Last updated 9 October 2026

Privacy

joshua421 is a companion for reflecting on your day and setting it before God. That is about the most private thing software can be handed, so this page is written to be read rather than to be survived.

Privacy contact

Kenneth Cheung is the contact for privacy questions, requests and complaints about Joshua421 in Australia. Contact ken@joshua421.app.

The iPhone app is offered by invitation only. The web app opens to anyone who signs in with an emailed link or a Google account, after declaring where they live. Neither invitations nor sign-ins are issued to residents of the European Union, the European Economic Area or the United Kingdom. That is a deliberate limit on which privacy regimes apply, not an oversight.

The public character quiz

The homepage appearance preview stays in page memory and does not change an account’s character or save a look. The character quiz requires an email sign-up before revealing your result, without creating an app account. Answers and the resulting profile are calculated in your browser. Your answers are kept in this browser’s local storage for up to seven days so you can continue after a reload; starting again clears them. Unless you opt in as described below, they are not sent to our server or an AI service, or attached to your account. The name you give so your result can address you is held only in the page’s memory and is not sent with your sign-up. Links to Bible passages open an external site; your quiz answers are not included in those links. The invite-only app has the separate account and Google permissions described below.

If you tick the separate option to help improve the test at sign-up, we store your 32 answers, how long each took, how many you changed or skipped, the three characters shown, your choice and your fit feedback. This is stored without your email, name or country, under a random token kept in your browser so a retake from the same browser can be compared with the first. Leave the box unticked and nothing about your answers is stored.

Quiz sign-up stores your email address, country of residence, optional app beta preference, the wording version and submission dates. We use this to record sign-ups and interest in the iPhone app, and only contact you about app beta access if you opt in. It does not sign you up for general marketing or grant beta access. Submitting the same email again updates its preference. Sign-ups from excluded countries are refused without storing the submission. We retain this record until you ask us to delete it at ken@joshua421.app.

Email updates

The updates page has a separate, optional sign-up for Joshua421 app news. We send your email address to Brevo to request a confirmation email. You join the updates list only after following its confirmation link. Your country is checked for availability but is not sent to Brevo. Signing in, taking the quiz or requesting a beta invite does not subscribe you.

Brevo keeps your address, confirmation and delivery records, and unsubscribe status to operate this list. Email opens and link clicks are counted anonymously, without being linked to individual recipients. Every app update email includes an unsubscribe link. Unsubscribing stops updates; you can also request deletion at ken@joshua421.app. Your private writing and quiz answers are never included in this list.

What is stored about you

Your account record contains your email address, your Google account identifier if you sign in with Google, your timezone, your two nudge hours, whether nudges are on, the identifier of the calendar joshua421 created for you, two per-day markers that stop a nudge being sent twice, the date you joined, and your Google refresh token.

If you sign in with email, we store your email address, your time zone and a SHA-256 hash of a one-time sign-in token. The token works once, for 15 minutes, and its record is deleted at the next sign-in request after that; we never store the link itself. Opening the link adds your address to the list of people who can use the web app.

The refresh token is stored as AES-256-GCM ciphertext. The key is held in the application’s environment and never in the database, so a copy of the database on its own cannot be used to reach your Google account.

The iPhone and iPad app also creates a sign-in record with a random identifier, a verification hash, an expiry time and the version of your AI-sharing consent. The sign-in record expires after ten minutes and is removed when used or during subsequent sign-in housekeeping. Mobile sessions contain a hash of the app credential, your account identifier, the consent version and a thirty-day expiry. The credential itself is held in your device’s Keychain. Signing out revokes that app session; account deletion removes all of them.

If you opted in to help improve the character quiz, your anonymised answers are stored as described in the public character quiz.

What is never stored

Your reflections: The conversation is not written to any database of ours. When you close the page, or the operating system closes the mobile app, it is gone from here. Unfinished conversations do not sync between devices. Only what you explicitly approve is kept, and it is kept in your own Google Calendar — read back from there each time, never mirrored.
Your calendar: The Week page reads events live from Google and mirrors nothing. Events reach reflection only when you select them for a request on the phone, held in memory for that request and discarded.
Your inbox: joshua421 has no permission to read email and does not ask for one. It can only send.

Website analytics and cookies

We use Vercel Web Analytics for aggregate visits to public website pages. It records page views, referring sites, approximate location, browser and device type without analytics cookies. Its anonymous visitor identifier expires after 24 hours; these figures are not a count of registered people.

We remove URL query strings and fragments, group character-profile visits, and exclude private app pages and sign-in callbacks. No form contents, quiz answers, journal writing or account identifiers are included. We honour Do Not Track and Global Privacy Control. The native iPhone app is not included in this website measurement. See Vercel’s analytics privacy information.

Sign-in uses its own cookie and a short-lived cookie to secure Google authorization. These are separate from website analytics.

Google data — what is accessed and why

Alongside your Google identity and email address, signing in requests the permissions below for the features described on the homepage.

See and edit calendar events: calendar.events — to read the events you choose to bring into a reflection, and to write the notes and day summaries you approve. Nothing is written without your approval in that session.
Create and manage the app’s own calendar: calendar.app.created — to create the separate “joshua421” calendar when you connect the calendar-reflection feature. Account deletion now preserves this external calendar and its contents. This permission applies to calendars created by the app.
Send email on your behalf: gmail.send — to send your morning and evening nudge from your own address, to yourself. It is used for no other recipient and no other message.

joshua421’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can withdraw these permissions at any time from your Google account’s permissions page. Doing so stops the service immediately; nothing already written to your calendar is affected, because it belongs to you.

AI and your data

AI is used in specific places, not everywhere. The character quiz involves no AI model. Saving an entry does not send it to AI: reflection starts only when you choose it, and only the words you write plus the journal entry or context you selected for that request are sent. Nothing you write is used to train a model, by us or by Anthropic.

The AI and data statement sets out where AI is used today, what the companion may and may not do with your writing, and how a connected assistant asks for your yes before it saves anything.

Who else sees anything

These services provide the functions described below. No data is sold, and none is shared for advertising, ever.

Anthropic: The companion is a Claude model. What you type, and the journal entry or context you selected for that request, are sent to Anthropic’s API to be answered. This is the one place your reflections leave your control, and it is unavoidable in a product of this kind — it is the model doing the listening. Anthropic processes API traffic under its commercial terms and does not train models on it. joshua421 keeps a record that a request started and finished, for the request limit, and no copy of its words.
Google: Sign-in, your calendar, and the sending of your nudges. Your own account, under Google’s own privacy policy.
Brevo: Sends the one-time link when you sign in with email. If you separately subscribe to app news, it also handles the confirmation email, updates list and unsubscribe requests described above. It does not receive your private writing or quiz answers.
Supabase: The database holding account records, mobile sign-in/session records and invite requests described on this page. No reflection transcript is stored there.
Vercel: Website hosting and the public-page analytics described above. Ordinary server logs may briefly record request metadata such as IP address and timing; they never contain reflection content.

If you asked for an invite

The invite request form stores your name, email address, self-declared country and whatever you chose to write, so that a real person can read it and answer you. It is used for that and nothing else — you are not added to a mailing list, because there isn’t one.

If you selected an EU, EEA or UK country, nothing is stored at all: the request is refused before it reaches the database, and you are told why on the spot.

Ask at ken@joshua421.app and your request is deleted.

Leaving

Delete your account from the account page. This removes your hosted account records and stored connection, and attempts to revoke Google access. Provider revocation can fail; you can also remove access in your Google account settings. Device-only plans and saved device copies are not erased by this server request. What remains is the joshua421 calendar in your own Google account, with everything you chose to keep in it — it is yours, and it stays whether or not you keep using this. Delete it yourself if you’d rather it were gone.

You can also ask for a copy of what is held, or a correction to it, at ken@joshua421.app. In practice the answer is the short list at the top of this page; you are welcome to have it in writing.

Where this stands legally

joshua421 is operated from Australia and handled under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Reflections about faith are sensitive information under that Act, and they are collected only with your consent and only for the purpose described here.

Data is processed in Australia and the United States, the latter because Anthropic’s and Google’s services are hosted there.

If this policy changes in a way that affects what is collected or who sees it, invited members are emailed before it takes effect, not after.