Privacy Policy

In short

• Reading, search, reading aloud, the learning paths, the atlas and the people pages work on your device without an account.
• The app contains no advertising and no third-party analytics or tracking code, and it does not track you across other apps or websites. Once a day it sends us anonymous totals of how often a few things were done in it, with nothing that identifies you or your device; you can turn this off in Settings.
• Your highlights, notes, bookmarks, saved verses and reading plans are never sent to our servers.
• If you create an account, we do not store your email address — only a keyed hash of it and a masked hint such as j•••@gmail.com.
• Questions you send to Ask (解經) are not linked to your account, and our service does not save them.
• If you record your voice so chapters can be read to you in it, the recording and the Bible text it reads are sent to MiniMax, the company that makes the voice. You can delete the voice at any time.
• If you give or redeem a gift, we keep its code, who it is from, who redeemed it and when, and the message the giver wrote.
• Chapters you give in your voice can be heard by the accounts that redeem them, and a recording you send of your real voice by anyone who has its link. Either ends when you take it back or delete it.
• You can delete your account in the app at any time.
• If you leave your email on this website to hear when the app launches, or sign up as a partner church, we use what you gave us only for that, and remove it when you ask.

What stays on your device

The Bible texts, place data and people pages are bundled with the app, and so are most images, so reading works offline. What you create and choose is stored on your iPhone:

• your reading position, highlights, notes, bookmarks, saved verses and collections, and your reading plans and the chapters you have ticked in them;
• your lesson progress, streak and XP;
• your settings, such as language, translation, voice and reminder time.

Unless you record your own voice (see below), reading aloud uses the voices built into iOS. The daily verse reminder is a notification scheduled on your device; there is no push server. The home-screen widgets read a short summary the app writes to storage it shares only with its own widgets. The atlas uses Apple Maps, which loads map imagery from Apple; the app does not ask for your location.

Some people's pictures are not bundled. The first time one is shown, the app downloads it from our service at api.tomorrowchurch.com, which runs on Cloudflare. Like any web request, that reveals your IP address; the request carries no account or sign-in token and nothing else about you. The picture is then kept on your iPhone for next time. If it cannot be downloaded, for example offline, the page shows a drawn emblem instead.

iCloud sync (optional)

iCloud sync is off until you turn it on in Settings. When it is on, your highlights, notes, bookmarks, saved verses and reading plans sync between your own devices through the private iCloud database of your Apple Account. Apple keeps that data under your account; it is not sent to our servers, and we cannot read it.

Ask (解經)

Ask needs no account. When you send a question, the app sends our service at api.tomorrowchurch.com:

• the question you typed;
• the answer mode and any traditions you selected;
• the app's language;
• if you asked about a verse, its reference and the verse text shown on your screen.

These requests carry no account or sign-in token, so a question is not connected to your account. Answers are generated by a language model that runs on Cloudflare Workers AI under our Cloudflare account, and the cited mode quotes public-domain commentaries we host. Our service code does not write your questions or its answers to a database or to its logs. To count the day's questions, each request carries a random code the app made when it was installed and your time zone, and the service keeps, for a few days, a keyed fingerprint of each question that cannot be turned back into its words; with Pro, a token showing you have it is sent as well. Your IP address is used to limit how many questions one connection can ask per minute.

Please do not put personal information in a question. Answers are generated and can be wrong, and every quick answer says so.

Anonymous usage counts

So that we can tell whether the app helps people read, it sends our service at api.tomorrowchurch.com, once a day when you leave it, how many times that day these things were done in it: opening the app, reading a chapter, opening a book guide, a lesson or an original-languages lesson, finishing a lesson, showing a 3D scene, starting a guided tour of an artwork or artefact, sharing a verse card, and seeing the Pro page. Whatever is done after that day's send goes with the next day's. With the counts go the date, how many days ago the app was installed, the app's language and its look (Classic, Archive or Pilgrim).

Nothing else is sent with them: no account, sign-in token, device identifier, install code, device model or time of day. Our service adds the numbers into totals for each day shared by everyone who used the app in the same language and look and installed it in the same week, and keeps nothing else of the request — not your IP address, nor anything made from it — so these totals cannot be traced back to you or your device. Your IP address is used only to limit how many requests one connection can send in a minute.

It is on unless you turn it off: Settings (設定) › Send anonymous usage statistics (傳送匿名使用統計). When it is off, the app counts nothing and sends nothing.

If you create an account

An account is needed only for the Together (同行) tab — friends and shared reading plans — for reading aloud in your own voice, and for redeeming a gift. You can sign in with Apple, Google, LINE, a passkey, or a one-time code sent by email — in the app, or on this website at seekfind.tomorrowchurch.com/account, which manages the same account. When you do, we store:

• a random account ID, the display name you choose, your friend code, your time zone, and when the account was created and last used;
• for each sign-in method, the identifier Apple, Google or LINE gives this app for you; for a passkey, its public key, a signature counter and, when your device reports it, the name of the password manager that holds it — your face, fingerprint and device passcode never leave your device; and for an email address, only a keyed hash of it (HMAC-SHA256 under a secret key held only by our service) and a masked hint such as j•••@gmail.com. If you use Apple's Hide My Email, no hash or hint of that address is kept;
• the days you studied and the XP earned on them (finishing a day of a reading plan counts as a day studied), and your lesson progress — which lessons you completed, your scores, and when each is next due for review — so your streak can follow you between devices;
• your friend requests, friends and blocks;
• for shared reading plans, each plan's title, description and passages, its members, and which steps each member has completed; for a group plan (團體共讀), also its join code, its start day and who leads it.

The first time you sign in with Apple, the name you choose to share is used as your display name; the first time you sign in with LINE, your LINE display name is. You can change it under Account (帳號) › Display name.

There is no search by name, email address or phone number: someone can add you only with the friend code you give them. Friends see your display name, streak, XP and when you last studied. They do not see what you read, highlight, write in notes or ask. Members of a plan shared among friends see each other's progress in that plan. A group plan (團體共讀) is joined with a code, so most of its members are strangers to each other: its leaders — the person who started it and up to five co-leaders — see each member's display name and how many days they have read; other members see only how many people read each day, the organiser's name, and which of their own friends are in it.

The sign-in token our service issues expires after 30 days. In the app it is kept in the iOS Keychain on your device; on the website it is kept in a cookie that only the website's server can read (HttpOnly), which is the only cookie the website sets for your account.

Reading aloud in your own voice

Reading aloud uses your iPhone's own voices unless you choose to record yours. If you do, you record yourself reading Psalm 23, beginning with a sentence that gives your name and says you agree to your voice being used to read aloud in this app. The recording is sent to our service and from there to MiniMax, the company that makes the voice. A voice reads only the language you recorded it in. Our service keeps:

• the recording, in private storage on Cloudflare that is served only to your own signed-in account;
• the consent sentence as it was shown to you, and when you agreed;
• the language you recorded in, and MiniMax's identifier for your voice;
• every chapter read in your voice, as audio with the time each verse starts, so that a chapter is made only once;
• how many characters were read in your voice each month, so that spending stays within a monthly limit.

To read a chapter in your voice, our service sends MiniMax your voice's identifier and the text of that chapter. The text always comes from our own copy of the Bible, never from anything you typed, so your voice can be made to read the Bible and nothing else. MiniMax does not receive your account ID, email address or display name — only what you say in the recording. The audio it returns is stored as above and sent to your phone, which keeps a copy so the chapter plays offline next time.

Your recording is used only to make your voice, and your voice only to read the Bible. Nobody else can hear the recording. Chapters read in your voice are heard by you alone — unless you give some of them to family (see Gifts below), and then only those chapters, only by the accounts that redeemed them.

Gifts

You can buy a year of Pro in the app as a gift for someone else. Apple takes the payment, and we never see your payment details: our service receives Apple's signed record of the purchase — its transaction ID, the product, the dates and whether it was refunded — and opens a gift code for it, which is also the link you share. For each gift our service keeps:

• the gift code, and the App Store transaction it was bought with;
• the account it is from: the one the purchase was made for or that was signed in when it was bought, if any;
• the message the giver wrote on it, if any, at most 140 characters;
• which account redeemed it, and when;
• for a redeemed gift, when the year of Pro it gave starts and ends, and whether Apple refunded it.

Anyone with the link or the code can see, without signing in, what kind of gift it is, the giver's display name, the message, and whether it can still be redeemed — never which account redeemed it. The giver sees in the app whether and when the gift was redeemed, not by whom. Redeeming needs an account, so the gift stays with you when you change phones. Gift links are listed nowhere, and their codes cannot be guessed.

If the giver deletes their account, the gift can still be redeemed but no longer shows their name or message. If the account that redeemed it is deleted, the year of Pro it gave goes with it, and the code cannot be used again. If Apple refunds the purchase, the gift — or the year it gave — ends.

Chapters in your voice. You can give chapters read in your voice — one, several or a whole book — to family, with points, and share your voice with at most five accounts. For such a gift we also keep which voice it is and which chapters, and the points it cost. The account that redeems it can play those chapters, and keep them on its phone to play offline; it cannot have your voice read anything else, and the app offers no way to save the audio as a file. You see the display name of each account that redeemed one, never the account itself. When you take a gift back, delete your voice, record it again or delete your account, everyone you gave it to stops hearing it, and the chapters kept on their phones are removed the next time their app is online.

Recordings in your real voice. If you record a passage in your own voice to send to someone, it is not made by AI and it is not sent to MiniMax. The recording — at most five minutes — is kept in our storage on Cloudflare, with the passage, your message and when you made it, until you delete it in the app or delete your account; then the file is deleted and its link stops working. Anyone who has the link can listen to it and see the passage, your display name and your message, on this website or in the app, without signing in, so share it only with the people you mean to hear it. If someone keeps it in the app's Received voices (收到的聲音), we record that their account kept it, until they remove it or delete their account.

Reporting and blocking. Anyone with a gift's link can report it, on this website or in the app. A report keeps which gift it is about, the reason chosen, anything typed into it, and when — nothing about who sent it: no account, and no IP address (that is used only to limit how many reports one connection can send in a minute, and is not saved with a report). A copy is emailed to us, and we may take the gift down; one taken down no longer shows its message or plays. In the app you can also block whoever sent you a gift: what they gave you leaves your list and cannot be redeemed, and they are not told.

One-time sign-in codes

To send a code we have to use the address you typed: codes are delivered through Cloudflare's email service. The address itself is not stored. For each code, our service keeps a record of:

• a keyed hash of the address and a keyed hash of the code;
• the masked hint;
• a keyed hash of your IP address (for IPv6, of its /64 network);
• the number of attempts, and when the code was created, expires and was used.

A code expires after 10 minutes and allows five attempts. These records are kept for at least an hour, because the limits that prevent abuse are counted over that hour, and records older than that are deleted the next time the service issues a code. They carry no account ID, so deleting an account does not remove them; this schedule does.

Service providers

• Cloudflare hosts our service and this website. For the service it also provides the database, file storage, AI inference and email delivery, and operational logging for the service is turned on at Cloudflare.
• Apple provides Sign in with Apple, payment for in-app purchases, iCloud sync if you turn it on, the maps in the atlas, and Siri when you use it with the app's shortcuts.
• LY Corporation provides LINE Login, if you sign in with LINE. We ask LINE only for your LINE user ID and display name, and the access token LINE issues with them is revoked as soon as you are signed in.
• Google, if you sign in with Google. The app and the website ask Google only for your account identifier and email address. On the website's account page, Google's sign-in button is loaded from Google.
• MiniMax, if you record your voice. It receives your recording and the Bible text of each chapter read in your voice, makes the voice and the audio, and deletes the voice when we ask it to.

We do not sell your information or share it for advertising.

This website

seekfind.tomorrowchurch.com has no analytics. Its account page, seekfind.tomorrowchurch.com/account, signs you in to the same account as the app, as described above. Otherwise the site remembers your language and visual-effects choices in your browser's local storage, and serves its own fonts. It is hosted by Cloudflare. Our company's home page, tomorrowchurch.com, is served the same way and stores nothing in your browser.

At seekfind.tomorrowchurch.com/join, a member of a group plan can read each day's passage and tick it off without the app, signed in to the same account with the same cookie. So that it also opens with no connection, your browser keeps a copy of that page and, for the account signed in, its group plans and the passages of the last 14 days you opened, in the browser's own storage (a service worker's cache). This copy stays on your device and is replaced whenever the page is online; the plans and passages in it are deleted when you sign out or your session ends, and the copy of the page itself holds nothing of yours. The page also remembers in local storage whether you chose the 上帝版 or 神版 of 和合本, and whether you dismissed the suggestion to add it to your home screen.

If you ask to be told when the app is in the App Store, we keep the email address you typed, the language of the page and, when the link you followed named one, which poster, slide or post it came from. We use the address only to announce the launch, and we remove it when you ask: write to hello@jovanauniverse.com.

If you sign up as a partner church, we keep what you typed into the form — the church's name and city, your name, your email address, a LINE ID or phone number if you gave one, the church's Sunday attendance, whether it plans a reading campaign, and your message — and a copy is emailed to us. We use these details only to contact that church, and we delete them when you ask.

Neither is linked to an account. Unlike an account's email, these addresses are kept as you typed them, because we need them to write to you. Your IP address is used to limit how many sign-ups one connection can send in a minute; it is not saved with a sign-up.

Deleting your data

To delete your account, open the Together (同行) tab, tap Account (帳號), then Delete account (刪除帳號); you can choose to keep or clear the progress stored on your phone. You can also delete it on the website at seekfind.tomorrowchurch.com/account.

Deleting your account removes from our service the account and its sign-in methods, your study days and lesson progress, your friendships in both directions, the plans you started, your membership and progress in other people's plans, any year of Pro a gift gave you, your name and message on gifts you gave (which can still be redeemed), every voice you recorded, as described below, with the chapters you gave in it, every recording of your real voice you sent, whose links stop working, and the list of what others gave you. It cannot be undone.

To delete only your voice, open Settings (設定) › Reading aloud (朗讀) › Delete my voice (刪除我的聲音). This deletes the recording, every chapter read in your voice on our service and on your phone, and the voice at MiniMax. Deleting your account does the same for every voice you recorded; if MiniMax cannot be reached at that moment, nothing is deleted and you are asked to try again, so that a copy of your voice is never left behind. Signing out removes the chapters kept on your phone.

It does not touch your highlights, notes, bookmarks, saved verses or reading plans, which were never sent to us. You can delete them in the app — with iCloud sync on, those deletions reach your other devices too — or delete the app to remove what is stored on that phone.

Your choices

• Change your display name under Account (帳號) › Display name.
• Add or remove sign-in methods under Account › Sign-in methods, or on the website at seekfind.tomorrowchurch.com/account. The last one cannot be removed; delete the account instead.
• Turn iCloud sync and the daily verse reminder on or off in the app's Settings.
• Turn the anonymous usage counts off in Settings › Send anonymous usage statistics.
• Take back chapters you gave in your voice, or delete a recording you sent, in the app; report a gift, or block whoever sent it, from the gift itself.
• Ask us what is held for your account at hello@jovanauniverse.com.

Children

Reading, Ask and the learning paths need no account. Accounts are not intended for children under 13. If you believe a child under 13 has created an account, contact us at hello@jovanauniverse.com and we will delete it.

Security

The app and the website connect to our service over HTTPS. An account's email address is stored only as a keyed hash — an address left on the website's waitlist or church form is kept as typed, as described above — passkeys only as public keys that cannot be used to sign in, and sign-in codes only as keyed hashes that expire. No system is perfectly secure.

Changes to this policy

If this policy changes, we will publish the new version on this page and update the effective date at the top.

Contact

Questions about this policy or your data: hello@jovanauniverse.com.