Privacy Policy

What we collect

• Account data. Your email address, your display name, and a bcrypt-hashed password (if you sign in with email) or your profile image URL (if you sign in with Google). Google never sees your password; email sign-ins never see your Google account.
• Your study content. Highlights, notes, bookmarks, reading-plan progress, testimony posts, and verse-anchored reactions you create.
• Anonymous usage data. Page views collected via Cloudflare Web Analytics, which does not use cookies and does not associate the view with your account or a personal identifier.
• Transient technical data. Your IP address appears in Cloudflare's server logs (retained per Cloudflare's defaults, typically 30 days) and in short-lived security logs for anti-bot verification.

We do not collect location, contacts, financial data, health data, or any other categories of personal information.

Who else touches your data

Marturia uses a small set of third-party services. Each one receives only what it needs to do its job. None of them receive your study content unless explicitly listed below.

• Cloudflare - hosting, database, security. Handles every request. Sees IP addresses in server logs.
• Google (only if you use Google Sign-In) - authenticates you and provides your name + email + profile image at sign-in.
• Resend - sends transactional email (email verification, welcome message, password reset). Receives your email address and name for that specific message.
• Crossway (ESV) and Tyndale House (NLT) - we fetch scripture from their APIs. They receive only the verse reference requested, not your account or IP-linked identity.

We do not sell your data. We do not share it with advertising networks, data brokers, or affiliate marketers. We do not use it to train AI models. We do not have those relationships.

Where available, Marturia executes a Data Processing Agreement (DPA) with each processor listed above and relies on each provider's standard contractual clauses for international transfers. Cloudflare's DPA is incorporated under their Business Associate and Data Processing addendum; Resend's DPA is executed through their customer agreement; Google's DPA applies to Google Sign-In as a Google service controller/processor relationship. Scripture providers (Crossway, Tyndale House) receive only verse references, not personal data.

Cookies

We use a strictly-necessary session cookie to keep you signed in. Cloudflare Web Analytics is cookieless. We do not use advertising, marketing, or cross-site tracking cookies. There is no cookie banner because there are no cookies to consent to.

Your rights

Wherever you live, you can:

• Access - see everything associated with your account by visiting Library and Profile.
• Correct - edit your notes, testimonies, and profile at any time.
• Delete - remove individual items at any time. To delete your entire account and everything in it, use the "Delete account" button on your profile page. Deletion is immediate and irreversible.
• Export - if you want a copy of your data before deletion, email privacy@marturia.app and I'll send it.

Under GDPR (EEA/UK), the legal bases for processing are: performance of contract (account and authentication), legitimate interest (anti-bot security), and consent (for anything we ever ask you to opt into). Under CCPA (California), we do not sell or share your personal information. You have the right to know, delete, and correct.

Children

Marturia is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, email me at privacy@marturia.app and we will delete the account and its data.

International transfers

Marturia is hosted on Cloudflare's US infrastructure. Requests pass through Cloudflare's global edge network to reach the app. If you are in the EEA or UK, this transfer is covered under Cloudflare's standard contractual clauses.

Security

Marturia takes a defense-in-depth approach to protecting your data. All traffic to and from marturia.app is encrypted in transit with TLS and HSTS preload. Passwords are stored only as salted bcrypt hashes; the plaintext password is never written to disk or logs. Data at rest in Cloudflare D1 and Cloudflare R2 is encrypted using Cloudflare's platform-level encryption. The application sits behind the Cloudflare Web Application Firewall and uses Cloudflare Turnstile for anti-bot verification on signin, signup, and password reset. The site runs under a strict Content Security Policy (script-src is nonce-free and self-only, framing is denied, mixed content is blocked). Access to the production database is restricted to a single operator over short-lived credentials. These controls are maintained on a best-effort basis for a solo-developer project; no system is perfectly secure, and we document breach notification separately below.

Breach notification

If Marturia discovers a confirmed security breach that is likely to result in a risk to your rights and freedoms (unauthorized access to your account data, your highlights or testimony content, or your email address), we will notify affected users without undue delay and, where feasible, within 72 hours of confirmation. Notification will be sent by email to the address on your account and, where appropriate, posted as an in-app banner on your next sign-in. The notice will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps you and we are taking in response. Where required under GDPR Article 33, the relevant supervisory authority will also be notified within 72 hours.

Retention

Account data is kept until you delete it. Testimony posts, notes, and highlights are kept until you delete them individually or delete your account. Server logs are held per Cloudflare's defaults (typically about 30 days). Analytics data is aggregate and non-identifying.

Changes

If we change what we do with data, we'll update this page and change the "last updated" date at the top. Substantive changes will also be announced in-app on your next sign-in. Marturia does not run a marketing list and does not send promotional email; the only mail we send is transactional (verification, password reset, delete confirmation).

Contact

Marturia is built and maintained by one person. For anything privacy- related - questions, requests, corrections - email privacy@marturia.app.