Privacy policy

1. WHO HANDLES YOUR DATA, AND HOW TO REACH US

Scriptoria is the controller of the data described here, operating from Brazil under the LGPD (Brazil's General Data Protection Law, Lei 13.709/2018). For any request concerning your data (including requests under Art. 18, listed in section 8), use the contact form and choose the subject "privacy." We respond within 15 days.

2. WHAT WE COLLECT, AND WHY

If you do not create an account

You can read, play and appear on the leaderboard without an account. In that case we keep an anonymous session: a random identifier in your browser, your time zone and what you did on the service. There is no name, there is no email and we do not try to find out who you are. The session counts toward the leaderboard for 72 hours.

If you create an account, what you did without one moves to it when you ask ("Keep my XP") or confirm that it was you. If no one takes the session into an account, it is deleted: as soon as it expires, if it holds nothing; 30 days after it expires, if it holds something. Notes, highlights, favorites and reading are deleted, and the games remain in the leaderboard history, with nothing that identifies anyone.

If you create an account

ACCOUNT

Email and a cryptographic hash of the password. We do not store the password: not even we can read it.

PROFILE

A nickname, if you choose one: it appears in rooms and at the top of the page, and on the leaderboard only if you turn that on; until then, and always until you turn 18, the leaderboard shows a copyist name ("Copyist #4821") generated for you. The color of your seal. And a name, if you wish to give one: only you see it, in the greeting on your dashboard; it is not shown to anyone.

BIRTH YEAR

Only the year, asked once, and used only to check the minimum age of 13; it is not shown to anyone, it is not used in any analysis and it is deleted with the account, as Art. 13 of Brazil's Digital Statute of Children and Adolescents (Lei 15.211/2025) requires. If the answer indicates an age under 13, the account is not created and nothing that was typed is kept; the browser keeps, for 24 hours, only a marker that account creation was refused.

PREFERENCES

Time zone and language, so that "today" and the challenge deadline follow your clock and not our server's.

READING

Which chapters you marked as read and on what day. It is what answers "how many verses have I read this year" and what keeps your streak.

STUDY

Notes, highlights, tags, study boards and pins, with the revision history of the notes, which exists so that a note written offline is not lost to a sync.

GAME

Games, answers, points and duration measured by the server. Time breaks ties on the leaderboard, which is why it is measured here and not on your device.

QUESTION REPORTS

If you report a quiz question, we keep the reason, the note you write (up to 280 characters) and which game or room it came from. Only the team reads it; none of it is shown to other people. If the team accepts the report, you receive a notification. Do not write personal data in the note.

SIGN IN WITH GOOGLE

If you sign in with Google, or link a Google account to yours, we keep the identifier Google gives that account and its email, nothing else: no name, no photo, no contacts. You can see and unlink it in Account access, on your dashboard.

DEVICE

One identifier per device, to sync and to send notifications if you ask for them. Never a contact list, never a location. In Account access you can see the browsers where your account has signed in (the type of browser and when) and you can sign out of any of them: the tabs open in it close immediately.

TECHNICAL

Server error and access logs. The IP address is not stored in the clear: where we need to tell one sender from another (the message limit on the contact form, fraud detection on the leaderboard), we keep only an irreversible cryptographic hash, with a secret key. It serves to count, not to identify.

3. SENSITIVE DATA, TREATED AS SENSITIVE

Which passages of the Bible an identified person reads is religious belief, and Art. 5, II, of the LGPD classifies it as sensitive personal data. We treat it that way:

• Reading progress is part of the service you contracted when you created the account. It is the progress bar, the streak and the year in review. Without it there is no reading product.
• The aggregate analysis of reading behavior is asked for separately, under its own consent, and the product works fully without it. You can refuse and use everything.
• "Who saw it" never appears on a public screen. The home page says "18,402 people saw this verse"; it does not say who, and we do not build a screen that would.
• A public profile exists only if you create one, and by default it is not indexable by search engines.

4. THE LEGAL BASES

PERFORMANCE OF A CONTRACT (ART. 7, V)

Account, preferences, reading progress, study and games. It is the service itself.

CONSENT (ART. 7, I AND ART. 11, I)

Analysis of reading behavior, product news by email, push notifications. Each one asked for separately, each one revocable at any time in the settings, without losing access to anything.

LEGITIMATE INTEREST (ART. 7, IX)

Security, fraud prevention on the leaderboard and limits on abusive messages. It is the minimum necessary, and the IP hash exists only for this.

COMPLIANCE WITH A LEGAL OBLIGATION (ART. 7, II)

Access logs that Brazil's Civil Rights Framework for the Internet (Marco Civil da Internet, Art. 15) requires us to keep for six months; tax records, when there is billing; and the birth year, which checks the minimum age required to protect children.

5. HOW LONG WE KEEP IT

• Reading detail: 13 months. The detail tables are partitioned by month and the old partition is removed entirely, not "marked as deleted." Thirteen and not twelve so that a comparison with the same month of the previous year is possible once.
• Aggregates: permanent. Totals per day, coverage per chapter and verse counts are kept forever, because they are what makes the 2027 year in review possible. They are numbers, not the record of when you opened each page.
• Finished games: permanent. A published leaderboard is a social fact: deleting a game would change other people's positions.
• Notes and boards: as long as you want. Deleting a note leaves only a tombstone with no content, so that syncing does not bring it back on the next device that comes online.
• Contact messages: 24 months, or sooner if you ask.
• Question reports: as long as the account exists. With the account, the report and the note are deleted; all that remains, in the question's history, is how many reports it received and what the team decided.
• Live rooms: the nickname of someone who played without an account becomes "Player N" 30 days after the room ends, and the answers to each round are deleted after 180 days. The result of each seat (position and points) remains, without the name of anyone who played without an account. The question sets a host builds for their rooms belong to that host alone, and are removed with the account.
• A session without an account that no one took into an account: deleted when it expires, if it holds nothing; 30 days later, if it does. The games remain, without a name.
• Closed account: anonymization after a 30-day grace period. The grace period exists because accounts do get closed by mistake.

6. WHO WE SHARE WITH

We do not sell personal data. We do not hand it over for advertising. There is no third-party tracker on this site: no pixel, no third-party analytics, no social media button that loads an outside script. The fonts are served by us, and not by Google, which is a privacy decision as well as a performance one.

Time zone and country. Your browser reports the device's time zone (for example, "Europe/Lisbon"); we use it to write dates and times on your clock and to open the leaderboard to your country. The country comes from the time zone, not from your IP address or from your location. With an account, the country is kept as your home country for the leaderboard, so that a trip does not change your table.

Who is connected right now. For security and support, whoever administers Scriptoria can see who is using the service at this moment: whether it is an account or a visitor, on what type of page, the country (from the device's time zone), the type of device and the IP address the access came from. None of this is stored: it stays in the server's memory and disappears a few minutes after you leave. The address is shown incomplete; viewing the full address is recorded in the administration's audit trail.

Notifications. Account holders receive notifications within Scriptoria itself (the bell at the top of the page and the list under "Notifications" on the dashboard): the week's result, the result of a room they played in, a gifted plan, a new sign-in to the account. They are kept for 180 days and are deleted with the account. Only two go by email: the security alert when the account signs in on a browser it has not used before (for this, the browser keeps its own identifier, and we keep only a digest of it, which does not reveal the value) and the gifted plan, if no one saw it on the page first. No reminders, promotions or summaries by email unless you ask for them; people without an account receive no notifications at all.

Today's reading by email. If you ask for it, under your account's notifications, the verse, the psalm and the chapter of Proverbs of the day arrive by email at 6 a.m. your time, with the full text. We keep the fact that you asked and when, and the date of the last email sent. You can turn it off right there or through the link in each email, without having to sign in, and both the request and the withdrawal are recorded like any other consent.

What we count, on our own: how many times search engines and AI assistants read the public pages, and how many visits arrive from an assistant's answer (ChatGPT, for example). Only numbers per day and per type of page, with no address, no identifier, nothing that says who it was. And six numbers about the home page, also only per day: visits, taps on "Play now" (and on which button), first answers, room codes entered, today's readings opened and devices that played on one day and came back the next. For this last one, your browser keeps the date and the score of the day's game (it is also what lets the home page say "you played today") and sends only the count, never who it was.

We use processors, which process data on our instructions and only for the service:

• Hosting and database, for the service to exist.
• Transactional email delivery, for account confirmation and password recovery, the security alerts and today's reading for those who asked for it.
• Payment gateway, when there is billing. The card goes straight to it and never passes through our database.

If a processor is outside Brazil, the international transfer takes place with the safeguards of Art. 33 of the LGPD. We may also share data under a court order, and in that case we notify you unless the law forbids it.

7. COOKIES AND LOCAL STORAGE

We use a session cookie, needed to keep you signed in and to protect forms against request forgery. Those who use the site without an account also receive a cookie with the anonymous session, which lasts three days and leaves the browser when someone signs in to an account, signs out of it or, in the quiz, taps "Switch player." And a cookie with your device's time zone, which the browser itself reports, to show dates and times on your clock; from it we also take the leaderboard's country, never from your IP address. Whoever joins a live room receives a cookie for that room only, which stores which seat is yours in it and lasts a little over a day. Whoever signs in to an account receives a cookie with a browser identifier, which lasts two years and remains after signing out: it is how we know that a sign-in came from a new browser, so we can alert you by email. It is the same for every account that signs in on that browser, and we keep only a digest of it, which does not reveal the value. There is no advertising cookie and there is no third-party cookie, which is why you do not see a consent banner here: we have nothing to ask for.

Your browser's local storage holds appearance preferences, such as the light or dark theme, the chapters saved for offline reading and, when you write without a connection, the notes that have not been uploaded yet. This does not leave your device until the connection returns, and you can clear it through the browser itself.

8. YOUR RIGHTS

Art. 18 of the LGPD guarantees you the following rights, and we honor them:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of data that is unnecessary or processed out of compliance.
• Portability (export of your notes, highlights, boards and reading history in an open format): on your dashboard, under Download my data, at any time.
• Deletion of the data processed on the basis of consent.
• Information about whom we share your data with.
• Revocation of consent, at any time and without losing access to the service.
• Review of an automated decision (Art. 20), and the next section says which one we make.

9. THE ONLY AUTOMATED DECISION WE MAKE

The system may automatically remove a game from the leaderboard when it detects signs of fraud (for example, many anonymous sessions on the leaderboard from the same device in the same cycle). This does not affect your account, does not delete anything and does not reduce your lifetime XP: it affects only the position in that cycle.

The removal is silent by design, because a detailed notice would teach whoever cheated to try another way. You have the right to ask for a review by a human being, and all you need to do is write to us. We look at the case and respond.

10. SECURITY

Passwords are stored using a slow key derivation function designed for that purpose. Traffic is encrypted in transit. Consent records are immutable: revoking consent writes a new row and never changes the old one, so that "what this person had accepted, on that date" can still be answered. The tables where points are credited are protected against changes by the database itself.

No system is impregnable. If there is an incident involving relevant risk, we notify you and Brazil's National Data Protection Authority (ANPD), as Art. 48 requires.

11. CHILDREN AND TEENAGERS

Accounts are for people aged 13 or older (the birth year, in section 2, is what checks this). Under that age we do not create an account, and a child can read and play without an account, without a name and without an email. Between 13 and 18, the account depends on the knowledge and the agreement of whoever holds parental responsibility. We do not show advertising to anyone, we do not build profiles for advertising and we do not sell anything inside the game.

In a live room with children, players use only a first name or a nickname: we do not ask for an account, an email or anything else, and we do not invite them to create an account or to share the result with their name. Whoever runs the room is an adult with an account, responsible for it.

Parents and guardians have a page of their own. To ask for a child's account to be removed, or to tell us about something that worries you, use the contact page with the subject "Child safety", a subject read before all the others.

12. CHANGES TO THIS POLICY

When we change this policy, the version at the top changes. A change that broadens the processing or alters its purpose is announced on your dashboard, with a summary of what changed, and your agreement is asked for again. We keep a record of which version each person accepted and when.