Privacy Policy

Commontide (“we,” “us,” or “our”) operates the website at commontide.app — a digital Daily Office providing Morning Prayer, Evening Prayer, Compline, and related liturgical content according to the Book of Common Prayer tradition.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your rights regarding that information. We take the privacy of worshippers seriously and handle personal data — especially data relating to religious practice and spiritual life — with particular care.

By using Commontide, you agree to the collection and use of information in accordance with this policy.

2.1 Information You Provide Directly

When you create an account or use personalization features, we may collect:

• Identity data: name, email address
• Prayer context: information you choose to share about your liturgical preferences, prayer intentions, and worship habits (e.g., preferred rite, translation, or commemorations)
• Religious affiliation: information you voluntarily provide about your denominational background or tradition
• Child profile data (if you create a household): for each child profile you add, we store the child's first name, optional birth date, and liturgical preferences you set as the parent. No email address is collected for a child profile. If you enable an independent sign-in for a child, we also store a username (the child signs in by username only — no email is used).

You control what personal and spiritual information you share. Prayer context and religious affiliation data are optional and are used solely to personalize your worship experience.

2.2 Information Collected Automatically

When you visit commontide.app, we and our service providers may automatically collect:

• Log data: IP address, browser type and version, operating system, pages visited, time and date of visits, time spent on pages, referring URLs
• Device data: device identifiers, screen resolution, language settings
• Audio playback diagnostics (iPhone app): when you listen to an office in the app or in the car, the app records how long each pause between recordings took, whether a recording played from your device or over the network, the kind of network connection (for example Wi-Fi or cellular), the audio output in use (for example the phone's speaker, Android Auto, or CarPlay), and the app and iOS version. We use this to find and fix challenges in playback across the wide variety of devices that exist.
• Usage data: which liturgical services you access, which settings you use, features you interact with, and the timing of your prayer, office, and meditation activity (used for streaks and your personal practice history)
• Cookies and similar technologies: see Section 7 (CalOPPA) for details

2.3 Information from Third-Party Services

If you sign in using a third-party authentication provider (e.g., email magic link via Supabase), we receive the information necessary to create and authenticate your account.

We use the information we collect to:

• Provide and improve the service: render Daily Office liturgies, personalize content to your preferences, and maintain your account
• Communicate with you: send service-related emails such as authentication links, account notices, and updates about Commontide (you may opt out of non-essential communications at any time)
• Analyze and improve performance: understand how Commontide is used so we can improve the liturgical content and user experience
• Ensure security: detect and prevent fraud, abuse, and technical errors
• Comply with legal obligations: respond to lawful requests from public authorities where required

We do not sell your personal information.

We engage the following service providers who may process personal data on our behalf. Each is bound by contractual obligations to handle data securely and only as directed.

We do not share your personal data with third parties except as described in this policy or as required by law.

We retain your personal information for as long as your account is active or as needed to provide you with the service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain it longer.

Aggregate, anonymized analytics data that cannot be linked to any individual may be retained indefinitely.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS/TLS), access controls, and regular security assessments of our infrastructure.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

In compliance with the California Online Privacy Protection Act, we make the following disclosures.

We use the following types of tracking technologies:

• Essential cookies: Required for authentication and to maintain your session
• Preference cookies: Used to remember your liturgical settings and display preferences
• Analytics: Vercel Analytics collects aggregate, cookieless usage data. No cross-site tracking or advertising identifiers are used.

Do Not Track signals: We honor browser-level Do Not Track (DNT) signals. When DNT is enabled, we disable analytics tracking for your session.

You may disable cookies in your browser settings at any time. Disabling essential cookies may affect your ability to log in or use personalization features.

If you are located in the European Union or United Kingdom, the following applies to you.

Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: processing necessary to provide the service you have requested (e.g., authentication, rendering personalized liturgies)
• Legitimate interests: analytics and error monitoring to maintain and improve the service, where these interests are not overridden by your rights
• Consent: where we ask for and receive your explicit consent (e.g., before collecting prayer context or religious affiliation data, which are special category data under GDPR Article 9)

Note: Prayer context and religious affiliation constitute special category data under GDPR Article 9 (data revealing religious or philosophical beliefs). We collect this data only with your explicit consent and use it solely to personalize your worship experience.

Your Rights Under GDPR

You have the following rights with respect to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): request deletion of your personal data
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal

To exercise any of these rights, contact us at m@shadowandlife.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

International Transfers

Your data may be processed in the United States. Where we transfer data from the EU/UK to the US, we rely on standard contractual clauses or other appropriate safeguards as required by applicable law.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

We Do Not Sell or Share Your Personal Information

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising.

Your California Privacy Rights

California residents have the right to:

• Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it
• Delete: request deletion of personal information we have collected, subject to certain exceptions
• Correct: request correction of inaccurate personal information
• Opt out of sale or sharing: we do not sell or share personal information, so no opt-out is necessary
• Limit use of sensitive personal information: request that we limit the use of your sensitive personal information (including religious beliefs) to purposes necessary to provide the service
• Non-discrimination: we will not discriminate against you for exercising your California privacy rights

To submit a verifiable consumer request, contact us at m@shadowandlife.com. You may submit a request on behalf of a minor child for whom you are the parent or legal guardian.

Commontide is designed for family prayer, including children praying together with parents or guardians.

Minimum age for an account holder

The minimum age to create your own Commontide account depends on your location:

• 16 — if you are in the European Union, EEA, or United Kingdom
• 14 — if you are in China
• 13 — everywhere else, including the United States

If you are below the applicable threshold for your location, please do not create an independent account.

Child profiles within a household

A parent or legal guardian who holds a Commontide account may add child profiles to their household for children of any age. The parent — not the child — establishes the data-processing relationship. Child profiles store only: the child's first name, an optional birth date, and liturgical preferences the parent sets. No email address is collected for a child profile.

Parental access and control

The account holder retains full access to their children's profile data at all times and may edit any field or permanently delete a child profile from Settings → Household & Profiles. Deletion cascades all data associated with that profile. If a child has an independent sign-in, revoking consent immediately disables their access; deleting the profile removes their auth credentials.

What we do not do with child profile data

• We do not share it with third parties beyond the subprocessors in Section 4.
• We do not use it for advertising.
• We do not disclose it outside the household account.
• We do not use it to train models.
• We treat it as special-category religious data.

If you are a parent or guardian and believe your child has registered independently without a parent's account, please contact us at m@shadowandlife.com and we will delete that account promptly.

Commontide may link to external resources (e.g., scripture providers, denomination websites). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

On iPhone and Apple Watch, the Centering Prayer feature writes the duration of each completed session to Apple Health as a mindful session (Mindful Minutes). This data is written only on your device.

Commontide does not read any data from Apple Health, and does not store or transmit any Apple Health data to our servers. You can revoke Commontide's permission to write to Apple Health at any time in iOS Settings → Privacy & Security → Health.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page, and — where required by law or where changes materially affect your rights — by sending notice to your registered email address. Your continued use of Commontide after any change constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

For questions, concerns, or to exercise any of your privacy rights, please contact us:

• By email: m@shadowandlife.com
• By visiting this page: commontide.app/privacy

We aim to respond to all inquiries within 30 days.