Privacy Policy

This Privacy Policy explains how TrinityApologetics handles personal information through the websites, applications, APIs, account systems, study tools, libraries, and other services that link to it. We call these products the “Trinity Services.” They include TrinityApologetics, TrinityBible, TrinityLibrary, The Concord Project, IsMeansIs, Trinity Accounts and TrinityNotes, and the APIs that support them.

[OWNER INPUT REQUIRED: Legal name of the person or entity that operates TrinityApologetics.] In this Policy, “we,” “us,” and “our” refer to that operator.

The information we receive depends on the Trinity Service and the choices you make. It can include:

• your email address, display name, and chosen profile image;
• account preferences, such as theme, time zone, Bible translation, reading reminders, content level, and notification choices;
• notes, titles, tags, annotations, highlights, bookmarks, reading positions, plan progress, and other saved study material;
• quiz answers and saved quiz results;
• search or AI queries you submit;
• payment contact details and the support option you choose; and
• messages, attachments, or other details you send in a support or contact request.

Please do not submit information you do not want processed as described here.

Trinity Accounts use Supabase for identity and authentication. Supabase can process your email address, password credential, email-verification state, linked identity-provider information, OAuth grants, multi-factor authentication factors, session tokens, and security events. We do not receive your password in readable form.

TrinityBible, TrinityLibrary, and The Concord Project use the shared account through OAuth. Those applications receive the account identifier and the email/profile scopes you authorize. They keep short-lived access information and refresh credentials in secure, HTTP-only cookies so you can stay signed in.

The main site’s browser client also stores Supabase session information in browser storage. Account settings let you review linked identities, multi-factor methods, active sessions, and connected Trinity applications.

Signed-in study data is stored in the shared Supabase database and associated with your Trinity account.

TrinityApologetics and Trinity Accounts

The main service stores your profile, settings, TrinityNotes and their sources or tags, connected applications, supporter access, and denomination quiz results you choose to save.

TrinityBible

TrinityBible synchronizes notes, highlights, bookmarks, selected passage text, reading positions, preferences, and reading-plan progress. It can import guest study data when you sign in. Offline Bible data, reader settings, and AI-search history can remain on the device.

TrinityLibrary and The Concord Project

These readers synchronize notes, highlights, bookmarks, saved works or study state, reading positions, and preferences. They can import local study data after sign-in. TrinityLibrary also stores editorial drafts, source and rights metadata, revisions, and administrator audit records for authorized catalog editors.

A deletion in one connected service can affect the synchronized copy shown in another service. Guest data stays in browser local storage unless you sign in and import it. Clearing site data, reinstalling an app, or changing devices can remove local-only data. Export tools create files on your device; the browser and operating system control those downloaded copies.

When you use a Trinity Service, web servers and supporting infrastructure can receive:

• IP address and approximate network information;
• browser, device, operating-system, language, and request-header information;
• requested page or API path, request time, response status, and request identifier;
• session and authentication status;
• rate-limit, security, database timing, cache, and error information; and
• referring page or link information when supplied by your browser.

The audited Bible API request logs record method, path, status, timing, cache status, database mode, and a request ID. Error logs can include technical error details. We use this information to deliver requests, diagnose failures, protect infrastructure, and prevent abuse.

The account service also keeps administrative audit records for protected changes. Those records can identify the administrator, action, affected record, and time. Authorized administrators can use account, project, catalog, and supporter tools needed to operate the services.

No dedicated third-party product-analytics or error-monitoring SDK appears in the audited source. The services still produce operational logs and aggregate administrative counts. Production infrastructure can add logs outside the application repositories, which must be confirmed by the owner.

The Trinity Services use cookies and browser storage for functions users request, not for an advertising network in the audited code.

• Session cookies keep you signed in to connected applications. Temporary OAuth cookies protect the sign-in flow and remember the page you intended to open.
• Local storage holds guest notes, annotations, bookmarks, reading history, search history, theme, reader layout, accessibility choices, dismissed notices, and other preferences.
• Offline storage and caches let TrinityBible work as a progressive web app and can keep Bible data or interface assets on your device.

You can clear these items in the service or browser. Blocking essential cookies can prevent sign-in and synchronization. Clearing local storage can erase guest data that has not been synchronized or exported.

Most catalog and Bible text searches run against Trinity-controlled indexes or APIs. The audited applications do not store a server-side history of ordinary search phrases. A browser may keep recent queries on your device to restore the interface.

TrinityBible’s Ask & Find feature sends your query, selected translation or book filter, and requested result limit to OpenAI. It asks OpenAI for Bible references only; it does not send your saved notes or the text of Bible verses in the audited implementation. OpenAI processes the request under its own privacy terms.

For anonymous AI use, the Bible API creates a daily quota identifier from a browser-supplied anonymous ID or IP address. It stores a keyed hash, the UTC date, a count, and an update time. The code removes rows older than seven days when the quota store starts. Signed-in requests use an internal service credential to receive the signed-in quota treatment.

TrinityBible stores recent AI conversations in local storage. You can clear that history in the AI interface. Avoid putting confidential or sensitive personal information in an AI query.

Stripe handles card and payment-method details for one-time and recurring support. We do not store full card numbers. Stripe can collect billing contact information, payment credentials, device and fraud-prevention data, and transaction information under its Privacy Policy.

Our shared account database stores the Stripe customer identifier, account identifier, customer email and name when returned by Stripe, payment or checkout identifiers, amount, currency, project supported, payment status, subscription product and price identifiers, billing period, cancellation state, trial dates, and related metadata. The Stripe webhook event table also stores the event payload used to reconcile billing and supporter access.

Supabase can send account verification, password recovery, and other security messages. Stripe can send payment receipts. If you contact us through a working email or support channel, we use the message to answer and can keep a record when needed.

The contact form in the audited main-site code validates name, email, reason, and message fields in browser memory, then clears them. It does not transmit or persist the message. Do not rely on that form for a legal or privacy request until delivery is connected.

Account settings contain choices for email updates, content notifications, and reading reminders. The audited code does not identify a separate marketing-email provider or show that every preference is active in production. [OWNER INPUT REQUIRED: Connect the contact form; confirm which optional emails are sent and the provider used.]

The Trinity Services form one connected ecosystem. Information associated with a Trinity account may be used across connected Trinity Services when needed for authentication, synchronization, account management, saved notes and content, personalization, security, supporter access, and service operation.

For example, a TrinityBible note can appear in TrinityNotes, an OAuth grant can show which connected application has account access, and account preferences or project access can shape what a service displays. We do not make private study data public through this connection.

The audited code uses the following providers:

• Supabase for authentication, OAuth, account data, synchronized study data, role-based access, and shared database storage;
• Google and X as optional linked sign-in providers when a user chooses them;
• hCaptcha for abuse prevention when Supabase requires a CAPTCHA challenge;
• Stripe for checkout, recurring support, payment receipts, fraud controls, and the customer portal;
• Bunny for databases, object storage, content delivery, and hosting infrastructure used by APIs and library content;
• Cloudflare for hosting or edge delivery of The Concord Project; and
• OpenAI for TrinityBible Ask & Find AI requests.

Other infrastructure providers may process request data as part of hosting, domain, network, backup, or security operations. [OWNER INPUT REQUIRED: Confirm the production hosting, DNS/CDN, error-monitoring, and backup providers not represented in the repositories.]

We share information only as needed to operate the Trinity Services, complete a transaction, follow your direction, protect people or systems, or meet legal obligations. This can include sharing with:

• the service providers listed above;
• another Trinity Service you connect to your account;
• professional advisers or authorities when the law requires it or a serious security or safety issue calls for it; and
• a successor operator if the Trinity Services are reorganized, transferred, or acquired, subject to this Policy and applicable law.

The audited code contains no advertising SDK, cross-site ad tracker, or feature for selling personal information. [OWNER INPUT REQUIRED: Confirm that production operations do not sell personal information or share it for cross-context behavioral advertising.] We do not treat your private notes or study history as public content.

We keep information for as long as needed to provide your account and requested features, preserve synchronized content, secure the services, reconcile payments, meet legal or accounting duties, resolve disputes, and maintain reliable backups.

Different records need different periods. Account and synchronized study data can remain until you delete the item or request account deletion. Stripe and billing records can remain for financial and fraud-prevention needs. Security and administrative audit records can remain after account closure. Anonymous AI quota rows are pruned after seven days when the quota database initializes.

[OWNER INPUT REQUIRED: Production retention periods for server logs, support messages, billing records, audit logs, deleted-account backups, and backup rotation.]

You can edit profile details and preferences, delete individual notes and annotations, clear supported search or AI history, clear local study data, export certain notes and saved items, revoke connected applications, remove some sign-in methods, and sign out of sessions.

A self-service account deletion endpoint is not present in the audited code. Once the legal contact address is posted, you may use it to request closure and deletion. We will verify the request and delete or de-identify eligible information. We may retain records when needed for legal duties, security, fraud prevention, payment reconciliation, or disputes.

[OWNER INPUT REQUIRED: Account-deletion process, response address, completion target, and treatment of backups.]

We use measures such as encrypted HTTPS connections, secure HTTP-only cookies in connected applications, signed tokens, PKCE for OAuth, row-level database security, role checks, secret separation, rate limits, request-size limits, origin controls, keyed hashing for anonymous AI quotas, and administrative audit logs.

No internet service or storage system is completely secure. Protect your credentials, use available multi-factor controls, and contact us if you suspect unauthorized access.

[OWNER INPUT REQUIRED: Minimum age, intended audience, and whether the operator offers verifiable parental consent.]

If you believe a child submitted personal information in a way that does not meet the applicable requirements, contact us. We will review the report and take appropriate action.

The Trinity Services and their providers may process information in countries other than the one where you live. Those countries can have different data-protection laws. Where law requires a transfer safeguard, the responsible operator will use an available legal mechanism.

[OWNER INPUT REQUIRED: Operator’s home country and any specific international transfer mechanism the operator relies on.]

Depending on where you live, you may have a right to request access, correction, deletion, portability, restriction, or objection; to withdraw consent; or to appeal a decision about a privacy request. You may also have a right to complain to a privacy regulator.

We can ask for information needed to verify your identity and authority. Some records are exempt from a request or must be kept by law. We will not discriminate against you for exercising a privacy right.

If the owner confirms that TrinityApologetics does not sell or share personal information for cross-context behavioral advertising, this section will state that directly. Until then, see the owner-confirmation placeholder under “How information is shared.”

We may revise this Policy when the Trinity Services, providers, law, or our practices change. We will post the revised version here and change the “Last updated” date. If a change has a material effect on registered users, we may also provide notice in a Trinity Service or by email.