Privacy

People bring this app the things they would not say out loud. That is only possible if it is careful with what it is told.

What is never stored

• The words you type. Not in logs, not in a database, not in a file.
• The words Nicodemus replies — not as text, and not as audio. A spoken answer is streamed to you and never written to disk.
• Anything that could reconstruct a conversation — no saved questions, no saved answers, no saved list of the passages a reply leaned on.

What stays only on your device

• Your conversation history, language, tradition, and access code live in your browser, never on the server. The server never receives your history.
• Your Journey progress and reflections are stored only on your device. There is no server record of what you have read.
• Story Time (a parent-opened area for young children) keeps its family profiles — a nickname and birth month — on your device only. It never uses AI to talk with children, has no links out, and nothing about a child is collected or sent anywhere.

What the server keeps — anonymous

• A random per-device id and counts (days seen, number of messages) — used for message limits and to know roughly how many people used the app.
• The shape of a conversation — for example, that a care/crisis moment occurred and its category — with no words attached. This is how we can tell whether the crisis care is working. It is anonymous, but it is not nothing, and you should know it is there.
• Anonymous signals about where Nicodemus struggled, so it can be improved for everyone — for example, that an answer had to be rewritten after a check failed, that a Bible reference could not be verified (the reference itself is kept), that a reply was slow, that a live voice turn stumbled, or that someone asked again within two minutes (a plain yes or no, worked out in memory — your questions are never saved for this). Each is tied only to a general topic label from a fixed list, the language, the tradition setting, and a random key that changes every day and cannot be traced to you or your phone. For a care or crisis moment only a count is kept — no topic, no detail. No words of yours, and no words of Nicodemus's reply, are ever saved in these signals. They are deleted automatically after 90 days.
• Token and cost totals, to know the bill.
• Audio of Scripture chapters, the fixed voice preview, and the three lines of the spoken intro that say a first name. The first two are public and identical for everyone. The intro lines (for example “Eric. When were you born?”) are kept under a scrambled code made from the name, with no link to you, your phone or anything you said, so a name that has been heard once is not made again. Personal answers are never saved as audio.

These server-side records are aggregate, anonymous counters — usage and cost totals, and tallies of how often the care path was triggered by category — never a timestamped, per-person trail of what anyone said or did. They are kept only for the length of the pilot and cleared when its data is reset; the conversation-shape tallies are wiped on every deploy. The anonymous struggle signals above are the one exception to "wiped on deploy": they stay for 90 days and are then deleted automatically.

Which AI providers process your words

• Anthropic (the Claude model) processes the text of your questions and answers in order to generate replies.
• If you tap the microphone in the message box to talk instead of type, your phone's own Apple speech recognition turns your voice into words. It works on your phone when your language allows it; otherwise Apple's standard recognition is used, and then the audio goes to Apple. Nicodemus never receives or keeps the audio — only the words, and only when they are sent.
• If you start a live conversation (by tapping your light), your voice is streamed to ElevenLabs, which listens and speaks in Nicodemus's voice. ElevenLabs passes the words it heard to Nicodemus, which answers them the same way it answers a typed message (so Anthropic processes those words too), and ElevenLabs speaks the answer back. The conversation is saved on your phone as an ordinary conversation, like one you typed; our server holds it only in memory while the conversation lasts. We have set ElevenLabs to record no audio and to keep the conversation for 0 days. Its strictest “zero retention” mode cannot be used when Nicodemus writes the replies, so we cannot promise it keeps nothing at all while the conversation is happening; ElevenLabs' own terms apply to what it handles. If anything that sounds like a crisis comes up, the live conversation stops at once and the care message appears as text.
• If you use Listen (text-to-speech), OpenAI receives the text being read aloud — a Scripture chapter or an answer — and turns it into speech. OpenAI also makes the saved recordings of Scripture chapters and listens back to them to check them; that is public Scripture text, never anything you wrote.
• If an answer is spoken in Nicodemus's own voice in the app, ElevenLabs receives the text of that answer — not your question — and sends back the audio. The same goes for the Listen button on a Scripture card: ElevenLabs receives the text of that passage, which comes from our own Bible database. In the first-run intro, ElevenLabs also receives your first name, inside three short fixed lines, so Nicodemus can say it.
• Google (Google Cloud Text-to-Speech) is the backup voice. If ElevenLabs cannot make a piece of audio, Google receives that same text instead.
• Cloudflare stores the saved recordings of Scripture chapters and passages (public text, the same for everyone) and the three intro lines that say a first name. A spoken answer is never saved there or anywhere else.
• If you choose a Bible such as the ESV in the reader, its text — and the audio, for the ones that have it — come from Bible Brain (Faith Comes By Hearing). Bible Brain is told only which book and chapter is being read (when audio plays, it also sees your phone's network address, as any website would) — never anything you type or say.
• These companies process your words or audio only to provide the feature, under their API terms. Nicodemus adds no other recipients.

Our promises

• We never sell your data. Ever.
• Every default is the private one: conversation-content logging is off, and the access gate fails closed (no code configured means no one gets in, rather than everyone).

---

This is the plain-language version. A person can, in principle, opt in to content logging only in local development — never in the live app.