FAMILY BIBLE STUDY TOOL

Privacy

This copy of Family Bible Study Tool is run by the administrators of this site. It has no advertising and no product analytics, sells nothing, and does not try to follow you across sites. Hosting access logs and the external services used by specific features are described below.

Last updated: 23 September 2026

If you never sign in

Unless you send a problem report (see below), nothing about you is sent to this site’s database, and no cookies are set at all. Your reading position, highlights, notes, notebook and settings are written only to your own browser’s storage. Clearing your browser data removes them, and the administrators of this site cannot read that local copy. Anyone using the same browser profile may be able to read it; use a private device or clear its site data before sharing.

If you create an account

An account exists so your study follows you between devices. It stores:

• Your email address. No name, no profile, nothing else. It is not verified, and it is used only to identify the account and sign you in.
• When the account was created and when it last signed in, and whether it is a reader’s or an administrator’s account.
• Your password, hashed. PBKDF2-HMAC-SHA256 at 600,000 iterations with a random salt per account. The password itself is never stored and cannot be recovered from what is.
• Your reading progress — which chapters you have visited and where you last stopped, per book.
• Your highlights, chapter notes and notebook entries. Notes and notebook entries are free text and are stored as you typed them, unencrypted, in the database.
• Your S.O.A.P. journal entries. Scripture, observations, applications and prayers are free text and are stored as you typed them, unencrypted, in the database.
• Your reading-plan progress.
• Sign-in sessions — a hash of each session token, when it was created and when it expires.
• Password-reset requests — a hash of the one-time token, its expiry, and whether it has been used. The emailed token itself is never stored.

Cookies

One, and only after you sign in: __Host-sa_session. (A copy served over plain HTTP, without encryption, cannot set a __Host- cookie and names it sa_session instead.) It is HttpOnly and SameSite=Lax, it is Secure over HTTPS, and it lasts 30 days from when you sign in; signing out ends it sooner. It exists solely to keep you signed in. There are no analytics, advertising or preference cookies anywhere on this site, which is why you have never seen a consent banner here.

Who else sees anything

A short list, and some of it only if you use a specific feature.

• CARTO serves the map tiles. When a map is on screen your browser requests tiles directly from them, so they receive your IP address, your browser’s user-agent, and which part of the biblical world you are looking at. They do not receive which chapter you are reading.
• This deployment is hosted by Vercel, whose access logs record the IP address and path of every request. Some of those paths name the passage you are reading. The database is hosted by Neon.
• Your browser’s speech service, if you use Read Aloud. Reading aloud is done by the browser, not by this site — and on some browsers the better voices are network voices, which means the verse text is sent to that browser vendor to be spoken. This site cannot see or prevent that. If it matters to you, choose an offline voice in the reading settings, or do not use Read Aloud.
• The mail service this deployment uses for password-reset email, if one is set up, receives your address so it can deliver that message, and only then.

Nothing is sold or shared for advertising. The app does not load third-party advertising or analytics scripts.

What the administrators can see

The admin console shows each account’s email address and role, when it was created, when it last signed in and was last active, and how many books it has progress in, and it can download that list as a spreadsheet (CSV). It also lists the problem reports readers send, with the email address of the sender when they were signed in. It does not display anyone’s notes.

It also keeps an activity log of administrative and security events: sign-ins, new accounts, sign-in lockouts, completed password resets, account deletions, and every action an administrator takes in the console. Each entry records what happened and when, the email address of the account that acted and of the account it concerned (a lockout names the account only if it exists), and the IP address the request came from. No password, token or reset link is ever written to it. The administrators can read and search the log.

But you should assume the administrators can read everything. Whoever holds this deployment’s database credentials can read every email address, every highlight and the full text of every note, notebook entry and journal entry, because they are stored unencrypted. Backups taken with the project’s backup tool contain all of it too, the activity log included, unencrypted, wherever the administrators keep them; passwords are the one thing deliberately excluded from those backups. If you would not want a note read by another person, do not put it here.

How long things are kept

• Deleted notes and highlights stop being visible immediately and are removed from the record after 90 days. The delay is what lets the deletion reach your other devices instead of being undone by them.
• Sign-in sessions and password-reset requests stop working when they expire, are revoked, or are used, and a daily maintenance job deletes them after that.
• Failed sign-ins, registration attempts, reset-link requests and problem reports are counted, to slow down guessing and flooding. Each count is stored under a SHA-256 hash of what it counts — an email address, a network (one IPv4 address or one IPv6 /64), the two together, or an account’s internal id — so no email or IP address is stored in it as written. Hashing is not anonymising: anyone with the database and a guess at your address can confirm a match. The daily job deletes each count one day after its counting window opened.
• The activity log is kept for one year; the daily job deletes older entries. Deleting an account does not remove its entries, so its email address and the IP addresses it signed in from stay in the log until they are a year old.
• Problem reports carry what you wrote, the passage you were on, which view was open, and which build you were running. If you were signed in, a report is also linked to your account, the admin console shows your email address beside it so the administrators can follow up, and it is kept until an administrator deletes it. A report sent without an account is deleted 180 days after it was sent, if an administrator has not deleted it sooner. No account is needed to send one.
• Backups are plain JSON and deleting your account does not reach into one already taken. After a new backup succeeds, the backup tool deletes only its own timestamped dumps that are more than 90 days old.

The daily maintenance job is secured, and it refuses to run unless the operator has configured CRON_SECRET. Until that deployment step is verified, sessions, reset requests, counts, activity-log entries and reports past the periods above may remain in the database.

Getting your data, and getting rid of it

Download. My study → Download my study gives you a single file containing your progress, highlights, notes, notebook, S.O.A.P. journal and reading plan. It is yours, it needs no account, and it can be restored into this app on any device.

Deletion. Sign in, open the account menu in the top bar, and choose “Delete my account”. It offers you the download first, asks for your password, and asks you to type a word — then deletes the live server account and revokes its sessions. This device clears its study copy after confirmed deletion. Other devices, especially offline ones, may retain local copies: clear site data on each of them. Account deletion cannot be undone.

Three things a deletion does not reach at once, said plainly. It does not reach into a backup already taken, which is pruned after a later successful backup once it is over 90 days old; interrupted backups can extend that retention. It does not remove your entries from the activity log, which keeps your email address and the IP addresses you signed in from until each entry is a year old. And if you have reported a problem, the report survives so the fault can still be fixed — the text of reports linked to your account is erased with it; anonymous reports cannot be linked to account deletion, leaving only the fact that a chapter was flagged. That report is then linked to no account, so it is deleted 180 days after it was sent, like any report sent without one.

Forgotten password. Use “Forgot your password?” on the sign-in panel and a reset link is emailed to you. The link works once and expires in 30 minutes, and using it signs out every device. Sending that email is the one time this site contacts a third party on your behalf — the mail service receives your address in order to deliver it. If this deployment has no mail service set up, no email is sent, and you will need to contact the administrators.

Children

This is a Bible study tool with no social features, no messaging and no public content. It includes family materials for children to use with an adult. Adults should manage accounts and supervise shared-device use. An account stores the study content described above as well as an email address; avoid entering private information about children.

Changes

If this page changes in a way that affects what is stored or who sees it, the date at the top changes with it.

Contact

The administrators of this site handle deletion requests, questions, and anything that looks wrong: contact your administrator — the person or team that gave you access to this site.