Privacy Policy

Effective date: June 11, 2026

1. Introduction

Myrosa ("we," "our," or "the app") is a Catholic Rosary prayer application for iOS. We are committed to protecting your privacy. This policy explains what information the app accesses, how it is used, and your rights regarding your data.

This Privacy Policy describes the data practices of the Myrosa iOS app. The myrosa.app website is a static marketing page; the limited data Vercel collects when hosting it is described in Section 15 below.

2. Information We Do Not Collect

If you never sign in, Myrosa works fully on-device and we store nothing about you on our servers. Whether or not you sign in, the app has:

• No general usage analytics or behavioral tracking
• No advertising or ad networks
• No crash reporting services
• No third-party analytics SDKs
• No selling, renting, or sharing of your data for marketing

3. Information Stored on Your Device

All app data is stored locally on your device and is never transmitted to us or any third party. This includes:

• Prayer history — records of completed prayer sessions, including mystery set, duration, and completion status
• Preferences — language, voice selection, haptic settings, and display options
• Rosary design — bead colors, chain materials, medal choices, and lighting settings
• Profile information — display name and profile photo. The photo always stays on your device; the display name also stays on your device unless you publish a voice recording (see Section 6)
• Prayer intentions — personal prayer requests you enter during sessions

4. Device Permissions

Myrosa may request the following permissions, each used solely for the stated purpose:

• Microphone — to record your voice praying the Rosary (for optional publishing, see Section 6) and for on-device speech recognition that follows along as you pray. The microphone is active only while you are recording or in a session that uses voice tracking.
• Camera — to take a profile photo during onboarding. The photo is stored locally on your device and is never uploaded.
• Photo Library — to select photos for the Prayer Wall and rosary medal companions. The app references photos by identifier only; it does not copy, import, or upload your photos.
• Calendar — to create prayer schedule events via iOS Calendar so family members can see shared prayer times. Events are created through Apple's EventKit framework and sync through your own iCloud or local calendar.

You can revoke any permission at any time through iOS Settings.

5. Optional Account (Sign in with Apple)

Signing in is optional. You can use all of Myrosa's prayer features without an account; an account is required only to publish your own voice recordings. If you choose to sign in, Myrosa uses Sign in with Apple:

• Apple shares your name and email address with us according to the choices you make at sign-in (including Hide My Email).
• We use this to create an authenticated account with Firebase Authentication, a service operated by Google.
• You can delete your account, and everything connected to it, at any time from within the app (see Section 11).

6. Voice Recordings You Publish

Myrosa lets you record yourself praying the Rosary and share that recording with the community. If you publish a voice recording:

• The audio, your display name, the recording's language, and — if you choose to provide one — a coarse, city-level place you typed in (Myrosa never uses GPS or device location) are uploaded to our cloud backend, Google Firebase (Firestore and Cloud Storage).
• Published recordings are publicly discoverable by other Myrosa users, including on the community map.
• Recordings are screened by automated moderation — speech-to-text transcription and AI review — and may also be reviewed by a person. Other users can report or block content, and reported content may be hidden while we review it.
• You can delete a published voice recording at any time from within the app, which removes it from our servers and from discovery.

7. SharePlay (Group Prayer)

Myrosa supports praying together using Apple's SharePlay (GroupActivities framework). During a SharePlay session:

• Prayer progress, display names, and session state are shared peer-to-peer between participants
• All communication is encrypted by iOS
• No data passes through our servers — Apple's framework handles all connectivity
• No session data is retained after the session ends

8. Voice Packs

Optional voice packs (additional prayer voices) are downloaded from our cloud storage, hosted on Google Firebase. Downloading a voice pack does not require an account and does not send any personal data — the app simply fetches the audio files.

9. Third-Party Services

Beyond Apple-provided frameworks, the Myrosa iOS app uses a small number of third-party services:

• RevenueCat — manages in-app purchases, as described in Section 10.
• Google Firebase — provides authentication, the cloud database, and file storage for optional accounts and published voice recordings, as described in Sections 5 and 6. Google's privacy policy is at policies.google.com/privacy.
• Moderation services — third-party speech-to-text and AI review services process published recordings solely for content moderation, as described in Section 6.

We do not integrate any third-party analytics, advertising, social media, or crash-reporting services into the app. The myrosa.app website uses Vercel for hosting and Postmark for the contact form, both described in Sections 15 and 16.

10. In-App Purchases

Myrosa offers optional Patron subscriptions (monthly and yearly) and a one-time Lifetime purchase. All transactions are processed by Apple through the App Store and StoreKit — Apple handles your payment, and Myrosa never receives your name, email address, or payment-card information.

To validate receipts and manage subscription entitlements, Myrosa uses RevenueCat, a purchase-infrastructure service operated by RevenueCat, Inc. When you make or restore a purchase, the App Store receipt and an anonymous app-user identifier generated on your device are sent to RevenueCat. Myrosa does not send your name, email address, or any custom identifier to RevenueCat. Consistent with the data-type "Purchases — Used for Analytics, and App Functionality" declared on Myrosa's App Store listing, RevenueCat may use this purchase data in aggregate to power features (such as entitlement checks and restore-purchases) and to provide subscription analytics. This data is not linked to your identity.

Apple's handling of payment information is governed by Apple's privacy policy at apple.com/legal/privacy. RevenueCat's privacy practices are described at revenuecat.com/privacy.

11. Data Deletion

You can delete all on-device app data at any time from within the app. This removes all prayer history, preferences, profile information, downloaded voice packs, and design customizations from your device. Deleting the app entirely removes all of this as well.

If you created an account, Settings → Delete Account permanently removes your account and everything connected to it from our servers — your published voice recordings, profile, and share codes. This cannot be undone. You can also delete individual published voice recordings without deleting your account.

12. Children's Privacy

The core Myrosa experience collects no personal information. Accounts and voice publishing are optional features that are not directed at children under 13, and we do not knowingly collect personal information from children under 13. The app is suitable for all ages.

13. Changes to This Policy

If we update this Privacy Policy, we will post the revised version on this page with a new effective date. We encourage you to review this page periodically.

14. Contact

If you have questions about this Privacy Policy, please use the contact form at myrosa.app/support and choose "Privacy question" as the topic.

15. Website Hosting

The myrosa.app website is hosted on infrastructure provided by Vercel Inc. When you visit this page, Vercel processes standard hosting data on our behalf:

• Hosting logs — IP address, user agent, requested URL, and request timestamp, used by Vercel for routing, abuse prevention, and operational reliability.
• Vercel Web Analytics — we have enabled Vercel's built-in analytics, which records anonymized page views and aggregate visitor metrics. Per Vercel's documentation, this product does not set cookies and does not perform cross-site fingerprinting.

This website disclosure is separate from the iOS app's data practices described in Sections 2–13. The Myrosa app itself does not include analytics, advertising, or tracking SDKs. For Vercel's own privacy commitments, see vercel.com/legal/privacy-policy.

16. Contact Form

The myrosa.app website includes an opt-in contact form on the Support page. If you submit a message through this form:

• Your email address, chosen topic, and message are relayed as a single notification to the site owner via Postmark, a transactional email service operated by ActiveCampaign LLC.
• The notification also includes basic spam-diagnostic metadata: timestamp, the page you submitted from, your browser's user-agent string, and the request IP address as forwarded by Vercel.
• This information is used solely to respond to your inquiry. It is not stored in a database, CRM, or marketing platform, and it is not used for marketing.
• It is not sold, rented, or shared with any third party beyond Postmark's role as the delivery mechanism and Vercel's role as the hosting provider.
• You can request removal at any time by submitting another message through the same form; we will delete the prior message containing your address from the owner's inbox.

Postmark's privacy practices are described at postmarkapp.com/privacy-policy.