Privacy policy

Using the site without an account

You do not need an account to use the website. Reading, comparing, studying and memorising Scripture, the flashcards, the reading plan, the rewards and the manual Pastor's Friend tools are free, and there is no time limit for guests.

Your study progress, including points, streaks, badges, known flashcards, roadmap choices and completed readings, is stored in your browser on your own device. If you use Pastor's Friend without an account, your sermons, notes and memory items are stored there too. I never receive any of this. It is not uploaded unless you choose to copy a draft to your account, and clearing this site's data in your browser removes it permanently.

Legal basis: none needed from me, because this information stays on your device and I do not process it. The browser storage is used only to make the tools you ask for work (see “Cookies and storage in your browser”).

Visiting a page

When your browser loads a page, it sends technical information: its IP address, the page it asked for, the date and time, the type of browser and device, and the page you came from. Cloudflare, which hosts and protects the website, handles this to deliver the pages and to block attacks. Apart from the AI request counter described below, my own code does not record the IP address of people who read pages, and the website has no analytics.

Legal basis: legitimate interests, in running a secure and reliable website.

Fonts, icons and the video picture

The website loads fonts from Google Fonts and icons from jsDelivr. The homepage also shows a thumbnail picture of the featured video, which your browser requests from YouTube's image servers (i.ytimg.com, a Google service) when the picture is about to scroll into view; no page address is sent with it. The YouTube video player itself is loaded only if you press play, from YouTube's privacy-enhanced address.

Your browser asks those companies for these files directly, so they receive your IP address and ordinary browser details. Google says that Google Fonts sets no cookies. jsDelivr says that it sets no cookies and keeps your IP address, browser details and the website you came from in its logs. I do not control what they do with their logs; their notices are linked under “Who else handles your information”. If you block these requests with a browser setting or extension, fonts and icons may not appear, but the site still works.

Once you press play, YouTube (Google) can collect information such as your IP address and store information on your device under its own notice.

Legal basis: legitimate interests, in showing the site as it is designed, for the fonts, icons and picture. For the video player, your own choice to press play.

Making and using an account

Accounts are optional. An account is needed only for AI drafting and for keeping copies of your sermons in your account. If you make one, I store:

• your email address;
• your password in a protected form (a one-way “hash” made with PBKDF2-SHA256), never as readable text. Passwords must be at least 15 characters;
• the date your email address was verified;
• your sign-in sessions: a random code (kept only as a hash), when it was made and last used, and when it expires;
• short-lived records of the verification and reset links I email you (kept only as hashes);
• counters, kept under a one-way code made from your IP address or email address rather than the address itself, that limit repeated sign-in attempts in 15-minute windows.

I use these to let you sign in and stay signed in, to confirm that the email address is yours, to reset a forgotten password and to protect accounts from guessing.

Legal basis: contract, because this is needed to give you the account you asked for. Legitimate interests, in keeping accounts secure, for the sign-in attempt counters.

Sermons, notes and memory items saved in your account

If you save a sermon, note or memory item to your account, or create one there, I store its text, its Scripture links and its version history, linked to your account. Your device-stored drafts are not uploaded or merged when you sign in; copying a draft to your account is a separate choice you make.

When you delete a sermon or note in your account, it is marked as deleted so that you can recover it. It stays in my database until you delete your account.

I do not look at what is in your account unless you ask me to help with a problem or the law requires it.

Legal basis: contract, to keep your work and let you reach it from any device. What you write can reveal your religious beliefs, which the law treats as special category information. I handle it only because you ask me to, and I rely on your explicit consent (Article 9(2)(a) of the UK GDPR), which you give by choosing to save it. You can withdraw that consent at any time by deleting the item or your account.

AI drafting in Pastor's Friend

Pastor's Friend can draft with AI: a message brief, an outline, a full sermon draft, and actions on one section of a saved sermon (shorten, expand, make clearer, suggest an application, add an example, or add discussion questions). AI drafting needs a verified account and uses an AI allowance, with a free trial; the Plans page explains the rules. You do not need an account for anything else on this site.

What is sent to the AI provider:

• For a brief, only the fields you fill in on the form: your topic, passage, audience, occasion, length, tone, purpose, Sermon English and writing style. Your saved pastor notes are included only if you tick the consent box, which is unticked by default.
• For an outline or a draft, the brief you approved, the outline if you approved one, and, for a long sermon written in parts, the parts already written.
• For an action on a section, that section's heading and the text you have written in it. Scripture, quotation, private-note, slide-cue and stage-direction blocks are not sent. A verse or quotation you have typed into a paragraph is part of that paragraph's text and is sent.
• The text of the Bible passages you chose, taken from this site's own Berean Standard Bible and World English Bible data, so that the AI works from verified text. Bible quotations are not written by the AI.

Your name, email address, account number and IP address are not sent, and nothing else stored on your device is sent. The request is made by this site's server, so the AI provider sees the server, not you. Please do not put other people's private or confidential details (for example from someone's counselling) into text you send for AI drafting.

Who receives it: Anthropic, which provides the Claude AI models. Under Anthropic's terms for its API, what I send is not used to train its models by default. Anthropic says it normally deletes API inputs and outputs within 30 days, and that content its systems flag as breaking its usage policy can be kept for longer, up to two years.

What I keep: I do not keep the draft. It is shown to you and saved on your device automatically as soon as it arrives, and you remain responsible for reviewing anything generated before you use it. Saving a copy to your account is your choice. For each AI request I keep a usage record: the kind of action, the AI model, how much it used and what it took from your allowance, the reference Anthropic gave the request, and the times. It does not contain your text or the draft.

To limit use, the website records how many AI requests each internet (IP) address has made in an hour, in a counter in its own database, together with the address itself, the kind of request and the hour. Those counters are deleted 24 hours after the hour they count has ended.

Legal basis: contract, to produce the draft you ask for. Legitimate interests, in keeping your allowance right (the usage records) and in protecting the paid AI service from misuse and runaway cost (the IP counters). Because sermons and notes can reveal religious beliefs, I also rely on your explicit consent (Article 9(2)(a)), which you give when you press the button that sends the text. The pastor-notes box is a separate consent.

AI allowance, free trial and extra credit

I store when your free AI trial started and ends, the allowances granted to you (from the trial, a paid plan or extra credit) and when they run out, and the usage records above.

I do not keep any record of a trial once an account is deleted, so someone who deletes an account and makes a new one may be offered a new trial.

Legal basis: contract, for the trial and allowances.

Paying for a plan or extra credit

Paid plans and extra credit are not on sale on this site at the moment, so none of the following is happening yet. This is what will happen when they are.

When you buy a paid plan or extra AI credit, you enter your card details on a page run by Stripe, our payment provider. Your card details never reach this site and I never see or store them.

I send Stripe your account's verified email address (so that receipts reach you), an internal account number, which plan or credit pack you chose, and the version of the terms and the time you agreed to when you ordered. Stripe's page asks for your card details and what it needs to take the payment, such as your name and postcode, and collects device and browser information to prevent fraud, including its own cookies on its page. Stripe may email you a receipt for each payment and refund. Stripe may also show you the price in your own currency, which it chooses from where you are; if you pay in that currency, Stripe’s exchange rate includes a conversion fee of 2 to 4 per cent.

Stripe tells my website whether a payment succeeded. I keep Stripe's references for you (customer and subscription), your plan with its status and dates, the AI allowance each payment gave you, details of any credit packs you bought (the pack, the price and the times), and Stripe's event references. The record of what you agreed to when ordering is kept on Stripe's records, not in my database. I do not keep card details.

Stripe acts as my processor when it takes a payment for me, and as a controller in its own right for things it must do itself, such as preventing fraud and meeting financial regulations. Read the Stripe Privacy Policy. The terms of sale and the cancellation and refund policy explain what you are buying and your rights.

Legal basis: contract, to take payment and give you the plan or credit. Legal obligation (Article 6(1)(c)), to keep accounting and tax records.

Emails the website sends

The website sends two kinds of email, only to the address you give and only when you ask: a link to verify your email address, and a link to reset your password. They are sent through Resend, an email delivery service, and contain your address and a link that works once (it is valid for 24 hours to verify an address and for 30 minutes to reset a password). They are plain text. I send no newsletters, reminders or marketing, and I do not track whether you open them or click the link.

Legal basis: contract, to set up and secure the account you asked for.

Contacting me

You can contact me by email (the addresses on the Contact page end in @trythebible.co.uk), by telephone or WhatsApp on 07467 437 773, or through the social media links. If you do, I receive what you send, such as your name, email address or telephone number and your message, and I use it to reply and to keep a note of what was agreed. Apart from the feedback form described below, the website has no contact form and does not store messages itself.

If you join the Try the Bible WhatsApp group, other members and administrators may be able to see information you choose to share in the group. When you follow a WhatsApp or other external link, you leave this website and that service handles information under its own notice.

Legal basis: legitimate interests, in answering you. If you ask about an account or a purchase, contract.

Cookies

• __Host-pastor-session is set only if you sign in. It is one strictly necessary sign-in (session) cookie, marked HttpOnly, Secure and SameSite=Lax, and used only to keep you signed in. It ends when you sign out, when the session ends (7 days without use, or 30 days after you signed in), or when you delete your account.
• Stripe sets its own cookies, on its own payment page, when you pay. They are Stripe's, not this site's.
• YouTube (Google) may store information on your device only if you press play on the video.

Local storage in your browser (never sent to me)

• Study progress and rewards: points, badges, streaks, the date you were last active, quest progress and an activity log (keys beginning goc_).
• Known flashcards and your reading-roadmap plan and progress.
• Your Sermon English and writing-style choice (pf-sermon-language).
• Preaching Mode display settings such as high contrast (trythebible-preaching-prefs), and a rehearsal record for a sermon if you rehearse it (trythebible-rehearsal-v1).
• A list of the Scripture passages saved for offline preaching, for each sermon you prepared (trythebible-offline-snapshot-v1).
• Whether you have read the dictation notice on this device (ttb-dictation-notice).

IndexedDB and offline copies in your browser (never sent to me)

• The database trythebible-pastors-friend holds the sermons, notes, Scripture links and memory items you create without an account.
• When you open Preaching Mode, a small service worker (/sw.js) is installed in your browser. It stores nothing until you choose “Prepare for offline preaching”, which saves the Preaching Mode pages and the Scripture text for that sermon in two caches (pf-shell-v1 and pf-scripture-v1) so that they work without a connection.