Privacy Notice

Confession Compass is run by Furne MB, a small partnership (mažoji bendrija) registered in Lithuania, in the European Union, under company code 306426127, with its registered office at P. Vileišio g. 29-67, Vilnius, Lithuania (“we”, “us”). Our team works from our office in the European Union, at Manufakturu g. 20, Vilnius, Lithuania. We decide how and why your data is used, so we are its “controller” under data-protection laws such as the EU's GDPR and Brazil's LGPD.

For anything about your data, write to privacy@confessioncompass.com, or by post to our registered office in Vilnius. This address also reaches our “encarregado”, the person responsible for data protection under Brazil's LGPD, whose name we give on request.

If the Service is ever transferred to another organisation, your data will go with it, and we will tell you in advance.

Confession Compass is built around one simple promise: what you share here stays yours. Your situations, journeys, good deeds and conversations are private to you — no other user of the app can see them.

We do not sell your data, and we never share what you write, or anything drawn from it, for advertising. Beyond the service providers that run the app for us (see “Service providers, locations and transfers”), Google Analytics, which measures how the site and the app are used, Google Ads, which learns from Google Analytics and from our server which of our ads led to a new account, a journey or a purchase, PropellerAds, which learns which of our ads led to a finished quiz or a new account (see “Analytics” for all three), and, if you subscribe, Stripe, which takes your payments (see “Payments”), we share it with no one unless the law requires us to.

Account data: your email address (used for sign-in) and your name, if you give one or your Google account provides it; the date you joined; your interface language; your plan (Free or Premium) and, if you subscribe, the billing details described in “Payments”; and a record of the consents you gave (what you agreed to, which version, and when). Your password is handled by Firebase Authentication; we never see it. If you sign in with Google, Firebase Authentication also keeps the profile-picture link Google provides; we don't use it.

Content you enter: the situations you describe, the journeys and guidance generated from them, the steps you complete, your good deeds, your Companion conversations, your insights and — if you choose to join — your Community nickname, posts and replies, and the reports you file.

What you write may reveal your religious beliefs and other sensitive matters, such as your health, your sex life or things you have done. We process it only with your consent, and only to provide the Service to you, as this notice describes. You don't need to use names or details that identify you or anyone else, and we suggest you don't.

If what you write in a journey or to the Companion suggests you may be in danger, the app shows emergency and crisis lines. For a journey, this is recorded as a mark on the journey, so the lines keep being shown and a crisis journey is always built in full, on every plan. The mark stays with the journey, and administrators who open the journey can see it.

Technical data: your device's time zone, sent with each request so that “today” follows your own day; the most recent one is kept with your account, so our emails can reach you at a reasonable local hour. Our server logs record technical details such as internal identifiers, the part of the app used, timings and error types — never what you wrote, the prompts or the AI's answers — and are kept for 30 days. To protect accounts, Firebase Authentication records the IP address and browser type used to sign up and sign in, and keeps the IP addresses for a few weeks.

In your browser, the app stores what it needs: your sign-in session (kept by Firebase Authentication), a note that someone is signed in on this browser (so the public pages know whether to load sign-in), your interface and journey languages, whether Companion replies are read aloud, your analytics choice, your choice about vibration, and small markers that a one-time moment (a welcome, a seventh day on your road) has already been shown, and the first words you may write for your first journey before you reach the app (on our pages that help you prepare your Confession, before you have an account, or while you verify your email address): they stay in that tab only, are never sent until you have signed up and sent your journey, and are kept until the form reads them or you close the tab. The questions you mark in our guided examination of conscience stay in that tab too, until you close it; they go nowhere unless you take them into your first journey and send it. These are needed for the Service or remember choices you made. When analytics is on (see “Analytics”), Google Analytics also sets its cookies: _ga and _ga_ followed by an ID, which recognise this browser from one visit to the next, and, if you arrive from one of our ads, cookies beginning _gcl_, which remember the ad. They last up to 13 months (the ad ones 90 days), and are deleted when you turn analytics off. While analytics is on, this browser also keeps, for it, the first page of our site it opened, the page and button you signed up from and which part of the app your last Premium checkout started from, deleted in the same way; on an administrator's browser, a note that it is never measured. There are no advertising cookies beyond these, and nothing that follows you to other sites. Signing in with Google opens Google's own sign-in window, which runs under Google's terms.

To create and run your account, send you sign-in and security emails, give you the plan you have — taking your payments through Stripe if you subscribe — and answer your messages: because this is necessary to provide the Service you signed up for (GDPR Art. 6(1)(b); LGPD Art. 7, V).

To prepare your guidance, the Companion's replies, read-aloud, Catechism readings and insights, to show help lines when you may be in danger and, if you join, to show your Community posts to its members: with your consent, because what you write may reveal sensitive matters (GDPR Art. 9(2)(a); LGPD Art. 11, I). You give it when you create your account or sign in, by continuing after the notice on the sign-in page, and you can withdraw it at any time (see “Your rights”). The Service can't work without it, so withdrawing it ends your use of the Service, and we delete your account.

To keep the Service safe and working: fixing problems (including the administrators' logged access described in “Who can see what you share”), preventing abuse and enforcing daily limits, moderating the Community, and keeping our audit log and the records of your consent and of deletions. We do this because we have a legitimate interest in running a safe, reliable service and in being able to show that we handle data correctly (GDPR Art. 6(1)(f); LGPD Art. 7, IX); where it involves sensitive content, your consent covers it. You can object to it (see “Your rights”).

To measure how the site and the app are used and which of our ads work, including what Google Ads learns from Google Analytics and from our server, and what we tell PropellerAds (see “Analytics”): with your consent where we ask for it — on the site in the European Economic Area, the United Kingdom, Switzerland and Brazil, and in the app for everyone, given by creating your account or signing in after the notice on the sign-in page — which you can withdraw at any time by turning analytics off (GDPR Art. 6(1)(a) and, where your use of the app reveals your beliefs, Art. 9(2)(a); LGPD Art. 7, I, and Art. 11, I). On the site elsewhere, because we have a legitimate interest in understanding and improving the Service and our advertising (GDPR Art. 6(1)(f)); you can object by turning analytics off. Our own daily totals of visits to the public site (see “Analytics”), which identify no one, rest on our legitimate interest in measuring its audience, everywhere (GDPR Art. 6(1)(f); LGPD Art. 7, IX); you can object by saying no in the banner or turning analytics off.

To comply with the law, and to establish, exercise or defend legal claims (GDPR Art. 6(1)(c) and (f) and Art. 9(2)(f); LGPD Art. 7, II and VI, and Art. 11, II, a and d).

You need an email address to have an account; everything else is up to you. Your name is optional, and what you share, and how much, is always your choice.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. The AI's guidance, the automatic danger check and the Premium insights (which look for recurring patterns across your journeys) are there to help you, and decide nothing about your account. An automatic filter also stops Community posts, replies and nicknames that contain contact details, links or certain harmful phrases, and tells you why so you can reword them.

Your journeys, good deeds and conversations are protected by access controls on our server: no other user of the app can read or change them.

No administrator can read what you write. Your situation, your Companion conversations and your good deeds are encrypted, and our admin tools show them only as “encrypted — not viewable”. A small number of authorised administrators operate the Service — they grant Premium, moderate the Community, and carry out account deletions — and each of these actions is logged. Everyone with this access is bound by confidentiality. (If we ever needed to let an administrator read content to resolve a problem, we would first change this notice and tell you.)

Community posts are different by design: they are visible to Community members, but only under the nickname you choose, and never with your email, your name or your private journeys. If you leave the Community, your Community profile is deleted, but your posts and replies stay, under the nickname they were written with. You can delete your own posts at any time, even after leaving; your replies stay until a moderator removes them, you ask us to remove them at privacy@confessioncompass.com, or your account is deleted.

When you report a post or reply, our moderators see the reason you chose and a short excerpt of what you reported — never who filed the report.

To prepare your guidance, the situation you describe is sent over an encrypted connection to Google's Gemini models on Google Cloud Vertex AI, together with instructions that shape a reverent answer, faithful to Church teaching. The same models write the Companion's replies, the Catechism reading summaries and, with Premium, insights across your journeys.

What you write here is private, confidential and encrypted, so that no one at Compass can read it. The only company that processes it is Google Cloud, acting as our data processor under a written contract (Google Cloud's Data Processing Addendum): your words are decrypted for a moment and sent to it, over an encrypted connection, only to prepare your guidance. That contract allows Google to use them solely to provide its services to us — including keeping them secure and free of abuse — and requires Google to keep them confidential and protected. (If you use the Companion's microphone, your browser's own speech service is also involved; see below.)

Google processes it to produce your answers and, under Google Cloud's terms, does not use it to train its models; we will never give Google permission to do so, and we do not train any AI models ourselves. Your journeys and conversations are never sold, never used for advertising profiles, and never shared with anyone else unless the law requires it.

Google's Gemini service can keep requests and answers in memory for up to 24 hours to answer faster. We have turned this cache off for Confession Compass, so what you write is not kept in it.

Google also runs automated safety checks on requests to its AI models. If these checks flag a request as a possible breach of Google's AI usage policies, Google may keep the text of that request — what you wrote, together with our instructions — for up to 90 days, in the United States, solely so that authorised Google staff can check whether a breach occurred. Google does not use it to train models. Because people bring difficult matters here, a request can occasionally be flagged even when nothing is wrong.

When you use read-aloud, the text being read — the prayer, a step, a part of your guidance or a Companion reply, never your own words — is sent to Google Cloud Text-to-Speech, which does not keep it. Text-to-Speech is a global Google service, so this text may be processed in any of Google's data centres. The audio is cached in Google Cloud Storage for about 30 days, so it doesn't have to be made again, and is then deleted automatically.

To check Scripture passages, our server looks up only the reference (for example “Luke 15:11-32”) on third-party Bible sites: bible-api.com and thedouayrheims.com. Your words are never sent to them, and no web search is ever made from what you write.

The Companion's microphone uses your browser's own speech recognition, which may send the audio to the browser's maker to turn it into text (Chrome, for example, sends it to Google). This happens under the browser maker's terms, not ours; if you prefer, type your message instead.

AI-generated guidance may contain errors. It is educational support, never a substitute for the Sacrament of Reconciliation, your priest, or professional help.

The app runs on Google services, which process your data on our behalf and only on our instructions: Google Cloud (Compute Engine for our servers, Cloud SQL for the database, Vertex AI, Text-to-Speech and Cloud Storage) and Firebase Authentication for sign-in and its emails, under Google Cloud's Data Processing Addendum and Firebase's data processing terms. Emails you send to our addresses are received on our own mail server, which runs on Google Cloud in the United States; our replies, and the account emails we send you (the onboarding and Premium emails of “Emails about your journey and Premium”, and a reminder before a discounted first month ends), leave it through Resend (Resend, Inc., in the United States), which delivers them on our behalf under its Data Processing Addendum. Payments are handled by Stripe (see “Payments”); Google Analytics measures how the site and the app are used; Google Ads, which runs some of our ads, learns from Google Analytics and from our server which of them led to a new account, a journey or a purchase; and PropellerAds, which runs others, is told when a visit from one of them finishes a quiz or creates an account (see “Analytics”).

Our servers, our database, the AI processing and the stored audio are in Google Cloud's us-central1 region, in Iowa, United States, and Firebase Authentication runs only in Google's US data centres. Our team, including the administrators, works in Vilnius, Lithuania. So if you use the app from outside the United States, your data is transferred to the United States and processed there.

These transfers are protected as follows. We are established in the European Union, so the GDPR's transfer rules apply to all the data we send to the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, which the European Commission, the UK and Switzerland recognise as providing adequate protection; if that framework ever stops applying, Google Cloud's terms fall back on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. Resend is certified under the same framework and its UK extension, and its Data Processing Addendum includes the European Commission's Standard Contractual Clauses. For data from Brazil, Google Cloud's terms include the standard contractual clauses approved by the ANPD, and you also consent to the transfer — and to our team in Lithuania accessing your data — when you start using the app. Where the law of another country requires your consent to a transfer, you give it at the same step. You can ask us for a copy of these safeguards at privacy@confessioncompass.com.

We use Google Analytics to learn how people find Confession Compass and how they use it, so that we can improve it and see which of our pages and ads help. It records the pages you open; how you arrived (the site, search or ad you came from); your type of device and browser; your approximate location (country and city, which Google works out from your IP address without keeping it); and a few actions: following a call to sign up, how far you go in our reflection quizzes, the result each one ends with and which version of the page you saw, whether a prayer on our prayer page was shown and prayed (never which one), on our pages that help you prepare your Confession, ask whether something is a mortal sin or make a guided examination of conscience, which page and which version of it you saw, starting to write, the number of the card or question you reached, going on to sign up and whether you began from one of our suggested sentences (never what you write there, your answers or what you mark), signing up or in (and its steps: choosing Google or email, whether Google’s window finished, was closed or was blocked, and how long the sign-in page was open), starting a journey (and its language), completing a step (its kind), closing a journey, sending a Companion message, using read-aloud, adding a good deed, posting in the Community (its category), how far down a journey’s page you read (halfway, to the end), opening or closing the Premium page (which part of the app opened it, and whether a welcome price was shown), adding a calendar reminder, and starting or completing a Premium purchase (the plan, its price, any welcome price applied, and which part of the app it started from). To see which pages lead to a purchase, these actions also carry the first page of our site this browser opened and the page and button you signed up from.

Google Analytics never receives what you write: not your situations, journeys, conversations, good deeds or posts, nor your quiz answers. Nor does it receive your name, your email address or your account's identifier, and every identifier is removed from the addresses of the pages it records; a purchase carries only a code that lets us count it once. We have turned Google signals and ad personalisation off, so this data is not used to build advertising profiles or to show you ads. Administrators' use of the app is never measured.

On the public site, if your device is set to a time zone of the European Economic Area, the United Kingdom, Switzerland or Brazil, Google Analytics runs only once you allow it in the banner; elsewhere it runs from your first visit, and you can turn it off with “Analytics settings” at the foot of every page. A Global Privacy Control signal from your browser counts as turning it off. When you create your account or sign in, you agree to analytics in the app too, by continuing after the notice on the sign-in page, and the app asks nothing more; if you had said no on this browser before, that no stands. You can turn analytics off at any time in your profile or with “Analytics settings”. Your choice is kept in this browser, so on another device you choose again. The same choice covers what Google Ads learns from Google Analytics and what we tell PropellerAds (below).

Google Analytics is provided by Google Ireland Limited and Google LLC, which process this data for us, as our processor, under Google's data processing terms. To show us which of our ads lead to a sign-up or a purchase, Google also uses it to measure our ads, as an independent controller under its own privacy policy (policies.google.com/privacy). The data is processed in the United States: Google LLC is certified under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, and Google's terms include the European Commission's Standard Contractual Clauses. Google Analytics keeps it for 14 months, then deletes it. It holds no name, email or account identifier, so we cannot single out your data in it; turning analytics off stops any more being collected.

Some of our ads run on Google Ads, Google’s advertising service (provided by Google Ireland Limited and Google LLC). When you arrive from one of them, the page’s address carries a code Google gave that click on the ad, and Google Analytics records it with your visit. If you then create your account, start a journey or buy Premium, Google Analytics shows Google Ads which ad click led to it (for a purchase, also its price), so that we and Google can see which of our ads, and which searches, help people find us, and show our ads where they do. Because Google Analytics often can’t send from phones, our server tells Google Ads too: if you create your account after arriving from one of these ads, it keeps that click’s code with your account for at most 90 days, and sends Google Ads the code alone with the time you signed up and, if you buy Premium in that time, each purchase’s amount and currency. The code is deleted after 90 days, or with your account if that comes first, and is included in a copy of your data. Beyond this and what Google Analytics records (above), Google Ads receives nothing: never what you write, your quiz answers, your name, your email address or your account’s identifier. We use no Google Ads tag of our own, and we never send Google your email address, not even scrambled (hashed). Ad personalisation stays off, so none of this is used to build an advertising profile of you or to show you ads. Google uses it as an independent controller, under its own privacy policy (policies.google.com/privacy), in the United States with the safeguards described above. It follows the same choice as Google Analytics: where we ask first, only after your yes; elsewhere, unless you turn analytics off or your browser sends Global Privacy Control; when you sign up, by your agreement on the sign-in page. If analytics is off when you start a purchase, our server reports nothing and deletes the code.

Some of our ads run on PropellerAds (Propeller Ads Ltd, Limassol, Cyprus). When you arrive from one of them, the page’s address carries a code PropellerAds gave that click on the ad. If you then finish one of our quizzes, pray a prayer on our prayer page or create your account, our server sends PropellerAds that code and which of these happened, so that it can show our ads where they help people find us. That is all it receives from us: never your answers, your result, anything you write, your name, your email address or your account’s identifier, and we don’t keep the code. PropellerAds receives it as an independent controller, under its own privacy policy (propellerads.com/privacy). It follows the same choice as Google Analytics: where we ask first, only after your yes; elsewhere, unless you turn analytics off or your browser sends Global Privacy Control; when you sign up, by your agreement on the sign-in page. We report only visits from Brazil and Mexico, where these ads run, as your device’s time zone shows.

In the app, we also keep our own record of the steps you take, so that we can see where new accounts get stuck and put it right. It holds: opening the app, and coming back after a pause; which screen you see, in which language, and your device's language; seeing the journey form, starting to type in it, tapping one of its suggested first sentences (which one), sending it, or an error it showed; your journey being created, and how long its guidance took or that it failed; opening a journey and which of its parts you scrolled to; leaving while the guidance was being prepared, and after how long; being shown Premium (and from which part of the app); and starting or completing a Premium purchase. Once, when you sign up, it also notes where your account came from: the page of our site you first opened, the page and button you signed up from, the quiz and its result, and, if your visit came from one of our ads, the ad network and the numeric codes of the campaign, the placement or ad group, and the ad. It never holds what you write, how much you wrote or your quiz answers, and we don't share it with anyone. It is kept with your account in our database for 180 days, then deleted; it is deleted with your account, and included in a copy of your data. It follows your analytics choice in the app: turning analytics off in your profile or with “Analytics settings” stops it on that browser, including the steps our server notes as it serves you. Administrators' use of the app is never recorded.

On our public site and the sign-up page, our own server also counts how many visits reach each step: opening a page, staying on it for 15 seconds, scrolling past half of it, tapping a call to sign up, opening the sign-up page, and sending its form or choosing Google. It keeps only each day's totals, by page and language and, for a visit from one of our ads, the ad network and the numeric codes of the campaign, the ad group and the ad. Nothing in them identifies you or your browser: no cookie and no identifier is stored on your device, and we keep neither your IP address, your browser, the time of your visit nor the ad's click code, so a total can never be tied to a person or an account. Because these totals identify no one and serve only to measure our site's audience, they are counted without asking first, in every region, including where Google Analytics waits for your yes; they are used for nothing else, combined with no other data and given to no one. They are not counted if you said no in the banner or turned analytics off, or if your browser sends Global Privacy Control.

When you create an account, we enrol you in a short series of emails that help you get the most from Compass and explain Premium — about your progress and the welcome price, drawn from your account details and never from what you write. Our basis is this notice, together with your right to stop them at any time. Billing and security emails — for example a receipt, or a reminder before a discounted first month ends — are separate and always sent.

Because you receive these as someone using Compass, being on this list can suggest a religious interest; we keep the emails free of anything you wrote, and discreet in their subject and preview. You can stop them at any time — with the “Emails about your journey and Premium” switch in your profile, or with one tap in any email — and we keep a record of your choice. They are delivered for us by Resend (see “Service providers, locations and transfers”).

If you subscribe to Premium, your payments are handled by Stripe: Stripe, Inc. and, in the European Economic Area, Stripe Payments Europe, Limited. You enter your payment details on Stripe's secure pages, which run under Stripe's own terms and privacy policy, cookies included; we never see your card number.

We give Stripe your email address and an internal identifier of your account. On its pages you give Stripe your name, your country (and, where needed, your postal code) and your payment method. From Stripe we keep only what we need to run your subscription: its Stripe identifiers, your plan and period, its status, and when it renews or ends. Stripe never receives what you write in the app.

Stripe processes this data to take your payments for us and, as an independent controller, for its own purposes, such as preventing fraud and meeting its legal duties. Its privacy policy (stripe.com/privacy) explains how, including where it transfers data and with what safeguards. If you pay with Pix from Brazil, the Pix payment is processed by EBANX, Stripe's partner for Pix, which appears on your bank statement and sends you its receipt, under its own privacy notice (ebanx.com).

When your account is deleted, we cancel any subscription and delete your customer record at Stripe. Stripe keeps its records of your payments, which are also our accounting records, for as long as the law requires, for example under tax and anti-money-laundering rules.

We keep your account and content until you ask us to delete them. If you don't sign in for 24 months, we will email you, and delete your account with everything in it 30 days later unless you sign in again. An account whose owner never gave the consent needed to use the app is deleted after 30 days.

In the app, you can delete your good deeds and your own Community posts at any time. Everything else — your journeys and Companion conversations included — is deleted together with your account.

To delete your account, use “Withdraw my consent and delete my account” in your profile, or write to privacy@confessioncompass.com from the email address of your account. An administrator deletes it within 30 days, with everything in it: your sign-in, journeys, conversations, good deeds, insights, Community profile, posts and replies, the reports you filed, our record of your steps in the app, and the audio made for you. Any Premium subscription is cancelled, and your customer record at Stripe deleted (see “Payments”).

We keep the administrators' log entries about your account, including the record of its deletion, and the record of the consents you gave. They hold only internal identifiers, dates, versions and the language shown, never your email or anything you wrote.

Our database backups age out within 7 days, so deleted data is gone from them within 7 days as well. Google then removes deleted data from its own internal systems within the time its terms allow, at most 180 days; this includes Firebase Authentication's backups of your sign-in.

Read-aloud audio is deleted with your account, and in any case about 30 days after it was made.

Other time limits: a request flagged by Google's safety checks is kept for up to 90 days (see “How AI processing works”); our server logs are kept for 30 days; our own record of your steps in the app, for 180 days (see “Analytics”); the code of a Google Ads click that led to your account, for 90 days (see “Analytics”); Firebase Authentication keeps sign-in IP addresses for a few weeks; Google Analytics keeps its data for 14 months (see “Analytics”). A report you file is deleted with your account. A report about something you wrote, with a short excerpt of it, is kept for our moderators until your account is deleted.

All traffic to and from the app is encrypted (TLS), and Google encrypts our database and the stored audio at rest. On top of that, what you write — your situation, your Companion messages and your good deeds — is encrypted by the app itself with a key held outside the database, so a copy of the database alone cannot be read. Access to records is enforced on our server, not only in the app; our database cannot be reached from the internet; and no administrator can read what you write. No system is perfectly secure, but we protect your data with care.

This is not end-to-end encryption: to prepare your guidance, our server decrypts what you write in memory for a moment and sends it to Google's AI over an encrypted connection, then keeps it only in encrypted form. No person at Compass reads it along the way — our admin tools cannot show it (see “Who can see what you share”) — and our logs never contain your words, the prompts or the AI's answers.

If a security breach puts your data at risk, we will tell you and the relevant data-protection authorities as quickly as the law requires.

We never see or store your card or other payment details: you enter them on Stripe's page, and Stripe holds them.

You have the right to see your data and get a copy of it — also in a portable, machine-readable format — to have it corrected or deleted, to restrict how we use it, and to object to processing based on our legitimate interests. In the app you can see your data and change your name and interface language in your profile. On the Free plan, a journey you can't open in the app is still included when you ask for a copy of your data. For any request, write to privacy@confessioncompass.com from the email address of your account, so we know it is yours. It is free, and we answer within one month (15 days for requests under Brazilian law); if a request is complex, we may need up to two more months and will tell you why.

You can withdraw your consent at any time, as easily as you gave it: use “Withdraw my consent and delete my account” in your profile, or write to privacy@confessioncompass.com. From then on we stop using your journeys and conversations, and we delete your account within 30 days. Withdrawing doesn't affect what was done before.

If you think we have not handled your data properly, please tell us first at privacy@confessioncompass.com. You also have the right to complain to a data-protection authority. Because we are established in Lithuania, our supervisory authority is Lithuania's State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). You can also complain in the country where you live or work — for example to the AEPD in Spain, the CNPD in Portugal or the CNIL in France — and, outside the EU, to the ANPD in Brazil (gov.br/anpd) or the ICO in the UK (ico.org.uk).

If you are in Brazil, we process your data under the LGPD (Lei 13.709/2018). Your sensitive data is processed with your specific, highlighted consent (Art. 11, I), and its transfer abroad with your consent and the ANPD-approved standard clauses. Besides the rights above, you can ask us to confirm whether we process your data; to de-identify, block or delete data that is unnecessary or excessive; for information about the entities we share it with; and about what happens if you don't consent. You can reach our encarregado at privacy@confessioncompass.com; we give the encarregado's name on request. You can also petition the ANPD.

If you are in the United States, we do not sell your personal information or share it for cross-context behavioural advertising: Google Analytics and our ad measurement, through Google Ads and PropellerAds, only count how the site and the app are used and which of our ads work (and no visit from the United States is reported to PropellerAds), with ad personalisation off (see “Analytics”). We do not use your information to train large language models, and we use sensitive information (such as your religious beliefs or health) only with your consent: to provide the Service you ask for and, in the app, to measure how it is used, never what you write. You can turn analytics off at any time, and a Global Privacy Control signal counts as doing so. Wherever you live, you can ask to know, correct, delete or get a copy of your data at privacy@confessioncompass.com. We answer within 45 days; if we decline a request, you can appeal by replying to our answer, and we will answer your appeal within 45 days.

Consumer health data. What you write may include health information, such as your mental or physical health, and the app may infer that you are in danger (see “What we collect”). We collect it only from you, and only to provide the Service you ask for: your guidance, Companion replies, read-aloud and insights, and the help lines. We share it only with Google Cloud, our processor, under contract, and we never sell it. You can see, get a copy of or delete it, or withdraw your consent, as described in “Your rights”, and ask us for a list of any third parties and affiliates with which we have shared it (there are none). Our analytics never receives it (see “Analytics”).

Confession Compass is only for adults: you must be 18 or older to use it, and you confirm your age before you start. It is not directed to children, and we do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we delete it. If you believe a child has given us data, write to privacy@confessioncompass.com.

If we make material changes to this notice, we will tell you by email before they take effect, and the date at the top of this page will change. If a change affects how we use the sensitive data you consented to, we will ask for your consent again before it applies.

Questions about privacy can be sent to privacy@confessioncompass.com.