Ikona — Privacy Policy

Deutsche Fassung · This is a translation. If the two versions differ, the German version applies.

Last updated: 21 October 2026

1. Controller and scope

This policy applies to the Ikona app for iPhone and Android. The controller under the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer because the legal requirements for this are not met.

2. In short

Ikona is a prayer and Bible app: prayers and readings for every day, the church calendar of your tradition, and answers to questions about faith.

• The app stores your settings (language, tradition, church and calendar), favourites, bookmarks, reading position and chats on your device. Prayers, Bible texts and the calendar work without sending your content anywhere.
• You do not need an account. The app knows neither your email address nor your phone number.
• For some features, content is sent encrypted to our server and from there to AI models of Microsoft Azure. This only happens after you have explicitly agreed in the app. Our server does not store this content, and it is not used to train AI models.
• Usage statistics and crash reports are only sent with your consent.
• We do not sell data, show no advertising and do not track you across other apps or websites.

3. What we process, why, and on what legal basis

Downloading the app

When you download the app from the App Store or Google Play, Apple or Google process data such as your account identifier, payment data and the time of the download. They do this under their own responsibility; we do not receive this data. More: Apple, Google.

Content on your device

The app stores your settings (language, tradition, church and calendar), favourites, bookmarks, reading position and chats on your device. Prayers, Bible texts and the calendar work without sending your content anywhere. This data stays on your device until you delete it. It is protected by your phone's encryption and, if you have switched on device backups (iCloud or Google), your operating system may include it in them.

Processing by AI models — only with your consent

For the following features the app sends content encrypted (HTTPS/TLS) to our server at Supabase, which passes it on to AI models that Microsoft runs for us in Azure. The answer goes back to your device. The app sends:

• your questions and messages in the chat with the conversation so far, also in areas such as preparing for confession or praying for someone, where you may mention other people and their situation;
• voice messages in languages your phone's speech recognition does not know (currently Tagalog), to turn them into text;
• photos you attach, for example to have an icon or a Christian symbol recognised;
• your Christian tradition, facts about today in the church year and, if you set it, your name, so the answer comes from within your tradition and in your language.

When you pray for other people, it is best to use only their first name and nothing that identifies them. Your tradition and what you write about your faith allow conclusions about your religious beliefs; messages can also contain health data. These are specially protected data (Art. 9 GDPR). That is why we only process them through the AI service with your explicit consent. We do not send your tradition to our usage statistics. Before the first transfer, the app shows you a separate screen explaining what is sent, to whom and why. Legal basis: your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw it at any time in Settings → Privacy. Without consent, prayers, the Bible, the calendar, saints and readings work fully. The chat, personal prayers, picture recognition and the quiz, and translations of Bible verses not yet available in your language are then unavailable.

Our server only passes the content on and does not store it. Under its contract terms Microsoft does not use it to train models. Microsoft may, however, keep requests and answers for up to 30 days to detect misuse of its services; only for that purpose and only accessible to authorised staff. The AI models do not receive any identifier of your device.

Text generated by AI models can be wrong. The app does not make decisions about you on this basis.

Installation identifier and cost counters

When you first open the app, it creates a random identifier for this installation and sends it with every request to our server. Per identifier and day, the server counts the number of requests, the kind of feature and the cost incurred. It does not store any content. We need these counters to enforce usage limits, to fend off misuse and to keep exact track of our costs. Legal basis: Art. 6(1)(b) and (f) GDPR; our legitimate interest is an affordable and secure service. After 13 months the server removes the identifier from the counters: only totals per app, feature and day remain, which cannot be linked to anyone. We keep those totals as part of our cost records for up to ten years. When you choose Delete all my data in the app, it creates a new identifier; the old counters can then no longer be linked to anyone. Storing the identifier on your device is strictly necessary for the features you use (§ 25(2) no. 2 TDDDG).

Like every server, ours receives the IP address of your device for technical reasons. Supabase processes it to deliver responses and to fend off attacks in logs that are kept for a short time; we do not combine it with other data (Art. 6(1)(f) GDPR).

Texts, calendar and recordings from our database

The app loads prayers, Bible texts, readings and explanations of the church year from our database at Supabase. These requests contain the language and the text you want, but neither your tradition nor any of your content nor an identifier of you as a person; the app picks the edition that fits your tradition on your device. Legal basis: Art. 6(1)(b) GDPR.

Subscriptions

You buy subscriptions through the App Store or Google Play; Apple or Google are your contractual partner for the payment. We never see your payment details. To know whether your subscription is active, the app exchanges a random customer identifier and the store receipt with our service provider RevenueCat. Legal basis: Art. 6(1)(b) GDPR. Purchase records are kept while your subscription exists and then for at most three years, so that questions and claims can be settled (§ 195 BGB). On request we have them deleted at RevenueCat earlier.

Usage statistics and crash reports — only with your consent

The app asks whether it may send usage statistics and crash reports. The switch starts off. Without your agreement the app does not start these services.

• Usage statistics (Amplitude): which screens and features you use, the app version, device model, operating system, language and a random identifier. They do not contain your entries, messages or name; Amplitude does not store IP addresses for us.
• Crash reports (Sentry): when the app crashes or an error occurs, technical details such as the error message, the device model and the app version.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in Settings → Privacy. The data is deleted once we no longer need it to improve the app, at the latest after twelve months.

App updates

When it starts, the app asks our service provider Expo (650 Industries, Inc., USA) whether a new version of its content is available. This transmits the app version, the platform, a random identifier of the installation and, for technical reasons, your IP address. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is being able to fix errors quickly.

Permissions on your device

The app only asks for permissions you need for a feature, and only when you use that feature. You can withdraw any permission in your phone's settings.

• Microphone and speech recognition — to dictate a message. Your words appear in the message field while you speak; the app uses Apple's speech recognition for this, on the device when your phone recognises the language there, otherwise on Apple's servers under Apple's privacy terms. Only for languages Apple does not recognise (currently Tagalog) is the recording sent to the AI service to turn it into text (see above).
• Camera — to take a photo for the chat.
• Photos — to choose a picture for the chat and to save cards or pictures from the app to your photos.
• Notifications — for reminders of feasts, fasts and name days. They are scheduled on the device; no data is sent to us for them. Note that such reminders can be visible on your lock screen.

Contacting us

When you write to us, we process your message and email address to answer you (Art. 6(1)(b) or (f) GDPR). Details on how we handle email are in the website privacy policy.

4. Recipients

These service providers process data on our behalf and according to our instructions under a data processing agreement (Art. 28 GDPR):

• Supabase, Inc. (USA) — server, database and forwarding to the AI models; Standard Contractual Clauses;
• Microsoft Ireland Operations Limited (Ireland) — AI models in Microsoft Azure; Data Privacy Framework and Standard Contractual Clauses;
• RevenueCat, Inc. (USA) — subscription status; Standard Contractual Clauses;
• Amplitude, Inc. (USA) — usage statistics, only with consent; Data Privacy Framework;
• Functional Software, Inc. (Sentry) (USA) — crash reports, only with consent; Data Privacy Framework;
• 650 Industries, Inc. (Expo) (USA) — app updates; Data Privacy Framework.

Apple and Google process data under their own responsibility when you download the app, buy a subscription or use features of the operating system.

5. Transfers to third countries

Some providers are based in the USA or process data there. The safeguard for each provider is named above under recipients: "Data Privacy Framework" means the provider is certified under the EU-US Data Privacy Framework and the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR); "Standard Contractual Clauses" means we have agreed the European Commission's Standard Contractual Clauses with the provider (Art. 46(2)(c) GDPR).

Microsoft stores data in the EU. Depending on the model used, however, Microsoft may process a request in a data centre outside the EU. Microsoft is certified under the EU-US Data Privacy Framework, and our contract with Microsoft includes the Standard Contractual Clauses.

6. How long data is kept

• Data on your device: until you delete it or remove the app.
• Content sent to the AI models: not stored by us at all; at Microsoft for at most 30 days to detect misuse.
• Cost counters per installation identifier: 13 months, without content; after that only totals without the identifier.
• Purchase records: while the subscription exists and at most three years after.
• Usage statistics and crash reports: at most twelve months.

7. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR). Processing before the withdrawal remains lawful.

An informal message to hi@maverk.app is enough for any of these requests.

Because the app works without an account, we usually cannot link data on our servers to a person. If you want to exercise a right, write to us and we will tell you what we need to find your data. You can delete the data on your device yourself at any time in Settings → Delete all my data.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

8. Children and young people

Only people aged 16 or older can give the consents in the app (Art. 8 GDPR). Younger people use the app without the features that need consent.

9. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

10. Security

All connections between the app and our servers are encrypted. Only the people who need it to run the service have access to our systems.

11. Changes

We update this policy when the app or the law changes. The version published on this page applies. If what we use consented data for changes, the app will ask you again.

See also the Terms of Use and the Impressum.