Orant
Privacy Policy
Orant — the orantapp.com website and the Orant mobile application
The plain-language version
We built Orant to collect as little as possible. Here is the short version; the full policy below is the legally binding one.
- Prayers you write on the website stay in your browser. They are not sent to our analytics and are not stored on our servers. The only time a prayer leaves your device from the website is when you explicitly ask us to email it to you.
- In the app, your personal prayers are private to your account — stored securely so they sync to your devices, and visible to no one but you. Content you choose to share with a circle is visible to the members of that circle, and no one else. There is no public feed.
- Email is used only if you ask for it, and you can unsubscribe at any time.
- Analytics on the website are anonymized, consent-denied by default, and cookieless. We never send prayer text or personal information to analytics.
- We do not sell your personal information, and we do not use it for advertising.
- You can export your data and delete your account at any time from within the app.
1. Who we are and what this policy covers
This Privacy Policy is issued by Michael Bilderbach, a sole proprietor doing business as "Orant" ("Orant," "we," "us," or "our"), the operator of the website at orantapp.com (the "Site") and the Orant mobile application for iOS and Android (the "App," and together with the Site, the "Services"). We are based in the United States.
This policy describes the personal information we collect through the Services, how we use and disclose it, and the rights and choices available to you. It applies to visitors of the Site, users of the App, and members of circles, including circles operated by churches and ministries.
Because Orant is a prayer application, some information you choose to provide — such as the content of prayers and prayer requests — may reveal or imply your religious beliefs. We treat this as sensitive information, we minimize our collection of it by design, and where the law requires it (for example, under the EU and UK GDPR), we process it only on the basis of your explicit consent, given through your deliberate actions in the Services (such as tapping "share with my circle" or "email me this prayer").
2. Information we collect
We collect information in three ways: information you provide directly, information collected automatically, and information processed locally on your device that we never receive.
2.1 On the Site (orantapp.com)
Prayer content you compose. When you use the prayer composer or the share card on the Site, everything you type is processed locally in your browser. Your prayer text is not transmitted to our servers and is not sent to our analytics provider. Drafts may be held in your browser's local storage on your own device until you clear them.
Email address and requested prayer (opt-in only). If you choose "email me this prayer," we transmit your email address and the specific prayer you requested to our email service provider, Resend (Resend, Inc.), solely so that we can deliver it. If the page offers a short prayer series and you opt in, we will use the same address to send that series. Every email includes an unsubscribe link.
Analytics data. We use Google Analytics 4 in a privacy-preserving configuration to understand which pages help people, using measurements such as page views and button taps. Consent for advertising storage and analytics storage is denied by default (Google Consent Mode), so analytics operate in a cookieless mode using aggregate, anonymized signals. IP addresses are used transiently to route requests and derive coarse, city-level geography and are not logged or stored by us. We do not send names, email addresses, prayer text, or any other personal information to analytics.
2.2 In the App
Account information. When you create an account, we collect the information needed to operate it: your email address, a display name, and authentication credentials (your password, which is stored only in hashed form and is never visible to us). If you choose to add one, we also store a profile photo.
Prayer content and reflections. Prayers, reflections, and related content you create in the App are private to your account. They are stored on our servers (through our hosting provider, Supabase) and loaded only for your signed-in account, so they are available across your devices; they are not shown to anyone else. This content is protected by encryption in transit (TLS) and at rest, but it is not end-to-end encrypted, which means Orant is technically able to access it to operate and support the Services. Reminder preferences and certain settings are kept only on your device.
Circle content. When you post a prayer request, praise, comment, or response (such as "Prayed," "With you," or "Amen") to a circle, that content — together with your display name, unless you post anonymously — is stored on our servers and made visible to the members of that circle. Anonymous requests are displayed to circle members without your name attached. For safety and abuse moderation, Orant's systems retain the association between an anonymous post and the account that created it; circle leaders and other members cannot see who authored an anonymous post.
Contacts (opt-in). Access to your device contacts is strictly opt-in and is used only to help you invite people to a circle. Contact identifiers (phone numbers and email addresses) are normalized and hashed (SHA-256) on your device; only the resulting one-way hashes are sent to Orant, and only to match against people already on Orant. Your raw contacts are never transmitted to or stored by Orant.
Notifications. If you enable reminders or circle notifications, we process a device push token through Apple Push Notification service (on iOS) or Firebase Cloud Messaging by Google (on Android) to deliver them. You can disable notifications at any time in the App or in your device settings.
Device and diagnostic data. We process limited technical information necessary to operate and secure the App, such as device type, operating system version, app version, and language. Orant does not currently use any third-party analytics or crash-reporting SDK in the App; we do not build advertising or behavioral profiles of you.
Church and ministry circles. If you join a circle operated by a church or ministry, the circle's leaders can see the circle's membership and aggregate engagement information (such as member counts, prayer counts, and recent activity), as well as the content shared within that circle, in order to shepherd the group. Circle leaders are independent of Orant and are responsible for their own use of information they can see within their circles.
2.3 Information we do not collect
We do not collect precise geolocation. We do not use advertising identifiers or advertising SDKs. We do not scan or mine the content of your prayers for advertising, profiling, or model training. We do not operate a public feed, and nothing you write in the Services is made public.
3. How we use information
We use the information described above to: (a) provide, maintain, and secure the Services, including delivering circle content to the correct members; (b) deliver emails and notifications you have requested; (c) understand, in aggregate, how the Site and App are used so we can improve them; (d) prevent abuse, enforce our terms, and protect the safety of our users; and (e) comply with legal obligations. We do not use your personal information for targeted advertising, and we do not sell it.
4. Legal bases for processing (EEA, UK, and Switzerland)
Where the GDPR or UK GDPR applies, we rely on the following legal bases: consent (Art. 6(1)(a)) for optional emails, the prayer series, contact access, notifications, and any future consent-based analytics storage; explicit consent (Art. 9(2)(a)) for content that may reveal religious beliefs, which you give through your deliberate act of composing, sharing, or requesting delivery of that content; performance of a contract (Art. 6(1)(b)) to provide the account-based features of the App you sign up for; legitimate interests (Art. 6(1)(f)) for cookieless aggregate analytics, service security, and abuse prevention, balanced against your rights and freedoms; and legal obligation (Art. 6(1)(c)) where we must retain or disclose information under applicable law. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act ("CCPA/CPRA"). We disclose personal information only as follows:
- With your circle, when you choose to share content with it, as described above.
- With service providers who process information on our behalf under contractual confidentiality and data-protection obligations, limited to what is necessary: Resend, Inc. (email delivery), Google LLC (Google Analytics 4, in the consent-denied configuration described above, and Firebase Cloud Messaging for Android notifications), Apple Inc. (push notification delivery on iOS), Supabase, Inc. (application database, authentication, and file storage), and Vercel, Inc. (website hosting).
- For legal reasons, if we reasonably believe disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Orant, our users, or the public.
- In a business transfer, such as a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information and we will notify you of any material change in ownership or use.
We never disclose the content of prayers to third parties for their own purposes.
6. Cookies, analytics, and similar technologies
The Site works without advertising cookies. Google Analytics 4 runs in a consent-denied, cookieless mode by default: no analytics or advertising cookies are set, and only aggregate, anonymized signals are processed, unless a future consent banner is introduced and you affirmatively enable additional storage. The Site may use strictly necessary local storage in your browser to keep your unsent prayer drafts on your own device.
Because we do not track visitors across third-party websites and do not respond to tracking for advertising purposes, the Site's behavior is the same whether or not your browser sends a "Do Not Track" or Global Privacy Control signal; in all cases, no personal information is sold or shared for advertising.
7. Data retention
We keep personal information only as long as necessary for the purposes described in this policy. As guidelines: email addresses used for the prayer series are retained until you unsubscribe or ask us to delete them; transactional email records are retained for up to 24 months; account and circle content is retained while your account is active and is deleted promptly when you delete your account, with residual backup copies purged within 30 days. When you delete your account, the prayer requests, praises, comments, and responses you posted to circles are deleted along with it. Aggregate analytics data is retained according to our Google Analytics configuration (up to 14 months). Content that never leaves your device (Site drafts, and on-device App settings) remains under your control until you clear it.
8. Security
We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information we handle, including encryption of data in transit (TLS) and at rest, access controls, and the data-minimization architecture described throughout this policy. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; if we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
9. Your rights and choices
Everyone. You can unsubscribe from any email via the link in the email; disable notifications in the App or your device settings; revoke contacts access in your device settings; export your data from within the App; and delete your account at any time from within the App (from the App's account settings — "Download my data" and "Delete account").
EEA, UK, and Switzerland. You have the right to access, rectify, and erase your personal data; to restrict or object to processing; to data portability; to withdraw consent at any time; and to lodge a complaint with your supervisory authority (in the UK, the ICO).
United States. Depending on your state of residence (including California, Colorado, Connecticut, Texas, Utah, Virginia, and others), you may have the right to know, access, correct, and delete personal information we hold about you, to obtain a portable copy, and to opt out of sales, sharing, or targeted advertising — noting that we do not sell or share personal information or engage in targeted advertising. We do not use or disclose sensitive personal information for purposes requiring a "limit use" right under the CPRA. We will not discriminate against you for exercising any right.
To exercise any right, contact us at info@orantapp.com. We will verify your request using the email address associated with your account or request and respond within the time required by applicable law. You may use an authorized agent where the law permits; we may require proof of the agent's authority.
10. International data transfers
We are based in the United States, and our service providers may process information in the United States and other countries. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, and, where applicable, providers' certification under the EU–U.S. Data Privacy Framework.
11. Children's privacy
The Services are not directed to children under 13 (or the higher age required in your jurisdiction, such as 16 in parts of the EEA), and we do not knowingly collect personal information from them. Families and church communities sometimes pray together; where a minor participates in a circle, we expect a parent, guardian, or responsible circle leader to have invited and to supervise that participation. If you believe a child has provided us personal information without appropriate consent, contact us at info@orantapp.com and we will delete it.
12. Third-party links
The Site and App may link to third-party websites or services (for example, the App Store, Google Play, or a church's own website). This policy does not apply to those third parties, and we encourage you to review their privacy policies.
13. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by prominent notice on the Site, in the App, or by email before the changes take effect, and we will update the "Last updated" date above. Your continued use of the Services after the effective date of a revised policy constitutes your acknowledgment of the revision; where the law requires consent for a new use of your information, we will ask for it.
14. Contact us
If you are in the EEA or UK and are not satisfied with our response, you have the right to complain to your local data protection authority.