2.1 Information You Provide Directly

When you create an account or use personalization features, we may collect:

• Identity data: name, email address
• Prayer context: information you choose to share about your liturgical preferences, prayer intentions, and worship habits (e.g., preferred rite, translation, or commemorations)
• Religious affiliation: information you voluntarily provide about your denominational background or tradition
• Child profile data (if you create a household):for each child profile you add, we store the child's first name, optional birth date, and liturgical preferences you set as the parent. No email address is collected for a child profile. If you enable an independent sign-in for a child, we also store a username (the child signs in by username only — no email is used).

You control what personal and spiritual information you share. Prayer context and religious affiliation data are optional and are used solely to personalize your worship experience.

2.2 Information Collected Automatically

When you visit commontide.app, we and our service providers may automatically collect:

• Log data: IP address, browser type and version, operating system, pages visited, time and date of visits, time spent on pages, referring URLs
• Device data: device identifiers, screen resolution, language settings
• Usage data: which liturgical services you access, which settings you use, features you interact with, and the timing of your prayer, office, and meditation activity (used for streaks and your personal practice history)
• Cookies and similar technologies: see Section 7 (CalOPPA) for details

2.3 Information from Third-Party Services

If you sign in using a third-party authentication provider (e.g., email magic link via Supabase), we receive the information necessary to create and authenticate your account.

Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: processing necessary to provide the service you have requested (e.g., authentication, rendering personalized liturgies)
• Legitimate interests: analytics and error monitoring to maintain and improve the service, where these interests are not overridden by your rights
• Consent: where we ask for and receive your explicit consent (e.g., before collecting prayer context or religious affiliation data, which are special category data under GDPR Article 9)

Note: Prayer context and religious affiliation constitute special category data under GDPR Article 9 (data revealing religious or philosophical beliefs). We collect this data only with your explicit consent and use it solely to personalize your worship experience.

Your Rights Under GDPR

You have the following rights with respect to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): request deletion of your personal data
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal

To exercise any of these rights, contact us at m@shadowandlife.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

International Transfers

Your data may be processed in the United States. Where we transfer data from the EU/UK to the US, we rely on standard contractual clauses or other appropriate safeguards as required by applicable law.

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

We Do Not Sell or Share Your Personal Information

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising.

Your California Privacy Rights

California residents have the right to:

• Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it
• Delete: request deletion of personal information we have collected, subject to certain exceptions
• Correct: request correction of inaccurate personal information
• Opt out of sale or sharing: we do not sell or share personal information, so no opt-out is necessary
• Limit use of sensitive personal information: request that we limit the use of your sensitive personal information (including religious beliefs) to purposes necessary to provide the service
• Non-discrimination: we will not discriminate against you for exercising your California privacy rights

To submit a verifiable consumer request, contact us at m@shadowandlife.com. You may submit a request on behalf of a minor child for whom you are the parent or legal guardian.

Minimum age for an account holder

The minimum age to create your own Commontide account depends on your location:

• 16 — if you are in the European Union, EEA, or United Kingdom
• 14 — if you are in China
• 13 — everywhere else, including the United States

If you are below the applicable threshold for your location, please do not create an independent account.

Child profiles within a household

A parent or legal guardian who holds a Commontide account may add child profiles to their household for children of any age. The parent — not the child — establishes the data-processing relationship. Child profiles store only: the child's first name, an optional birth date, and liturgical preferences the parent sets. No email address is collected for a child profile.

Parental access and control

The account holder retains full access to their children's profile data at all times and may edit any field or permanently delete a child profile from Settings → Household & Profiles. Deletion cascades all data associated with that profile. If a child has an independent sign-in, revoking consent immediately disables their access; deleting the profile removes their auth credentials.

What we do not do with child profile data

• We do not share it with third parties beyond the subprocessors in Section 4.
• We do not use it for advertising.
• We do not disclose it outside the household account.
• We do not use it to train models.
• We treat it as special-category religious data.