Trust & Security

This page is maintained by the Breadly team to answer common questions about how Breadly handles your account, your reading progress, and your payments. It describes the controls we have enabled today; it is not an independent audit or certification.

Account & authentication

• Sign-in is handled through our managed authentication backend; we do not store your password ourselves.
• Email/password and Google sign-in are supported.
• You can delete your account at any time from your profile. Deletion removes your account, progress, and cancels any active subscription.

Hosting & platform

• Breadly runs on Lovable Cloud, which provides our managed database, authentication, and serverless functions.
• Traffic is served over HTTPS.
• Database access is gated by row-level security so each account only sees its own progress and subscription records.

What we collect

• Account email and authentication identifiers.
• Reading progress, streaks, completed lessons, memorization state, and saved verses you create in the app.
• Optional journal reflections and Bible reader bookmarks when you save them while signed in.
• Subscription status (e.g. trialing / active / cancelled) from Stripe (web) or the App Store via RevenueCat (iOS).
• Aggregated, privacy-preserving product analytics to understand how features are used.

Payments

• Web subscriptions are processed by Stripe. We never see or store your card number, CVC, or full payment details.
• iOS subscriptions are processed by Apple through the App Store (managed via RevenueCat). Apple handles payment details.
• Subscription state is written to our database only by verified payment webhooks — clients cannot create, modify, or delete subscription records.

Subprocessors

• Lovable Cloud — hosting, database, authentication.
• Stripe — web payments and billing.
• Apple App Store / RevenueCat — iOS in-app subscriptions.
• Sentry — error monitoring.
• PostHog — product analytics.

Retention & deletion

Account data is kept for as long as your account exists. When you delete your account, your reading progress and profile are removed and any active subscription is cancelled. Limited records required for tax or anti-fraud purposes (such as Stripe invoices) may be retained by our payments provider as required by law.

Reporting a vulnerability

If you believe you have found a security issue, please email joachim@noobwork.no with details and steps to reproduce. Please do not publicly disclose the issue until we have had a reasonable chance to investigate and respond.

Contact

General privacy or security questions: joachim@noobwork.no.