Privacy Policy
This policy covers the BibleQuize website (biblequize.com) and the Sanluma app for iOS and Android. We collect as little as we can, there is no advertising and we do not sell personal data. You can download your data and delete your account inside the app.
Effective date: 2 November 2026.
In short
- The website biblequize.com has no accounts. We count visits with Google Analytics and PostHog only if you allow it (in Europe they are off until you accept). Your reading-plan and quiz progress on the website stays in your browser.
- The Sanluma app (iOS and Android, and its web version at app.7scrolls.com) saves your learning progress on our server so it is not lost and can follow you to a new device. If you sign in, we keep your email address to sign you in.
- No advertising, no tracking across other companies’ apps or websites, no selling of personal data. The mobile apps contain no third-party analytics, advertising or crash-reporting tools.
- You can download your data and delete your account inside the app at any time, or ask us to delete it by email (see how to delete your account).
1. Who is responsible (controller)
The controller for the website biblequize.com and the Sanluma app is:
Dzmitry Pliachko (sole proprietor, NIP 8992909337)
ul. Stanisława Drabika 63/19, 52-131 Wrocław, Poland
Email: hello@biblequize.com
“BibleQuize” and “Sanluma” are the names of the website and the app; they are not separate companies. We have not appointed a data protection officer because we are not required to.
2. What this policy covers
| Service | What it is |
|---|---|
| Website | biblequize.com: articles, quizzes, reading plans, app waitlist |
| Sanluma app | The mobile app for iOS (App Store) and Android (Google Play), and the same app in a browser at app.7scrolls.com |
Where a section applies to only one of them, it says so.
3. The Sanluma app: what we collect and why
You can use the app without giving us your name or email. When you first open it, the app creates a random device code and a guest account on our server, so your progress is saved from the first lesson.
| Data | When | Why (and legal basis under GDPR) | How long |
|---|---|---|---|
| Account identifiers: a random user ID, a random device code generated by the app (not an advertising ID from Apple or Google), the date the account was created | Always, from first launch | To save your progress and keep you signed in. Contract (Art. 6(1)(b)): it is needed to provide the app. | Until you delete your account. Guest accounts that are not used for 12 months are deleted automatically, together with their progress. |
| Email address | Only if you sign in to save progress across devices | To send you a one-time sign-in code and link, and to recognise your account. Contract. | Until you delete your account. Sign-in links and codes expire after 15 minutes, and the record of each sign-in request (including the email it was sent to) is deleted after 24 hours. |
| Confirmation of your age (a yes/no tick that you are 16 or older, or that you are a parent signing in for your family; not your birth date) | When you sign in | To meet our age rule (section 7). Legitimate interests. | Until you delete your account |
| Learning progress: lessons finished, answers you chose, whether they were right, time taken, hints used, review schedule, memorised verses, streaks, points (XP, talents and similar) | While you use the app | To run lessons, spaced review and streaks, and to restore your progress on another device. Contract. | Until you delete your account |
| App settings: Bible translation, why you learn (for example “for my kids”), level, daily goal, rest day, reminder time, time zone, accessibility choices, whether you want to compete | When you choose them | To tailor lessons and reminders. Contract. | Until you change it or delete your account |
| Your Christian tradition (for example Protestant, Catholic, Orthodox or “none”) | If you choose one | To adjust wording and lessons to your tradition. Because it can reveal religious beliefs, it is stored only on your device and is never sent to our server. It does not follow you to a new device. Because our server does not know your tradition, server-side features such as rest days and quiet reminder days use one shared calendar for everyone. | On your device until you change it, delete the app or delete your account |
| Arena and leagues: your player nickname and avatar (a preset character, never a photo), match results, rating, recorded rounds, the name you enter for friend challenges, and automatic fair-play flags (for example answers that are impossibly fast) | When you play Arena games or leagues | To match players, show results and leaderboards, and prevent cheating. Contract; fair-play checks: legitimate interests (Art. 6(1)(f)). | Until you delete your account |
| Groups: the group name, your group nickname, your role, which lessons of the current unit you have finished, and group game scores | Only if you create or join a group | To run study groups with friends. Contract. | Until you leave the group or delete your account. If the group owner deletes their account, the group is deleted. |
| Reports you send: “Report a mistake” (category, the question or lesson, your note and source) and reports about a player or a group (your user ID, the reported player’s user ID and group, the reason you picked: offensive name, spam or other, where you saw it, and a copy of the name you saw); the players and groups you chose to hide | When you send a report or hide someone | To fix content and keep the community safe. Legitimate interests. | Mistake reports: up to 2 years. Player reports: up to 12 months after the case is closed, longer only if needed for a legal claim. Hidden players and groups: until you delete your account. If a reported name breaks our rules, we replace it with a generated one; repeated breaches can lead to a ban, after which only generated names can be used. When you delete your account, your mistake reports and the players you hid are deleted; reports you made about other players are kept only without your user ID, so we can still act on them. |
| Usage statistics inside the app: which screens and features are used (for example “lesson finished”). They are recorded on our own server linked to your account (user ID). No third-party analytics, no advertising, no tracking. Text that looks like an email, phone number or name is stripped. | On by default; you can switch it off at any time in Settings → Usage analytics | To understand which lessons help and what to improve. Legitimate interests (Art. 6(1)(f)): our interest is improving a free learning app; the data stays with us and is not used for advertising. You can object at any time with the switch, and new statistics stop immediately. | 13 months, then deleted automatically; earlier if you delete your account. |
| Reminders | Only if you turn them on | In the iOS and Android apps, reminders are local notifications scheduled on your device; no push token is sent to us, and the app asks your phone’s permission for notifications. In the web version, if you allow browser notifications, we store the browser’s push subscription. If you choose email reminders, we send them to your email at your reminder time; every email has an unsubscribe link. Consent: turn off any time. | Until you turn them off. Delivery logs: 13 months, like usage statistics. |
| Sessions: a record of each device you are signed in on | While you are signed in | To keep you signed in securely. Contract. | Deleted after 90 days without use, when you sign out, or when you delete your account. |
| Security data: your IP address and device code are used to limit abuse (for example too many sign-in emails). | Each request to our server | To protect accounts and the service. Legitimate interests. | We never store your IP address itself: only a salted one-way hash, deleted after 24 hours. Our host keeps standard logs for a short period (see section 6). |
What the mobile apps do not do: they do not ask for or access your camera, microphone, photos, contacts or location; they do not use an advertising identifier (Apple’s or Google’s); they contain no advertising, no Google Analytics, no PostHog, and no crash-reporting service. Lesson voices are pre-recorded audio files included in the app (see section 8), so nothing you do is sent to a voice service.
Device backups: your phone’s own backup (for example iCloud on iOS, or Google’s backup to your Google Account on Android, if you have it turned on) may copy the app’s local data from your device, such as sign-in tokens, settings and your tradition. This is controlled by your device settings and the backup provider, not by us, and it is not sent to our server. To keep it off, switch off app backup in your phone’s settings.
Purchases: the mobile apps have no in-app purchases. There are currently no paid plans.
App store review demo account: for review by the app stores we run a demo account with a fixed sign-in code. It contains no real person’s data.
4. What other players can see
The app has a social layer that opens only when enough people are playing, and only if you choose to take part. Other players can see:
- in Arena duels, daily leaderboards and leagues: your nickname, avatar, rank, score and weekly points. A recorded round of yours (your answers’ correctness and timing) may be replayed as an opponent for another player;
- in a friend challenge: the name you typed, shown to whoever has the link;
- in a group: your group nickname, whether you are the leader, which lessons of the current unit you have finished, and your group game scores.
Your email address is never shown to other players. Your default nickname is generated by the app; please do not use your real name. You can hide leagues in the app, leave any group, and report or hide any player or group. Once hidden, you see “Player” instead of their nickname. The community rules explain what names are allowed and how reports are handled.
5. Kids mode
Sanluma has a kids mode for parents who learn with their children. It is a setting on the parent’s device or account, not a child’s account:
- there are no accounts for children; to save progress across devices, a parent signs in with their own email;
- kids mode turns off leagues, ranked duels, public leaderboards and groups, and turns off timers and typing;
- family duels are shared by link and protected by a parent check;
- we do not ask for any information about the child. The app does record that kids mode is on, and the lesson progress made in kids mode is saved to the parent’s guest or signed-in account like any other progress.
6. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting of the website and the app server, database (Cloudflare D1), security, app waitlist storage, standard request logs | Global network; the database is not restricted to the EU and may be located outside it |
| Resend | Sending sign-in codes and email reminders (sender address hello@send.biblequize.com) | United States |
| Google (Google Analytics), website and web app only, after consent | Visit statistics | May process data in the United States |
| PostHog, website and web app only, after consent | Product analytics, no session recordings | EU (Frankfurt) |
| Push services of your browser (Apple, Google, Mozilla, Microsoft), web app only | Delivering browser notifications you turned on | Varies |
| Our email provider | Messages you send us | Varies |
Apple (App Store) and Google (Google Play) process data under their own privacy policies when you download the app. We receive from them only aggregated download statistics, and crash or performance reports only if you chose to share them with app developers in your phone’s settings.
Where data is transferred outside the European Economic Area, these providers rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. We do not sell or share personal data for advertising.
7. Age
- 16 and older: you can sign in with your own email and use the app on your own.
- Under 16: you can use the app without an account (as a guest, on your device and with the progress saved under a random guest code, without your name or email), or a parent or guardian signs in with their own email and uses the app together with you. Children under 16 must not sign in with their own email.
- Kids mode (section 5) stays available for families.
When signing in, you confirm that you are 16 or older, or that you are a parent or guardian signing in for your family. If you believe a child under 16 has signed in with their own email or otherwise given us personal data, email us and we will delete it.
The website is suitable for families but is not designed to collect information from children.
8. AI-generated voices
The voices of the characters in Sanluma are AI-generated. They were produced in advance by us (using ElevenLabs, Kokoro and Chatterbox) and are included in the app as audio files. When you use the app, nothing is sent to these services. If an audio file is missing, the app may use your device’s built-in voice, which runs on your device.
9. The website biblequize.com
| What | Why | How long |
|---|---|---|
Analytics (Google Analytics 4): pages viewed, approximate location (country/city), device and browser type, how you arrived. Cookies _ga and _ga_<ID>. | To understand, in aggregate, which pages help people. Legal basis: your consent in the EEA, the UK and Switzerland; legitimate interests elsewhere, with the option to opt out. | Data up to 14 months; cookies up to 2 years. |
Analytics (PostHog, EU cloud in Frankfurt): pages viewed and clicks on buttons and links (without their text), page addresses without query strings, approximate location, device and browser type, how you arrived. No session recordings, no profiles. Cookie ph_<ID>_posthog. | Same as above, same consent choice. | Event data up to 12 months; cookie up to 1 year. |
| Server and security logs kept by Cloudflare (IP address, time, page requested, browser). | To deliver the site, keep it secure and stop abuse. Legitimate interests. | Short periods set by Cloudflare’s standard retention. |
| App waitlist, only if you join: email, date, the page you joined from, device type (iPhone, Android or computer), country as seen by Cloudflare. No IP address. | To send you one email when the app launches. Nothing else: no newsletter, no sharing. Consent (tick box). | Until the launch email is sent, then deleted within 30 days; at most 12 months. Ask us to delete it sooner at any time. |
| Emails you send us, including mistake reports and contact messages. | To reply and fix what you report. Legitimate interests. | Up to 2 years after the conversation ends, unless a correction needs to be documented longer. |
Quiz plays: when you play a quiz on the website, the page sends a cookie-free technical event (time spent, number of answers and correct answers, device type, referring site, country as seen by Cloudflare) so we can see that quizzes are used. It contains no IP address, no persistent identifier and no fingerprint, and it is deleted within a few hours. Legitimate interests.
Data that stays in your browser: on the website, reading-plan progress, your scroll shelf, quiz scores, your cookie choice and similar settings are stored in your browser’s local storage and are never sent to us. Clear your browser’s site data for biblequize.com to delete them. This applies to the website only. The Sanluma app saves progress on our server, as described in section 3.
10. Cookies and similar technologies
Website (biblequize.com) and the web version of the app (app.7scrolls.com): the only optional cookies are the Google Analytics and PostHog cookies listed in section 9. One choice covers both. We use Google Consent Mode, and advertising features are off for everyone.
- EEA, UK and Switzerland: analytics cookies are off by default. A small banner offers Accept or Decline. Until you accept, no analytics cookies are set. If our site cannot tell that you are in Europe, Google still treats visits from these countries as “not consented” based on the approximate location of your connection.
- Everywhere else (including the United States): analytics cookies are on by default, and you can turn them off at any time.
We remember your choice in your browser’s local storage (sl-consent), not in a cookie. To change it, use Cookie settings in the footer. If you decline, we stop analytics and delete the _ga and ph_ cookies our site can reach.
The web version of the app also uses strictly necessary cookies to keep you signed in (sl_at, sl_rt, and sl_gs for a 10-minute Google sign-in step). They are required for the service and are not used for analytics.
iOS and Android apps: the apps use no cookies and no third-party trackers. They keep your sign-in tokens, progress and settings in the app’s own private storage on your device, so the app works offline.
11. How long we keep data: summary
- Sign-in codes and links: valid 15 minutes, records deleted after 24 hours.
- IP addresses: never stored as such; a salted hash is kept for 24 hours for abuse limits.
- Sessions: deleted after 90 days without use.
- Usage statistics and reminder logs: 13 months.
- Guest accounts not used for 12 months: deleted with all their data.
- Account data and progress: until you delete your account.
- After you delete your account, everything linked to it, including your reports, usage statistics, sessions and sign-in records, is deleted from our live database immediately. Copies may remain in our hosting provider’s automatic backups for up to 30 days and in our email provider’s sending logs for their standard period, after which they are erased.
- Website data: see section 9.
12. Your rights
Everyone can, inside the app:
- download your data: Settings → Download my data. You get one file with your account, progress, Arena and group data, reports, reminders, devices and sessions (without security secrets), plus the settings kept only on your device. On a phone it opens the share sheet so you can save the file;
- delete your account: Settings → Delete account. This deletes your account, progress and points for good and cancels any web subscription. Groups you created are deleted; in other players’ match history your account is no longer shown. If you use the app as a guest (not signed in), use Settings → Delete my data instead. If you cannot open the app, you can ask us to delete your account by email: see how to delete your Sanluma account;
- change your tradition (kept on your device only), reminders, usage analytics and other settings at any time.
EU and UK (GDPR / UK GDPR): you have the right of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests (including usage statistics; the Settings switch is the quickest way). Where we rely on consent (for example reminders and website analytics), you can withdraw it at any time without affecting earlier processing. You can complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or the authority where you live; in the UK, the ICO.
US states (for example California, Colorado, Virginia): you can ask what we hold about you, ask us to correct or delete it, and opt out of sale or targeted advertising. We do not sell personal data or use it for targeted advertising.
You can change your website analytics choice under “Cookie settings” in the footer, block or delete cookies in your browser settings, or use Google’s opt-out browser add-on. To leave the app waitlist, email us from the address you signed up with.
To make any request, email hello@biblequize.com. If you are signed in, please write from the email address of your account so we can verify it. We reply within 30 days.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Arena fair-play checks only affect game ratings.
13. Security
Sign-in codes and links are stored only as one-way hashes, expire after 15 minutes and are deleted after 24 hours. IP addresses are stored only as salted hashes. Sessions use short-lived tokens that are refreshed and can be revoked by signing out. All connections use HTTPS. No method is perfectly secure, but we limit what we collect so there is little to lose.
14. Changes
If we change this policy, we will update this page and its effective date first. If a change is significant (for example a new kind of data or a new provider), we will also tell app users inside the app. See also our terms of use, app support, our about page and our editorial policy.