Privacy Policy

The Sacred Well is published by Mustard Seed Press. This policy explains what the app stores, what leaves our servers, and what you can do about it. The app is free. There is no advertising, no tracking for advertising, and nothing here is sold.

What we store

Your account. Your email address. If you sign in with Google, we receive your Google account ID and basic profile information such as your display name.

Your household. The household name, each member's display name and role, and — for children only — a date of birth entered by a parent. Adult members are not asked for a date of birth.

Children's accounts. Parents create sign-in accounts for their children from within the app. A child does not create their own account, and a parent can reset a child's password or remove the account at any time.

What you write. Notes, highlights, bookmarks, prayer requests, saved prayers, the people you pray for, worship moments, session history, memory practice, and study progress across all four rooms.

Your preferences. Preferred Bible translation, reading and vocabulary settings, highlight colours, and panel order.

Technical data. Ordinary server logs, and browser local storage used to keep you signed in and remember your settings.

Who else processes it

The app runs on infrastructure we control. Your accounts and everything you write live in a Supabase project owned by Mustard Seed Press — not a reseller's, and not shared with any other app.

Supabase — the database, sign-in, and the server-side functions the app runs on.
Lovable — serves the web app itself. It does not hold your data.
Anthropic (Claude) — the AI features described below.
Google — only if you choose to sign in with Google.
Resend — sends household invitation emails. It receives the recipient's email address, your display name, the household name, and, when you are setting up an account for someone, that person's first name.
Crossway (ESV API) and API.Bible — supply the Bible text in your chosen translation. They receive the passage being requested, and API.Bible's fair-use system records which passages were viewed so that publishers can see their translations are being used within licence.

What the AI features send

Five features call Anthropic: the Study Assistant, the Theology Assistant, sample prayers, worship moments, and Sacred Roots lessons. Each sends only what it needs to answer.

Sample prayers send the most, so it is worth stating plainly. When you generate a prayer, we send:

• your display name, and whether you are the mother or father in the household
• your spouse's name
• your children's first names and their ages in whole years — not their dates of birth. The date is converted to an age on our server and the date itself is never sent
• the names and relationships of any loved ones you have added
• the prayer requests you selected
• anything you typed into "what's on your heart"

What we do not send is you. The request carries no email address, no account ID, and nothing else identifying who is praying. Anthropic receives an application key belonging to Mustard Seed Press, not an identity, so a prayer cannot be tied back to your account at their end.

This is not anonymity — first names appear inside the text itself. It simply means they are never told whose family it is.

Under Anthropic's commercial API terms, what we send is not used to train their models.

Sharing inside your household

The Sacred Well is not a social network. There are no public profiles, no feeds, no followers, no discovery, and no way to share anything with anyone outside your own household. The only people who can see what you write are members of your household, each with their own account, and only what you have specifically shared with them.

Your notes and prayer requests are private to you unless you choose to share them. Sharing is enforced in the database itself, not just in the app, so another member cannot read what you have not shared.

One thing worth knowing before you share. If you share a prayer request with someone in your household and they generate a prayer from it, your words and your name are sent to Anthropic as part of that request. Sharing a request with your husband or wife also means it may travel that far.

Children

The Sacred Well is built for parents and children to use together. There are two ways a parent sets up a child, and they differ in what is collected:

• By invitation — the household owner sends an invitation link by email. The child's email address is collected and passes through Resend.
• By username — the parent creates a username and password directly and keeps them. No email address is involved at all, which makes this the more private of the two.

Either way the account is created by a parent, and a parent can reset the password or remove the account at any time.

We do not ask for a date of birth when someone signs up with their own email address or with Google, so we cannot tell how old a new account holder is. We do not knowingly allow a child to create an independent account, and if you believe one exists, write to us and we will remove it. Parents are responsible for their household's use of the app.

Your choices

You can edit or delete anything you have written, at any time, from inside the app. You can delete your entire account and its data from your profile page. You can sign out at any time.

Retention

We keep your data while your account exists. Deleting your account removes it.

Security, honestly stated

Connections are encrypted in transit and your data is encrypted at rest. Secrets stay on the server and are never sent to your browser. Sharing rules are enforced by the database itself, not merely by the app, so another member cannot read what you have not shared even if something in the app misbehaved.

The platform beneath the app carries independent certification. Supabase, where your data lives, is SOC 2 Type 2 and ISO 27001 certified and encrypts data at rest with AES-256.

The application itself has not been independently audited, and Mustard Seed Press holds no certification of its own. Those audits exist mainly for companies selling to other companies. This is a free app, made by one family for others, and we would rather say so plainly than let a certificate belonging to someone else imply something about us.

If you find a security problem, please write to us before disclosing it publicly.

Changes

We will update this page when the app changes. The effective date above will change with it.

Contact

hello@mustardseed.press