF, CEP 70070-938, Brasil, which is the controller of the data described in this policy under Brazil's General Data Protection Law (Law 13,709/2018, "LGPD").

Channel for data subjects: privacy@gracefold.tech, for any request or question about your data. Gracefold is a small-scale processing agent and therefore does not appoint a data protection officer ("encarregado") (ANPD Resolution CD/ANPD 2/2022, art. 11). If we start high-risk processing, we will appoint one and publish their name and contact here.

2. What this policy covers

• the Efatah app for iPhone/iPad (iOS) and Android;
• the efatah.app website, including the help center and the addresses opened by the QR code on the physical cards (efatah.app/c/…), and the same addresses on the old santolingo.com domain, which keep working.

Purchases on the App Store or Google Play, Apple and Google accounts, and your device's system services are also governed by Apple's and Google's policies.

3. What we do not do

• we do not require an account, registration or login to use the app;
• without an account, we do not ask for your name, e-mail, phone number, date of birth, location, contacts or photos;
• we never store your photo, password, contacts or location, not even with an account;
• we show no ads and use no advertising, campaign-attribution or cross-app tracking SDKs;
• we do not record sessions or the screen, we use no third-party analytics SDKs inside the app and we do not build a profile of you: the usage data described in section 5.1 is minimal, has no content and is tied to a random code, never to your name;
• we do not sell or rent personal data and do not share it for marketing;
• we do not send camera images or microphone audio to our servers;
• we do not hand your data to third parties to train their artificial intelligence, and we never use your voice or data about faith (section 8) to train models.

4. Data that stays on your device

To work, the app stores locally, in the space set aside for it on your device:

• the courses (language pairs) you chose and the downloaded content packs;
• your study progress: completed lessons, reviews, placement, mastery of each word, day streak, commitments and achievements;
• favourites and saved verses and passages;
• app preferences such as voice, audio speed, reminder times and theme;
• the content shown in widgets and live activities (Live Activities / ongoing updates), generated on the device itself.

As long as no account is linked, this data is not sent to Gracefold. It is deleted when you uninstall the app. Automatic system backups (iCloud, Google) may include it, depending on your device settings and Apple's and Google's policies.

5. Data processed when the app or the website goes online

The app goes online to download the catalogue, lesson packs, images and audio, and to check for content updates. These requests go to Gracefold servers running on Cloudflare's infrastructure (api.efatah.app,cdn.efatah.app, media.efatah.app). The same applies to visitors of efatah.app. As with any internet request, the infrastructure records technical request data: IP address, date and time, requested resource, and the app or browser and system identification (user agent).

We use these records only to deliver content, protect the service against abuse (for example, rate limits per IP address) and diagnose failures. They are not linked to a profile, because the app sends no user identifier when downloading content. They are kept for Cloudflare's retention period and, where the law requires, for the access-log retention period of Brazil's Internet Civil Framework (Law 12,965/2014, art. 15).

The efatah.app website uses no cookies, analytics or advertising. The help center search runs in your browser.

Legal basis: performance of the service you request by using the app or the website (LGPD art. 7, V), legitimate interest in the security of the service (art. 7, IX) and compliance with a legal obligation (art. 7, II), where applicable.

5.1 Technical and usage data from the app (diagnostics and improvement)

What stays on your device only: your prayers, what you say in the voice exercises, and what you save and annotate.

What Efatah collects: technical data (errors, crashes and performance) and usage data without content (screens opened, lessons and devotionals started, completed or abandoned, features used, course language, app version, device type and system, approximate country), tied to a random code generated on the device, not to your name, e-mail or account. This code is replaced every 13 months and deleted when you delete your account or uninstall the app. None of this data carries what you wrote, said, saved or prayed, nor which verse or passage you kept. The IP address is not stored: the country is worked out on the fly at the network edge and the IP is discarded.

What for: fixing problems and improving the app, for example finding where people give up on a lesson or which features nobody finds. We never sell this data, never use it for advertising and never hand it to third parties to train their artificial intelligence. We may use it, always without content and without identifying you, to improve Efatah itself, including with artificial intelligence tools.

Legal basis: legitimate interest (LGPD art. 7, IX, and art. 10), assessed in writing with the safeguards above (minimal data, no content, random code, limited retention). That is why this collection is part of how the app works and does not depend on an individual option. Because this data does not identify you, we cannot look it up by your name or e-mail; uninstalling the app or deleting the account deletes the code, and what was already sent expires within the periods in section 14.

Who with: Sentry (error diagnostics) and PostHog (usage analysis), with the data stored in the European Union (section 7). The raw data is also kept in a Gracefold storage in the European Union (Cloudflare R2).

5.2 Problem reports and suggestions you send

In several places in the app (the "⋯" menu of a piece of content, the lesson, Settings › Help or by shaking the phone) you can report a problem or suggest an improvement. Nothing is sent until you tap "Send".

• what goes with it: what you wrote; the category; the content involved (for example, the pack, the card or the devotional day, by its identifier); the screen; the app version, the system and the device type; the random code in section 5.1; and, if you leave it, a screenshot and up to 3 images you choose. Before sending, you see the screenshot and can black out parts of it or remove it. Check the screenshot: it may show your prayers or notes;
• e-mail for a reply: optional, and only for people who declare they are 12 or older or the responsible adult. Without an e-mail, you only get the report number;
• testers: in test versions, a registered tester's report carries that indication and the test environment, never their e-mail;
• what for: fixing problems and improving the app and the content;
• legal basis: your consent, given with each submission (LGPD art. 7, I). If what you send reveals something about your faith, sending it counts as specific consent for this purpose (art. 11, I). You can ask for deletion at any time;
• where it is kept: the text and images are kept in a private Gracefold storage in the European Union (Cloudflare R2), and each report becomes a record in a private Gracefold repository on GitHub, where the team reads and organizes it. They never go into the usage data in section 5.1;
• for how long: up to 12 months after the report is resolved; then the text, images and e-mail are deleted, and only a record without any of them remains (category, screen and content), for statistics;
• how to delete it sooner: write to the privacy e-mail (section 19) with the report number, and we delete everything.

6. System permissions

The app does not ask for access to your photo library, contacts or location. All permissions are optional and can be revoked in the device settings; the related features then stop working.

7. Third-party services and processors

• Cloudflare, Inc. (United States): hosting and delivery of content, of the website and, once it exists, of the account server (sections 5 and 9).
• Apple and Google as app stores (App Store and Google Play): distribution, installation, updates and in-app purchases. If you allow it in your device settings, Apple and Google may send us aggregated usage statistics and crash reports that do not identify you.
• Google Play (Android): the app uses Google Play's in-app update service to tell you when a new version is available.
• Google ML Kit (Android): reads the QR code and the printed code on the cards, on the device. According to Google's documentation, ML Kit sends Google technical performance and usage metrics about the library itself (for example, device model, app and library version, timings and errors). Camera images are not sent.
• Apple (Sign in with Apple and Private Email Relay) and Google (Google Sign-In), once accounts exist (section 9): authentication and, for Apple, forwarding of e-mails for people who choose to hide their address.
• Resend, Inc. (United States), once accounts exist: sending service e-mails and, for those who opt in, news e-mails (section 9). It receives the e-mail address, the name if any, and the message content.
• RevenueCat, Inc. (United States), when subscriptions exist: managing subscriptions from the stores' purchase receipts (section 10).
• Functional Software, Inc. (Sentry) (United States; data stored in the European Union, in Germany): diagnostics of errors and crashes in the app and the servers (section 5.1). It receives the error type, the app version, the device type and the random code; it does not receive name, e-mail, IP, screenshots or session recordings.
• GitHub, Inc. (United States): private repository holding the reports and suggestions in section 5.2 (text, category, technical context, temporary links to the images and, if you leave it, the e-mail).
• PostHog, Inc. (United States; data stored in the European Union, in Germany): analysis of the usage data in section 5.1, sent by Gracefold's servers, without the IP and without content.
• System speech and voice services (Apple, Google): speech recognition (section 6) and the "Device voice" option, which uses the system's own speech synthesizer.

Changes to this list will be published here before they take effect.

8. Data about faith

Efatah teaches languages with Bible and devotional texts. Information about what you study, save or pray may reveal religious belief, which the LGPD treats as sensitive personal data (art. 5, II, and art. 11). Therefore:

• the content stays on your device only: what you read, saved, annotated or prayed is never sent without an account. The usage data in section 5.1 records only the fact that a lesson or the day's devotional was opened, completed or abandoned, with no content and tied to a random code. Since the app itself is about Bible study, this usage record reveals no more than the fact that you have the app installed, and it is never used to infer or classify anyone's faith;
• if you link an account (section 9), the app asks for an active choice, with nothing preselected: "Save everything, including the devotional" or "Only study progress". We only sync devotional data if you pick the first, and we keep a record of that choice with the version of the text shown;
• you can withdraw that choice at any time under Profile › Account and sync. When you do, devotional data is deleted from our servers and the rest of the account stays;
• we never use it for advertising, never sell it and never share it with third parties beyond the processors in section 7.

9. Optional account to save your progress (coming soon)

Before any data leaves the device, the app asks about age (section 13) and what you want to save (section 8). Then you choose Continue with Apple (Sign in with Apple) or Continue with Google.

• what we keep:
  • the identifier Apple or Google gives us for your account, and the account creation date;
  • profile: your name, if the provider sends it (optional; you can change or remove it), and your e-mail. If you choose to hide your e-mail with Apple, we keep the forwarding address Apple creates (Private Email Relay), not your real e-mail. Apple only sends name and e-mail at the first sign-in;
  • your age answer, your devotional choice and your choice about news e-mails, with the version of the text shown;
  • a random identifier per app installation and the session (only a cryptographic hash of the token, never the token itself);
  • study events (lessons, reviews, placement, commitments, achievements), courses, favourites and saved verses, and preferences (voice, speed); devotional events only if you choose;
  • a template of your reminder times, offered when you sign in on a new device ("Use the same reminders as your other device?"). It is never applied on its own, and afterwards each device manages its own reminders;
• what we do not keep: photo, password, phone number, contacts or location;
• what stays on the device only: downloaded files, mobile-data use, scheduled notifications, recents and searches;
• why: to keep your progress, restore it on a new device, sync it between iPhone and Android, merge two of your accounts (for example, one Apple and one Google) without losing anything, show your name in Profile and contact you by e-mail (below);
• legal basis: performance of the service you requested (LGPD art. 7, V) for the account, profile and study progress; your specific consent (art. 11, I) for devotional data (section 8); and, for children, a parent's or guardian's consent (art. 14, §1; section 13);
• where: in a Gracefold database on Cloudflare's infrastructure, in the Eastern North America region (United States), because the database service used (Cloudflare D1) has no South American region. This is an international transfer (section 17);
• abuse protection: the server limits the number of requests per IP address and per account. If we start using the app-integrity checks offered by Apple or Google (App Attest / Play Integrity), this policy will be updated first. An account used in breach of the terms may be suspended: its sessions are ended and sign-in is blocked, with nothing deleted; suspension can be reversed (terms, section 12).

E-mails

• Service messages (about your account, security, receipts and changes to the terms or this policy): sent to account holders without needing permission, because they are part of the service (LGPD art. 7, V) or required by law (art. 7, II).
• News and content: only with your consent (art. 7, I), given through a separate option that starts unchecked. Every message has an unsubscribe link, and you can also turn it off in Profile.
• Under 12: anyone who said they are under 12 never receives news or content e-mails, even if the option is checked.
• To deliver messages to Private Email Relay addresses, our sending domain is registered with Apple. If you turn off forwarding in your Apple settings, we can no longer reach you by e-mail.

Linking an account is never required. The app may remind you to save your progress, but you can always decline and keep using it without an account. Signing out applies only to that device; local progress stays.

10. In-app purchases (when available)

Today the app sells nothing. When plans or purchases are offered, they will be processed by Apple or Google, which are responsible for payment data. Gracefold has no access to your card or your store account. We receive from the stores only the purchase confirmation (product, date, subscription status and a transaction identifier), to unlock what you bought. If you have a linked account, we may associate that transaction identifier with your account to unlock the purchase on other devices. To manage subscriptions we use RevenueCat, Inc. (United States) as a processor: it receives the stores' purchase receipts and a random buyer identifier, with no name, e-mail or payment details.

11. Sharing and social features

When you share a verse, a prayer or a word, the image or text is created on your device and handed to the system share sheet. You choose the destination (WhatsApp, Instagram and so on), and what happens next follows that service's rules. Nothing is sent to our servers, and the image carries neither your name nor your numbers.

Efatah has no public profiles, chat, friends, leaderboards or any contact between users. If such features are created, this policy will be updated first, and taking part will be optional.

12. Synthetic voices and artificial intelligence

The app's "natural voices" are audio generated with AI speech synthesis and prepared by Gracefold before you download the lessons; they use none of your data. The app has no assistant, chat or other AI feature that processes what you write or say. Your voice is only used to check pronunciation, by the system speech service (section 6), and is never used to train models or create voices.

13. Children and teenagers

Efatah can be used by people of any age, and children should use it under the responsibility of their parents or guardians. We always process children's and teenagers' data in their best interest (LGPD art. 14). In practice:

• the app does not ask for age or identifying data, has no advertising, no tracking and no social features;
• without an account, the only data that leaves the device is the technical records in section 5, the technical and usage data without content in section 5.1 (tied to a random code), the technical data of the libraries in section 7, the reports and suggestions you choose to send (section 5.2) and, if the microphone is used, the audio processed by Apple's or Google's speech service. Parents can turn the microphone off in the device settings;
• before linking an account, the app asks for a self-declaration: "I am 12 or older" or "I am the parent or guardian and I authorize it". For a child under 12, the account should only be linked by a parent or guardian, who gives the consent required by art. 14, §1, by choosing the second option. The answer is a declaration: the app does not check documents, and parents should supervise this step. Children's Apple and Google accounts are created and controlled by their parents (Family Sharing and Family Link);
• anyone who said they are under 12 never receives news or content e-mails, only the account's service messages (section 9);

On the App Store, the app is rated 4+ and is not part of the Kids Category. On Google Play, the declared target audience is 13 and over, and the app does not take part in the "Families" programme today. Children under 12 use the app with a parent or guardian, who is the one making the self-declaration "I am the parent or guardian and I authorize it" when linking an account. If you believe we processed a child's data without a legal basis, write to privacy@gracefold.tech and we will delete what is identified.

14. How long we keep data

We keep data longer only when the law requires it or to exercise rights in judicial, administrative or arbitration proceedings (LGPD art. 16).

15. How to delete your data

• Without an account (today): uninstall the app. This deletes downloaded content, your progress and your preferences. Nothing of yours is on our servers apart from the technical records in section 5 and the usage data without content in section 5.1, which does not identify you and expires within the periods in section 14.
• With an account (once it exists): delete the account inside the app, under Profile › Account and sync. To confirm it is you, the app asks you to sign in again with Apple or Google. Deletion removes the account, the profile (name and e-mail), consent choices, the Apple or Google identities linked to it and all synced progress, and we ask Apple to revoke Efatah's link to your Apple account. Progress stored on the device stays there until you uninstall the app. Deleting the account does not cancel subscriptions: cancel them on the App Store or Google Play.
• Without access to the app: request deletion at efatah.app/account/delete by signing in with the same Apple or Google account (available once accounts launch). You can also write to privacy@gracefold.tech from the account's e-mail address.

Step by step on Data and deletion.

Legal exception: if a court order or a legal duty requires us to preserve an account's data (for example, a preservation request from the police or the public prosecutor under Brazil's Marco Civil da Internet), a deletion request makes the account inactive at once (it disappears from the app, sessions end and sign-in is blocked), but the data is kept, isolated and unused, for as long as required, and then deleted. The LGPD allows this (art. 16, I).

16. Your rights

Under the LGPD (art. 18) you may ask at any time for: confirmation that we process your data and access to it; correction; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about whom we share it with; deletion of data processed with your consent and withdrawal of that consent; and objection to unlawful processing. We make no automated decisions that affect your interests.

To exercise any right, write to privacy@gracefold.tech. Because almost everything stays on your device, many requests can be handled inside the app itself. We reply within 15 days (art. 19, II). You may also complain to Brazil's National Data Protection Authority (ANPD). If you live outside Brazil, we honour the equivalent rights under your local law.

17. Security, incidents and international transfers

All traffic between the app and our servers is encrypted (HTTPS). We keep the minimum data, and the account server stores only a cryptographic hash of session tokens. If a security incident may cause relevant risk or harm, we will notify the ANPD and the people affected (LGPD art. 48). The processors in section 7 process data outside Brazil, notably in the United States: Cloudflare (including the account database, in the Eastern North America region), Resend, Sentry and PostHog (US companies, with Efatah's data stored in the European Union), GitHub (the reports in section 5.2) and, when subscriptions exist, RevenueCat. These transfers rely on LGPD art. 33, based on those providers' data processing agreements, which include standard contractual clauses. Details are in the Gracefold policy. The account server's access records (section 14) are also kept in the United States, in the same region as the account database.

Requests from authorities

• we hand over access records or an account's data only under a court order (Marco Civil da Internet, arts. 10 §1 and 22); registration data (name and e-mail) also to administrative authorities legally empowered to request it (art. 10 §3);
• we verify every order before acting, hand over only what it asks for, and keep a record of each request and each reply;
• we tell the affected person, unless the order forbids it or notice could harm an investigation;
• the usage data in section 5.1 is tied to a random code, not to the account: we cannot find it by anyone's name, e-mail or account.

18. Changes

Changes to this policy will get a new version and date on this page. If a new app version starts processing data differently (for example, when the optional account or purchases launch), the policy will be updated before that version is released, and relevant changes will be announced inside the app. When a change depends on your consent, we will ask for it again.

19. Contact

Privacy and data subject requests: privacy@gracefold.tech. App support: support@santolingo.com. GRACEFOLD TECH LTDA, SAUS Quadra 4, Bloco A, s/n, Sala 513 Parte 1002, Plano Piloto, Brasília/DF, CEP 70070-938, Brasil.

Version history

• 0.8 (2026-10-18): the app and the website are now called Efatah (formerly Santolingo); the website and servers move to efatah.app, and the old santolingo.com addresses keep working and remain covered by this policy. Nothing changes in how data is processed.
• 0.7 (2026-10-06): problem reports and suggestions sent from the app (section 5.2): what goes with them, screenshot with black-out, e-mail only with an age self-declaration, consent per submission, GitHub as processor, 12-month retention after resolution.
• 0.6 (2026-10-06): account-server access records kept for 6 months as required by law (Marco Civil, art. 15), replacing "up to 7 days"; preservation exception to deletion under a court order or legal duty; account suspension; how we handle requests from authorities.
• 0.5 (2026-10-06): technical and usage data from the app (section 5.1), on legitimate interest, without content and tied to a 13-month random code; Sentry and PostHog as processors, with data in the European Union; the artificial intelligence commitment now states what we never do (hand data to third parties to train their AI; use your voice or data about faith to train models) and what we may do (use usage data, without content and without identifying you, to improve Santolingo itself); retention and transfers updated.
• 0.4 (2026-10-03): Gracefold as a small-scale agent with no DPO and the privacy@gracefold.tech channel; store ratings (App Store 4+, not in Kids; Google Play 13+, not in Families); account database in the US (Cloudflare D1, Eastern North America) as an international transfer; logs up to 7 days and recovery copies up to 30 days; web deletion page; Resend for e-mail and RevenueCat for subscriptions; effective from the launch of the optional account.
• 0.3 (2026-10-03): optional account: profile with name (optional) and e-mail, including Apple's relay; service and news e-mails (separate opt-in, never for under-12s); active choice about the devotional, deleted on withdrawal; age self-declaration; reminder template for a new device; account merge; deletion with re-authentication and on the web.
• 0.2 (2026-10-03): revised after a comparison with reference apps' policies; new sections on data about faith, optional account (coming soon), purchases, sharing, synthetic voices, retention and rights; ML Kit (Android) and store statistics added to third parties; the santolingo.com website is now covered.
• 0.1 (2026-10-01): first draft, based on the app's current behaviour (no account, no analytics, local content and progress).