Privacy policy

The short version

Selah is a prayer journal. What you write into it is about as personal as it gets, so the short answer is this: your entries are not analysed, not passed on, and not used for advertising. There is no tracking, no analytics tool and no ad network in this app.

The long text below says the same thing again, in the way the GDPR requires.

Controller

The controller for the processing of your data within the meaning of the GDPR is:

Johannes Klaus Am Sportplatz 11 64673 Zwingenberg

Email: johannes.klaus@gmx.net

Hosting

Selah runs on a server operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in Nuremberg. A data processing agreement under Art. 28 GDPR is in place with netcup. Your data does not leave Germany.

When you open the site, the server processes the connection data it technically needs — IP address, time, requested address, browser identification. This is necessary to deliver the site at all and rests on the legitimate interest in operating it securely (Art. 6 (1) (f) GDPR).

Signing in with Google

Signing in is only possible with a Google account. When you do, Google passes me your name, your email address, the address of your profile picture and an identifier for your Google account. I never receive a password.

The legal basis is the performance of the user relationship (Art. 6 (1) (b) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may also be transferred to the United States. What Google itself collects during sign-in is set out in Google’s privacy policy.

Your profile picture is loaded from a Google server when the app displays it, which tells Google your IP address. The request is sent without a referrer, so it does not reveal which page you are on.

Your entries

Everything you create in Selah is stored in a database on the server named above:

• Prayer concerns with title, text, date and status
• Comments and notes on a concern
• Prayer sessions — when you looked at which concern
• Tags you choose yourself
• Answers to prayer and the testimonies you write about them
• Settings such as language and colour scheme

These entries allow conclusions to be drawn about your religious beliefs and are therefore a special category of personal data under Art. 9 GDPR. They are processed solely on the basis of your explicit consent (Art. 9 (2) (a) GDPR), which you give by signing in and creating entries, and which you may withdraw at any time with effect for the future.

They are used for one purpose only: showing your own entries back to you. There is no analysis, no profiling and no disclosure to third parties.

Cookies and browser storage

Selah sets a single cookie: the session cookie that keeps you signed in. It holds no content, only a random identifier, and expires after 30 days. It is strictly necessary for signing in to work and therefore requires no consent (§ 25 (2) no. 2 TDDDG).

So that the app also works without an internet connection, it keeps a copy of your own entries in your browser’s storage (IndexedDB and local storage). That copy lives on your device only. It is removed when you sign out or clear the site’s data in your browser.

Alongside your session, the server also stores the IP address and browser identification, so that unusual sign-ins remain recognisable. These are deleted when the session expires.

Fonts and external content

All typefaces are served from this site’s own server. No connection is made to Google Fonts or any other outside server.

Selah embeds no maps, videos, social media buttons or other third-party content. Apart from signing in and the profile picture at Google, no data travels to third parties.

How long data is kept

Your entries are kept for as long as your account exists. When you delete a concern it disappears from view at once; in the database it stays behind, marked as deleted, so that a mistake can be undone. It is removed for good when you have your account deleted or expressly ask for its deletion. Session data is deleted after 30 days at the latest.

To have your account and all its entries deleted, an informal message to johannes.klaus@gmx.net is enough. Deletion happens without undue delay, within one month at the latest.

A backup of the database is made daily. It stays on the same server and is deleted automatically after 30 days; for a restore, a copy may be transferred to a machine under my control. Until then, deleted data may still be contained in a backup.

Security

The connection to the site is encrypted with TLS throughout. Access to the server and the database is limited to me.

Your rights

Under the GDPR you have the following rights towards me:

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17)
• Restriction of processing (Art. 18)
• Portability of your data in a transferable format (Art. 20)
• Objection to processing (Art. 21)

A message to johannes.klaus@gmx.net is enough for any of these.

Consent once given may be withdrawn at any time with effect for the future (Art. 7 (3) GDPR). This does not affect the lawfulness of processing carried out until then.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one where you live (Art. 77 GDPR).

Changes

If something about Selah changes in a way that matters for data protection, this policy is updated. The version published here is the one that applies.