Privacy policy

Who we are

The website and the app are offered free of charge by the “Împreună Cucerim Înălțimi” Association (Together We Move Mountains), which is the controller of your data (tax ID 55733840, registered office at str. Huniade nr. 5 bis, ap. 31, Lugoj, Timiș County, Romania). For any question about your data, write to us at [email protected].

What data we use

• Without an account: we do not ask for personal data. Your language choice stays on your device.
• Your account: your name, email address, password (stored only in a one-way cryptographic form), language and time zone. If you sign in with Google or Apple, they send us your name, email and an account identifier.
• Session security: the IP address and the browser or device type of each sign-in session.
• Notifications: a phone identifier for notifications, your language, time zone and preferences (which notifications you want and when).
• Mentoring: your prayer requests, the messages you exchange with your mentor and your session bookings with their notes.
• Your progress in reading plans: the days you have read and when you started.
• Your Bible: the verses you highlight or mark as favorites and the notes you write on verses. Notes are encrypted in the database and only you can see them.
• Donations: the amount, date, frequency (one-time or monthly) and Stripe payment reference. If you donate while signed in, the donation is linked to your account. We use the email you give at checkout only to confirm the donation.
• Form 230, if you fill it in on the website: your name, father's initial, CNP (personal numeric code), address, optionally phone and email, the 2-year option and the signature you draw on screen. They are stored encrypted and only the association's administrator sees them, in order to file the request with ANAF.

Data about your faith and personal life

Prayer requests, messages and booking notes can reveal religious beliefs, health information or other intimate matters. These are special categories of data (Article 9 GDPR). We only use them with your explicit consent, which you give by ticking the consent box before sending.

These texts are encrypted in our database. A new request is visible to mentors until one of them takes it on; from then on only that mentor can see it.

Why and on what legal basis

• To provide the services you ask for (account, plans, prayer requests, bookings): performance of the service you request (Article 6(1)(b) GDPR).
• Data about your faith and personal life: your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time by deleting the request or your account.
• Notifications: your consent, given through your phone’s permission and withdrawn at any time in the app or phone settings.
• Protecting accounts and the platform (IP addresses, limits on sign-in attempts): our legitimate interest in preventing unauthorised access (Article 6(1)(f) GDPR).
• Administrative emails (account confirmation, password reset): performance of the service. We send no newsletters and never use your email for advertising.
• Donations and their email confirmation: performance of the donation you make and our legal accounting obligations (Art. 6(1)(b) and (c) GDPR).
• Form 230: your request to redirect your tax through the association and the association's obligation to file the requests with ANAF (Art. 6(1)(b) and (c) GDPR). We only use your CNP because the ANAF form requires it.

Who helps us run the platform

We use a few providers that process data only on our behalf and only as needed:

• Contabo (Germany): the server that hosts the platform and its database.
• Cloudflare: the network that carries traffic to the website, for speed and protection against attacks.
• Expo and Google Firebase Cloud Messaging (Android), and Apple (iPhone): delivering notifications. They receive the phone identifier and the notification text, which for personal messages is generic and never contains your requests or messages.
• Resend: sending administrative emails.
• Stripe: processing card payments for donations. You enter your card details directly with Stripe; they never reach us. If you donate while signed in, we only send Stripe your email address and an internal account identifier.
• Google and Apple, only if you choose to sign in with them.

Stripe as an independent controller

For card payments, Stripe also uses payment data for its own purposes: fraud prevention, anti-money-laundering checks and obligations towards the card networks. For these purposes Stripe is an independent controller and is solely responsible for that processing, under its own privacy policy (stripe.com/privacy). We do not sell your data or share it with anyone for any other purpose.

Transfers outside the European Union

Some of these providers are based in the United States. Transfers only take place under the mechanisms set out in the GDPR: the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

How long we keep data

• Account data, requests, messages, bookings, progress and what you keep in the Bible: for as long as you have an account. Deleting your account erases them permanently.
• You can delete a prayer request at any time; its messages are deleted with it.
• Sign-in sessions expire automatically and are deleted when you sign out.
• The notification identifier is deleted when you turn notifications off or when the notification service can no longer reach your phone (for example after you uninstall the app).
• Backups are encrypted and overwritten within 30 days at most.
• We keep donation records (amount, date and payment reference) for as long as accounting law requires. When you delete your account, your donations are no longer linked to you and any monthly donation stops.
• Form 230: until it is filed with ANAF and then for 3 more years, for possible checks. Requests that were not filed by the deadline are deleted automatically. Deleting your account does not delete the request, because it has to reach ANAF.

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time without affecting what was done before.

From your account you can download all your data (JSON file) and delete your account permanently, without writing to us. For any other request, email us at the address above and we will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in your country.

Cookies

We only use strictly necessary cookies: the one that keeps you signed in and the one that remembers your language. We use no analytics or advertising cookies, so we do not ask for consent for them.

Children

Accounts and mentoring services are for people aged 16 or over. If you are under 16, only use them with your parents’ consent.

Changes

If we change anything important in this policy, we will let you know on the website and in the app before the change applies.