Privacy Policy

Last updated: 19 October 2026

Castiel is a prayer app: you share an intention, Castiel connects it to a real church and its bell, and you take a moment to pray. There are also prayer alarms, reminders, a daily Bible verse and saint, reflections, and a community where people pray for one another. This page explains which data is involved, where it goes and what rights you have.

In short: much of it stays on your device. A prayer text only leaves it when you use a feature that needs it. Usage analytics and ad measurement only run if you agree. Castiel shows no ads and does not sell data.

1. Who is responsible

Castiel is developed and operated by Kevin Baur, a sole trader based at Hochstraß 542, 3033 Klausen-Leopoldsdorf, Austria. I am the controller within the meaning of the GDPR. You can reach me at castiel@kevin-baur.com with any question about your data. Full provider details are in the Imprint.

2. What stays on your device

You can use Castiel without an account. Your prayer intentions, prayer history, alarms, reminders, reflections and settings are stored locally on your device. Alarms and reminders are scheduled by your device's operating system; nothing leaves your device for the scheduling. What happens when you stop an alarm with a prayer is explained in section 3.

Castiel does not ask for your location. The church map only shows the churches in the app.

If you delete the app, this local data is gone. That does not delete a community account (section 5); you do that in the app under "Your account".

3. Prayer intentions and AI

Some features use an AI model: choosing a church and bell for your intention, a personal word on your prayer, the reflection, the weekly and monthly review, and checking your prayer for a prayer alarm. These features are only available with Castiel Pro and Smart Companion switched on; without Pro, no text goes to an AI model. When you use one of them, the app sends the texts it needs to a service I run on Cloudflare, which passes them on to Anthropic (the Claude model) and returns the answer.

What is sent: the prayer texts concerned, their timestamps, your app language and, if you entered it in the app, your first name. What is not sent: your account, your email address or device identifiers. My service does not store the texts; it passes them through and discards them.

Anthropic processes the texts on my behalf, as a processor, and may use them only for this purpose. Under the terms of this interface they are not used to train models and are generally deleted within 30 days, kept longer only if a request is flagged for violating Anthropic's usage policies or the law requires it. Processing takes place in the USA (see section 13).

Prayer alarms with a prayer. If you set an alarm to stop only after a prayer, the AI model checks whether your spoken or written prayer counts as a prayer. Only that text and your app language take the same route through Cloudflare to Anthropic. If you speak the prayer, what is said under "Dictation" below also applies. Without Pro, with Smart Companion off or without a connection, the app only checks on the device whether the text is long enough.

Smart Companion. With Castiel Pro, Smart Companion is switched on by default. You can turn it off at any time in the app under Settings. The app then matches your intention to a church on the device using keywords, reflections and reviews are off, and prayer texts are no longer stored on your device.

Sensitive data. A prayer intention can say a lot about you, such as your faith or your health. The GDPR gives such information special protection. I only process it because, and to the extent that, you deliberately use one of these features; that is your explicit consent. Share only what you want to share, and no private details about other people without their agreement. If you do not want AI processing, turn Smart Companion off; bells, prayer time, alarms and reminders work without them.

Dictation. If you speak into the microphone instead of typing, Castiel with Pro and Smart Companion switched on uses enhanced speech input by default: while you speak, the app sends your speech directly to OpenAI, which turns it into punctuated text. My service on Cloudflare only issues a short-lived access key for this; it receives your app language, but no recording. OpenAI receives the speech recording and, for technical reasons, your IP address, but not your account, your email address or device identifiers. OpenAI processes the recordings on my behalf, as a processor, and may use them only for this purpose. Under the terms of this interface they are not used to train models and are generally deleted within 30 days. Processing takes place in the USA (see section 13). Spoken prayers are covered by what is said above under "Sensitive data".

You can turn enhanced speech input off at any time in the app under Settings. Then, without Pro, and whenever OpenAI cannot be reached, your operating system's speech recognition turns your speech into text. On iPhone this happens on the device where the language pack is available, otherwise at Apple. On Android it is usually handled by Google's speech service. Either way, Castiel only receives the finished text and keeps no recordings. You can withdraw microphone access in your device settings at any time.

4. Usage analytics and ad measurement, only with your consent

On first launch Castiel asks whether you agree. If you decline, nothing leaves your device for these purposes and the app works the same. You can change your decision at any time in the app under Settings.

Usage analytics with PostHog. With your consent, Castiel records how the app is used, such as which screens you open, which onboarding steps you complete, whether a purchase starts or fails, and which version you use. This includes a random installation identifier and details about device type, operating system, language and app version. Your name, your email address and your prayer texts are not recorded. Before you agree, the app makes no contact with PostHog. The provider is PostHog Inc.; the data is held in PostHog's EU cloud in Frankfurt am Main, Germany. PostHog acts as a processor.

Ad measurement with Meta. When I advertise Castiel on Facebook or Instagram, I want to know whether the ads lead to installs and purchases. The Meta SDK is only switched on if this measurement is active and you explicitly agreed to it at launch. It sends app events such as install, app open and purchase, together with technical details about your device, to Meta. Your device's advertising ID is only shared if you allow it; on iPhone the system also asks you ("App Tracking Transparency"). Meta Platforms Ireland Limited and I are jointly responsible for collecting and transmitting this data; what Meta does with it afterwards is Meta's own responsibility, under Meta's Privacy Policy.

Where an install comes from. On Android the app reads the Google Play install referrer once after installation. It tells the app whether you arrived through an invitation or a particular campaign, so an invitation can be credited and the onboarding fits. The referrer contains only that campaign or invitation reference.

5. Account and community

An account is optional. You need it to pray for one another with friends and groups, to send lights, and to take your Pro access to a new device. The community is meant for people aged 16 and over. When you register, you explicitly agree that the prayer intentions you share there are stored and processed.

Signing in. You sign in with an email address and password, or with "Sign in with Apple" or "Sign in with Google". I store your email address, your display name, a random invitation code and when you gave your consent. Your password and your recovery code are stored only as one-way check values; keep the recovery code private. With Apple or Google, I receive your email address from them (with Apple, a relay address if you choose) and, the first time, your name; Apple or Google learn that you are signing in to Castiel. Email addresses are not currently verified by a confirmation email, and I do not send newsletters.

What others see. Confirmed friends and members of your groups see your display name, your profile picture if you set one, and your personal intention if you add one. Nobody sees your email address.

What is stored. With an account, the following is stored: the prayers and lights you send, friend requests and friendships, groups with their name, picture and members, thank-you notes, whom you have blocked, the names you privately give your contacts (visible only to you), and reports you submit, including your note.

• A prayer to a friend is visible only to the two of you.
• A prayer for the community is not published as text. Others see that someone prayed, summed up as a number, along with the country from your device's region settings and the church you chose.
• Profile and group pictures are re-saved before upload, which removes metadata such as where a photo was taken.

Inviting friends. When you invite someone, I store who invited whom and when a bonus was credited. So that the same bonus cannot be obtained repeatedly through the same device, a one-way checksum of the installation is stored.

Widget. The home screen widget gets its own access that can only read what it displays. It can show your chosen light on your home screen, and so to anyone who looks at your device.

Where it is stored. Account and community run on Supabase, on Amazon Web Services servers in Ireland (EU). Sign-in credentials are kept in your phone's protected storage.

Under "Your account" you can export your data and permanently delete your account. That removes your account, your prayers, friendships, pictures and stored access, as well as reports concerning your account. Signing out removes the account data from your device but does not delete the account.

6. Notifications

Prayer alarms and reminders are created on your device. Community notifications, for example when a friend prays for you, are sent by the server. If you allow them, a delivery address for your device (push token) is stored. They are sent through Expo (650 Industries, Inc., USA), which hands them to Apple or Google. A notification may contain the sender's display name, never the prayer text. You can turn these notifications off in the app or in your device settings.

7. Purchases

You buy Castiel Pro through the Apple App Store or Google Play. I never see your payment details. Purchases are managed with RevenueCat (RevenueCat, Inc., USA). RevenueCat receives a random identifier and your purchase status. If you are signed in, that identifier is your account's random identifier, so your Pro access follows you to a new device when you sign in. RevenueCat does not receive your name, your email address or your prayer texts.

8. App updates

At launch the app asks Expo whether a newer version is available and downloads it if so. Expo receives your IP address, a random installation identifier and technical details such as operating system and app version.

9. Maps, bells and Bible

The church map uses Apple Maps on iPhone and Google Maps on Android. When it is displayed, these providers receive the requests needed to draw it, including your IP address, under their own privacy terms.

The app downloads bell recordings from Google Cloud Storage the first time they play and caches them on your device. It loads Bible texts from Supabase (section 5), even without an account. The English audio Bible is streamed or downloaded directly from eBible.org (USA). For these requests the providers receive your IP address and the requested file, but no prayer texts, no account and no device identifiers.

10. This website and email

This website is delivered through Cloudflare (Cloudflare, Inc., USA). Cloudflare processes your IP address and technical details of your browser to deliver the pages and fend off attacks. The home page loads images from Google Cloud Storage and the App Store badge from Apple, which gives Google and Apple your IP address. The pages with the legal texts load nothing from third parties. This website sets no cookies and keeps no visitor statistics.

If you email me, I process your address and your message in order to reply. My mailbox is hosted by Namecheap (Private Email service, Namecheap, Inc., USA).

11. Legal bases

• Contract (Art. 6(1)(b) GDPR): the app's features, your account and the community, community notifications, purchases and your Pro access, invitations, and replies to your enquiries.
• Explicit consent (Art. 9(2)(a) together with Art. 6(1)(a) GDPR): prayer intentions you use for AI features or share in the community.
• Consent (Art. 6(1)(a) GDPR, section 165(3) of the Austrian Telecommunications Act 2021): usage analytics with PostHog, ad measurement with Meta, reading the advertising ID, microphone and dictation, and notifications.
• Legitimate interest (Art. 6(1)(f) GDPR): security and abuse prevention, including request limits and checksums for invitations, reports and moderation, app updates, and delivering and securing this website. My interest is a safe, fair and working service. You can object to this, see section 15.
• Legal obligation (Art. 6(1)(c) GDPR): for example handling reports of illegal content and statutory retention duties.

You can withdraw consent at any time with effect for the future, in the app or in your device settings. Processing carried out until then remains lawful. You are not obliged to give me any data; without the data a feature needs, however, you cannot use that feature.

There is no automated decision that has legal effects on you or similarly significantly affects you. Measures against content or accounts are decided by me.

12. Recipients

These services receive data, each only for the stated purpose:

• Supabase (Supabase, Inc., USA): database, file storage and sign-in for account and community, and Bible texts, stored in Ireland
• Google Cloud (Google Cloud EMEA Limited): hosting the bell recordings and the images on this website
• Cloudflare: relaying AI requests, access keys for enhanced speech input and delivering this website
• Anthropic (Anthropic Ireland, Limited): AI features
• OpenAI (OpenAI Ireland Limited): enhanced speech input
• RevenueCat: managing purchases
• PostHog: usage analytics, only with consent
• Expo: app updates and delivering notifications
• Namecheap: email
• Meta (Meta Platforms Ireland Limited): ad measurement, only with consent
• Apple and Google: Sign in with Apple or Google, speech recognition, maps, delivering notifications and processing purchases
• eBible.org (USA): English audio Bible

Supabase, Google Cloud, Cloudflare, Anthropic, OpenAI, RevenueCat, PostHog, Expo and Namecheap act as processors on my behalf and on my instructions. Meta is jointly responsible with me for ad measurement as described in section 4 and solely responsible afterwards. Apple, Google and eBible.org are responsible for their own services.

13. Transfers outside the EU

Several of these providers are based in the USA or process data there. The basis is the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, such as Cloudflare, Google and Meta. In all other cases the European Commission's Standard Contractual Clauses apply. You can get a copy on request at castiel@kevin-baur.com.

14. How long data is kept

• Data on your device: until you delete it in the app or remove the app.
• Account and community: until you delete your account. Operational backups of the database provider may persist until their technical retention expires.
• Push tokens: until you turn notifications off, delete your account, or your device stops accepting notifications.
• Checksums of installations that already received a bonus: kept after an account is deleted, so a bonus cannot be obtained twice. They contain no name or contact details.
• Reports: as long as needed to handle them.
• AI requests: not at all on my side, at Anthropic as described in section 3.
• Speech recordings: not at all on my side, at OpenAI as described in section 3.
• Usage analytics: as long as needed for analysis; after you withdraw consent, no new data is collected.
• Emails: as long as needed for your enquiry and statutory retention duties.

15. Your rights

Under the GDPR you have the right to access your data, to rectification and erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Much of this works directly in the app: export and deletion of your account under "Your account", consent to analytics and ad measurement under Settings. For anything else, write to castiel@kevin-baur.com.

Without an account, your prayers are only on your device; I hold no data I could attribute to you.

You also have the right to lodge a complaint with a data protection authority, where you live or the one responsible for me: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40 to 42, 1030 Vienna, Austria, dsb.gv.at.

16. Age

Castiel is intended for people aged 16 and over. I do not knowingly collect data from younger children. If you believe a child has given me personal data, let me know and I will delete it.

17. Changes

If this policy changes, the date at the top of this page changes with it. I point out significant changes in the app.

18. Contact

Kevin Baur, castiel@kevin-baur.com