Privacy Notice
Version 2026-10-16 ยท Effective
About these pages
These pages describe Serony and its planned app release. Some app features remain subject to launch checks before they become available.
You can contact Serony now for support, privacy questions, and account deletion requests.
Privacy in brief
Serony offers real Christian testimonies to adults aged 18 and older. Each person receives one testimony at a time.
Your optional trust statement and saved prayer signals remain private. A testimony becomes available to readers only after your submission authorization and human moderation.
We do not sell personal data or use it for advertising. The MVP has no third-party product analytics SDK.
This Privacy Notice covers the app, testimony share pages, public information pages, and support and privacy requests.
Who is responsible for your data
Serony is the operator and data controller. Its public contact address is Eleyele, Ibadan.
That operator is the data controller. It decides the purposes and means of the processing described here.
Privacy contact: [email protected]. Support contact: [email protected].
Serony is independent of any partner church or ministry. A church or community that introduces you to Serony does not receive your private app information.
Account information and service records
We process your email, first name, account identifiers, sign-in and recovery records, adult declaration, and receiving choices.
Our authentication provider processes your credentials to secure your account. The standard signup flow asks for an 18+ declaration, not your birth date.
We keep the records needed to deliver testimonies, prevent repeated delivery, enforce your cadence, and record opened or meaningfully read outcomes.
These records are not a public activity profile. We do not store raw reading traces for engagement analysis.
Some account information is necessary to provide and secure your account. Optional statements, prayer responses, contributions, evidence, and notifications are separate choices.
Your optional private trust statement
You can privately answer: What are you trusting God for in this season? Your answer can contain up to 500 characters.
When you grant both current consents and choose Save and use privately, we store your statement and request its analysis for testimony matching.
We do not send unsaved text for analysis. Choosing to skip this step leaves the General testimony experience available.
The proposed processor is Amazon Web Services, using Amazon Titan Text Embeddings V2 through Amazon Bedrock in Ireland, eu-west-1.
The request contains only your explicitly saved statement text and fixed model parameters. It contains no Serony account or user identifier.
The returned numerical representation is temporary. We derive broad internal themes and do not retain that numerical representation.
Themes remain internal. We do not show them to you, contributors, moderators, churches, or other readers.
Matching uses broad theme overlap with random selection. It does not diagnose your needs, promise an outcome, or claim that God selected a testimony.
Turning off Testimony matching deletes the statement, its retained history, and its derived themes. You can continue to receive General testimonies.
A failed analysis retries only through the approved provider for up to 24 hours. After that period, the pending statement is deleted.
A material provider, model, region, purpose, or retention change stops new analysis until review and any required fresh consent.
Private prayer responses
Choosing I've prayed instructs Serony to save only your private prayer signal. We do not save your prayer words.
Reading or leaving a Guided prayer does not itself save a response. We do not measure Guided-prayer activity.
Contributors, moderators, churches, and other readers cannot see these signals. They do not create public counts.
You can delete your saved prayer responses in Manage privacy. They otherwise expire within six months.
Your testimonies and public images
We store your drafts privately and process the text, attribution, and attachments that you choose to submit.
Submit for review and publication authorizes trained human review and publication if moderators approve that exact submitted version.
Publication can include delivery to eligible readers, account-bound offline copies, permitted share previews, and an unlisted web link.
Anyone who obtains an unlisted link can read the available testimony without an account. The link does not identify its sender or recipient.
The current unlisted web page is text-only. A native share preview can contain the first approved public image.
Anonymous attribution hides your account identity from readers. Authorized reviewers can still associate the submission with your account when necessary.
Details in your words or images can identify you even without your name. We review such risks but cannot guarantee anonymity outside Serony.
A testimony can contain up to three approved public images after its text. Recipients receive processed copies with embedded camera and location metadata removed.
We retain authorization and moderation records to operate the review process. Moderators do not rewrite your words or alter your images or descriptions.
You can withdraw a published testimony or public image. Account deletion unpublishes every associated testimony; there is no leave-published option.
Confidential supporting evidence
Supporting evidence is optional and separate from public images. It can contain sensitive health or document information.
We accept up to three JPEG, PNG, or safe PDF files, each no larger than 10 MB, for restricted review.
Only assigned authorized reviewers can access the safe files. Each file requires independent second review.
We never publish, deliver, share, or use evidence as a verification badge. Evidence is not required for testimony eligibility.
Evidence does not enter AI analysis, ordinary email, free-form notes, diagnostics, or service measurement.
We process and scan uploads in restricted storage. Rejected or unsafe files do not become reader-accessible.
You can remove evidence before review completes. Review can pause, but the absence of evidence does not count against eligibility.
Notifications and information on your device
With your operating-system permission, we use a push token and designated-device record to provide testimony and service notifications.
Notification text is generic. We do not include your trust statement, themes, prayer signal, or testimony body in the notification.
You can disable notifications through your device settings. You can also pause receiving in Serony Settings.
The app can hold encrypted, account-bound copies of prepared testimony text, prayer material, and selected processed images for offline access.
Private local drafts and waiting submissions can remain on your device until you clear them or the app completes the approved sync process.
Image preparation follows your data preference. Missing images do not prevent you from reading complete prepared text.
Server actions need a verified connection. An offline deletion action cannot itself confirm deletion from Serony servers or providers.
Reports support and safety
We process the information needed to assess concerns, manage appeals, answer support requests, verify rights requests, and address security or safety incidents.
Access depends on each staff member's role and assigned task. Contributors do not receive the identity of a person who reports their testimony.
Ordinary support records do not contain trust statements, themes, prayer signals, testimony bodies, or evidence files.
When sensitive material is necessary, we use the restricted case process instead of ordinary email or a general task board.
We disclose only necessary information for a valid legal requirement or a properly assessed serious safety concern.
These exceptions do not allow routine disclosure to churches, recruitment contacts, or other users. Past abuse does not automatically trigger contact with authorities.
Service measurement and diagnostics
We use limited first-party service measurement from records already needed to operate Serony. Its purpose is to assess safe delivery and meaningful reading.
Individual operational detail expires after 90 days. De-identified service aggregates can remain for 24 months.
Measurement excludes private text, themes, prayer responses, Guided-prayer behavior, report details, contributor attribution, recruitment source, and community source.
We do not create an analytics profile, session replay, or cross-app tracking record. These measures do not rank testimonies or increase engagement pressure.
Unlisted share pages record only a private daily open total for each testimony, retained for 90 days.
That total contains no reader, account, delivery, cookie, IP address, device, or user-agent value. It cannot affect matching or ranking.
Sentry receives allow-listed technical error codes and service metadata. Private content and account identity do not belong in these reports.
Website requests and cookies
The policy-page application adds no analytics SDK, advertising tracker, or cookie. Other Serony surfaces use the functions described in this notice.
Hosting, security, email, and request-intake providers can process connection information such as IP addresses, request times, and browser headers.
Cloudflare Pages hosts these public pages. Google Gmail handles email sent to [email protected], including support, privacy, and deletion requests.
These providers can process technical information and correspondence outside Nigeria under their own service terms. Provider retention can differ from the app schedule below.
The anonymous share-page count does not imply that no provider processes technical request information.
Links to another service open that service's own privacy practices. This includes a sharing service that you choose on your device.
Legal grounds for use of information
Reading this notice does not grant blanket consent. Optional sensitive processing uses the separate actions and explanations described above.
The planned app uses the purpose-specific grounds below. Sensitive processing and international transfers require separate review before the relevant features open.
- Core account, requested delivery, authentication, and account support: proposed necessity to provide the service you request under its account terms.
- Trust-statement storage and matching, private prayer saving, submitted content, and evidence review: purpose-specific consent or authorization, with separate sensitive-data review.
- Restricted security, abuse prevention, necessary diagnostic records, and limited service measurement: proposed legitimate interests, subject to a documented balancing assessment.
- Privacy-rights handling and legally required records or disclosures: the applicable identified legal obligation, with no general exemption for all retained data.
- Exceptional serious-safety action or retained evidence: only a confirmed narrow legal ground and the relevant sensitive-data condition.
- Faith-related participation, health information, and information about another person need separate sensitive-data analysis. Religious purpose alone does not establish an exemption.
Providers and processing outside Nigeria
We use providers only for the documented service purposes. Provider access must follow the minimum necessary data and applicable retention boundaries.
The app provider register must confirm legal entities, processing countries, support access, subprocessors, and transfer safeguards before the relevant app features open.
We do not automatically send real trust statements to another embedding provider during an outage.
- Supabase: planned account authentication, database, restricted file storage, and server functions, with Ireland as the planned primary region. Production locations require confirmation before app launch.
- Amazon Web Services: the optional, consented statement analysis described above, only after its separate launch gate passes.
- Expo Push Service, Apple, and Google: delivery of generic device notifications, including required token and technical delivery information.
- Sentry: planned scrubbed technical diagnostics. Its contracted entity, region, access locations, and retention require confirmation before app launch.
- Google Gmail: support, privacy, and deletion correspondence at [email protected]. The app verification and recovery email provider remains subject to launch checks.
- Cloudflare Pages: these public policy pages. Email is the public deletion request route. App upload-processing services remain subject to launch checks.
How long information remains
These periods describe the planned retention schedule. A deletion or withdrawal request can require earlier removal.
The periods are service limits, not claims that Nigerian law requires every listed duration. Professional review and operational verification remain pending.
- Account information and active notification tokens: while needed for the active account; account closure or token invalidation removes them sooner.
- Active trust statement and internal themes: while Testimony matching remains enabled. Replaced or answered statement history: at most six months.
- Private prayer signals: at most six months, or sooner through your privacy controls.
- Detailed delivery, opened, meaningfully read, and individual service-measurement records: 90 days. A content-free deduplication marker remains while the account exists.
- Unlisted share-page daily totals: 90 days. De-identified service aggregates: 24 months.
- Inactive unsubmitted testimony drafts: 90 days. Declined or permanently unpublished content: within 90 days after its final outcome, unless removed sooner.
- Approved public images: while authorized publication continues. Source originals: within 24 hours after safe processing. Rejected source files: immediate removal.
- Supporting evidence: 14 days after publication, or seven days after the appeal window closes or the appeal resolves. The ordinary maximum is 90 days.
- Content-bearing closed moderation, report, or support notes: at most six months after closure. Detailed privacy-request information: at most 90 days.
- Ordinary security records: at most 12 months. Minimized consent, rights, moderation, operational-case, and confirmed-incident records: at most 24 months.
- Content-free deletion evidence for submitted or operationally processed content: at most 24 months. Unsubmitted draft deletion receipts and audits: at most 30 days.
- Inaccessible backup residue: at most 30 days after deletion. Serony-controlled offline testimony copies: no later than 30 days after scheduled delivery.
Deletion and its limits
An accepted account deletion immediately closes the account, ends receiving and optional processing, and unpublishes every associated testimony.
We remove live contributor content within 24 hours. Inaccessible backup residue expires within 30 days.
Connected reader access ends immediately. A temporarily offline device purges its Serony copy on reconnection or through the controlled offline expiry.
Only minimized content-free records or a specifically authorized legal or serious-safety hold can remain under the applicable schedule.
A hold does not delay account closure or unpublication. Routine reports, appeals, disagreement, or review backlog do not justify a content hold.
A safety-only evidence hold requires independent authorization, review at least every 30 days, and deletion within 90 days.
A confirmed legal duty can require a different specific period. Access remains restricted, and we explain a hold unless law or immediate safety prevents disclosure.
After a hold ends, live retained evidence is erased within 24 hours, with inaccessible backup residue removed within 30 days.
If your testimony is published, recipients may share it or capture a copy. Deleting your account will remove it from Serony and stop future delivery, but Serony cannot recall copies already shared, saved, screenshotted, or held on an offline device.
Your choices and rights
Manage privacy provides controls for statement deletion, matching, saved prayer responses, testimony withdrawal, correction, data download, and account deletion.
You can also contact [email protected] when you cannot sign in. We use proportionate verification before disclosing private information or deleting an account.
We normally verify through your signed-in account or control of the registered email. Government identification is not the default requirement.
Our manual-request target is acknowledgment within 48 hours and completion within 14 days. Applicable legal deadlines take precedence.
We explain any necessary verification, lawful limitation, or delay. An accepted connected request continues through automatic processing without repeated submission.
The in-app download excludes internal themes, confidential review reasoning, and another person's data. Statutory access requests receive a separate lawful assessment.
These app export limits do not remove any legal right to access information about you. We explain lawful redactions and provide available complaint routes.
You can raise a privacy complaint with the Nigeria Data Protection Commission. Contacting Serony does not waive that right.
- Ask whether we process your personal data and request information or a copy, subject to applicable law.
- Request correction, deletion, or restriction of processing, and object to processing where the law provides these rights.
- Withdraw consent for optional processing. Withdrawal does not make earlier lawful processing unlawful.
- Request portability or review of relevant automated processing where the legal conditions apply.
Children and account eligibility
Serony is for adults aged 18 and older. It does not offer a parental-consent route for children.
When a credible concern suggests that an account holder is under 18, new delivery and contribution stop while we seek proportionate confirmation.
Associated testimony becomes unavailable during that review. An admitted or unresolved underage account closes through the deletion process.
We do not infer age from writing, images, prayer behavior, or app activity.
Security and changes to this notice
Our planned controls include encrypted connections, access restrictions, individual staff authorization, secure local storage, and privacy-scrubbed diagnostics.
No internet service or device can provide an absolute security guarantee. We assess and respond to security incidents under the applicable notification duties.
Material changes to purposes, providers, regions, or retention receive advance notice and fresh consent where required. We do not silently expand sensitive processing.
Each published notice has a version and effective date.