Privacy Policy

Effective date and version: shown next to this document in the app. When you accept it, we record which version you accepted and when.

QuietRoots is a place to read, listen, and reflect. The private part of it stays private. Your journal lives in an encrypted database on your phone, and if you turn on sync, it is sealed so that we cannot read it. This Policy tells you what we hold, what we never hold, and what we will never decide about you from what you read.

If any sentence here is unclear, write to us and we will explain it in plain words.

1. Who we are

QuietRoots is run by Yesod Code LLC, a company formed in Wyoming, United States.

Yesod Code LLC is the company you have your agreement with. It is also the company responsible for the personal data described here. In this Policy, "we", "our" and "us" mean Yesod Code LLC. "QuietRoots" is the name of the app.

QuietRoots is for adults. You need to be 18 or older to have an account. If we learn that an account belongs to someone younger, we close it and delete the data.

Write to us about anything in this Policy: support@quietroots.app.

2. Your journal and reflections

What you write in QuietRoots is yours alone. Nobody else reads it: not other members, not the people who run an organization you join, not us.

That is true in both places where your journal lives, and it works differently in each.

On your phone. Your journal entries and reflections are stored in an encrypted database on the device. If your phone is lost or stolen, whoever has it cannot read your entries.

If you turn on sync. Sync is part of a paid subscription, and it lets your journal follow you to a new phone. Each entry is sealed on your device before it goes anywhere, with a key that stays with you. We hold the sealed result. We do not hold the words, and we cannot open them. If your subscription ends, we stop receiving new entries, we delete nothing, and unlocking with your Recovery Key keeps working whether or not you are paying.

Your key is protected by a 24-word Recovery Key that the app shows you once, when you turn sealing on. Write those words down and keep them somewhere safe. They are how you get your journal back on a new phone. If you lose both the words and your devices, your entries cannot be recovered. Not because we refuse, but because we do not have the key.

You can also export an encrypted backup file of your journal. That file has its own 24-word Backup Code. No one can open that file without it — not even us.

The app can show you patterns in your own writing, such as tags and recurring themes. That analysis happens on your device. The text is not sent to us to be analyzed.

This design has one cost worth saying out loud. Because we cannot read what you write, we cannot see that you are struggling, and we cannot reach out. The app lists places where you can get help.

3. Your account and profile

3.1 What is in your profile

Your profile is what makes the app yours, and it is short on purpose. It holds:

• a username;
• a first name;
• a last name, if you want to add one;
• your email address;
• your gender, if you want to add one;
• your birth date, if you want to add it;
• an avatar picture, if you add one.

We do not use your gender or your birth date for advertising, and neither one is shown to other members. Section 5 explains the small part of your profile that people in an organization can see.

3.2 How you sign in

You can sign in with an email address and a password, or with your Apple or Google account. If you use a password, we store only a scrambled fingerprint of it, which cannot be turned back into your password. If you sign in with Apple or Google, we store the identifier they give us, not your password with them.

3.3 Subscriptions

Some features of QuietRoots are part of a paid subscription. Subscriptions are sold through the Apple App Store and Google Play. Those stores take the payment, renew the subscription, and handle cancellation. You cancel in your Apple or Google account, not with us.

We never see your card number. We use a service called RevenueCat, which tells us whether your subscription is active and which plan you have. That is what unlocks the paid features in the app.

3.4 Notifications

If you turn notifications on, your phone gives us a push token, which is the address a notification is delivered to. It is not tied to anything you read. You can turn notifications off in the app or in your phone settings, and we stop using the token.

4. What the app remembers so you can continue

The point of this data is simple: you open the app and you are back where you were. It covers:

• the last place you stopped reading;
• the last place you stopped listening;
• practices you completed and your streak;
• the identifiers of the materials you opened, so the app can hand them back to you;
• bookmarks you saved.

This is the app's memory, not a portrait of your faith.

Suggestions. We use this memory to suggest what you might want next in QuietRoots — another passage, a practice, a work you have not opened yet. That happens inside the app, for you, and it is part of the service you signed up for.

Later on we may want to suggest something you can buy, such as a book. That is a different thing from helping you find your way around the library, so we will ask you separately before we start, in the same small and specific way as the consent in section 8. Either way the limit is the same: a suggestion is put together from your own account to show to you, and that is where it stops. We do not build a profile of your reading that anyone else can look up. We do not tell a bookshop or a publisher what you read. And a suggestion is never advertising space we sold to someone else.

Tradition preferences. You can choose the traditions and content areas you want to see more often. That choice is kept on your phone. We do not store it, and the passage you are shown each day is picked on your phone rather than on our servers, so there is nothing for us to ask your consent for — the choice never reaches us at all. It is not visible to other members or to the people who run an organization, it never reaches an analytics company, and it is never used to target ads at you. Because it lives only on your phone, it does not yet follow you to a new one.

We are not claiming to be blind. The list above shows what the app does remember, including the identifiers of the materials you opened, and someone reading that list could form an impression of what you read. The difference this design makes is smaller than "we know nothing" — but it still matters: we no longer hold a statement from you about what you follow.

We do not track your location.

5. Organizations you join

You join an organization by invitation, and you see the organization's name and how much of your profile will be visible before you decide. Section 8.1 sets out the consent we ask for at that moment.

Once you are a member, the organization holds a record about you:

• your invitation, your membership and whether it is active or suspended;
• your role and what you are allowed to do there;
• which of the organization's materials you have access to;
• where you stopped in those materials;
• the bookmarks you share with the organization;
• the part of your name the organization's settings let other members see;
• your email address — invitations are sent to it, and the people who run a community need a way to reach their members.

The name setting has three levels: your username only, your username and first name, or your username and full name. The organization chooses the level, and you see it before you join.

Bookmarks are the one place your own words are visible there. A bookmark marks a spot in a recording and can carry a short title and a note. If you save it into the organization's shared list, the members who can open that recording can read your note. Keep it private if you want it kept private.

People who run an organization can also write dated notes about members, for their own records. Those notes are visible only to the administrators of that organization, and they are not shown to you in the app. You can ask us for a copy of what is written about you, and section 14 explains how.

You can leave an organization at any time, and it takes effect immediately. Leaving does not delete your QuietRoots account, and it never touches your journal. Your membership can also be suspended by the organization. While it is suspended you keep your account, but you lose access to that organization's materials until the suspension is lifted.

The terms of taking part in an organization, and any rules that organization adds, are shown to you when you join.

6. Reading is not a declaration of belief

QuietRoots holds texts and teachings from more than one tradition, side by side. Reading across them is normal here.

So we do not treat your reading as a statement about you. We do not label you a follower of anything because of what you opened, saved, or finished. Your account has no religion field and no belief field. There is nothing there for us to fill in, and nothing for anyone else to read.

We do not use anything in this Policy to build an advertising profile of your beliefs. We do not sell your data. We do not share it for cross-context behavioral advertising, which means tracking you across other apps and sites to aim ads at you. And we never feed it into decisions about credit, employment or insurance.

7. Analytics, crash reports and server logs

An app that quietly breaks on your phone helps nobody, so we measure how the app performs. What keeps that safe is a hard line: what you read never goes into it.

We send to our analytics and crash-reporting service:

• that a screen was opened or an action happened, as a count;
• the platform, the app version, and the type of device;
• a random installation identifier;
• a technical error category and a crash report when the app fails.

We do not send: the tradition you chose, the name or code of a work, a passage, a tag, a mood, an organization's name or identifier, the title of a recording, your journal, your reflections, your bookmarks, your email, your name, or your username.

Server logs. Running a service means writing down what reached the servers. Each request leaves a line that includes your IP address, the time, the app version and device type, which part of our interface was called, and whether it worked. An IP address is personal information under California law, which is why we name it here rather than hiding it under "technical data".

The line for a request can include the identifier of a text you opened. That is why these logs are short-lived: they are deleted automatically after 14 days, only the people who operate the service can read them, and they are never sent to an analytics company.

Your emails to support stay in our mailbox, so we can follow up with you and notice when a problem comes back.

8. The consents we ask for separately

We ask for consent in small, specific pieces, so that saying no to one thing does not cost you the rest of the app. Each consent is recorded on its own, and no consent replaces the Terms of Service.

8.1 Joining a particular organization

This is the wording the app shows you when you accept an invitation:

“I consent to Yesod Code LLC processing my membership, my access to materials and my activity in this organization, so the organization works, stays secure, and can let me in.

“I understand that the organization’s name, my membership, its materials and my activity there may reveal my religious or philosophical interests.

“This consent covers only this organization. Saying no does not limit anything else I do in QuietRoots.

“I consent to the processing described above for my membership in this organization.”

Withdrawing this consent means leaving the organization. We cannot keep you in a community without holding the data that makes you a member of it. You can leave at any time and it takes effect immediately, and the rest of your account is untouched.

We treat every organization as one whose name, membership, and materials may point to religious or philosophical interests. That is the default, and we do not make you argue for it.

9. Why we are allowed to use your data

Different laws use different words for this. Here is the plain version.

• To give you what you signed up for. Your account, the material you asked for, your journal and its sync, your subscription, resuming where you stopped, the suggestions the app makes to you inside QuietRoots, and your membership in an organization after you join it.
• To keep the service safe and working. Security, blocking abuse, fixing faults, and defending ourselves if there is a legal claim. This is a narrow reason, and we never stretch it into profiling what you believe.
• Because you said yes. Marketing emails, and the consent in section 8. Some information can reveal religion or belief, and the law protects that kind of information more strictly. Where it applies, your consent is what allows us to hold it, and you can take it back.
• Because the law requires it. Tax and accounting records, answers to legally binding requests, and the record of which version of our documents you accepted.

Consent here is about your data. It is not the reason QuietRoots publishes what it publishes, and your access to the library never depends on it.

10. Who else touches your data

We share the least we can, with companies that run part of the service for us and may use the data only for that:

• Apple and Google — app distribution, sign-in, and subscription payments.
• RevenueCat — tells us whether your subscription is active.
• Google Firebase — push notifications, app analytics and crash reports, within the limits in section 7.
• Cloudflare — protects and delivers our traffic, and stores the audio, images and files the app serves.
• A European data-center provider — the servers our systems run on. We name the category rather than the company: where exactly our servers live is part of how we protect them — and your data along with them.
• Resend — sends our account and organization emails, such as invitations and notices.

This list changes as the service does, and we would rather tell you the rule than just the names. Any company we add may use your data only to do the job we hired it for, and the limits in section 7 travel with it — a company that measures how the app performs still never receives what you read. So if we replace or add a tool that measures performance or collects crash reports, the promise in section 7 is what holds, not the name of the vendor. We keep this list up to date, and the effective date shown with this Policy tells you when it last changed. If a change means something genuinely new about your data, rather than a new name for the same job, we tell you before it starts.

An organization you join receives your data as described in section 5.

We may hand over data when the law binds us to it, and we will not pretend a request is binding when it is not. If the business is ever sold or transferred, this Policy travels with your data, and we tell you before anything changes for you.

11. Where your data lives

Our servers are in the United States. Files such as audio and images are stored and delivered through Cloudflare's network, which has machines around the world, so a file may be served from a machine near you.

If you are in Europe or the United Kingdom, this means your data is processed in the United States. Yesod Code LLC is a United States company, so when you use QuietRoots your information reaches us here directly. Where we use other companies to run parts of the service, our agreements with them include the data-transfer terms European regulators publish for this purpose.

United States law lets government authorities force a company here to hand over data in ways European law does not. We cannot contract that away, so we say it rather than imply otherwise. What we can do is hold less: your journal is sealed before it leaves your device, request logs are deleted after 14 days, and what you read is never sent to an analytics company.

12. How long we keep it

• Your account and profile — while your account is open.
• Your journal — for as long as you keep it. When you delete an entry, it is removed from your device at once, and the sealed copy on our servers is marked deleted and is no longer sent to any device. It is cleared out entirely when you delete your account.
• What the app remembers — while your account is open.
• Organization data — while you are a member. After you leave, the organization keeps its own record that you were once there.
• Server logs — deleted automatically after 14 days.
• Backups — we keep copies of our databases so a failure does not lose your work. Something you deleted can sit in one of those copies for up to 30 days, until that copy is replaced. We never use a backup to bring back something you deleted.
• Records the law requires — tax and accounting records, and the record of which version of our documents you accepted, kept for as long as the law says.

13. Deleting your account

You can delete your account yourself, in the app. Open your profile, go to Account, and choose Delete Account. You type your username to confirm, because this cannot be undone. You may tell us why you are leaving, and you may skip that.

When you confirm, we delete your journal entries and the encrypted key package that lets your 24 words restore your journal. We remove your name, your email, and the rest of your profile from the account record. What stays is what section 12 says stays.

One thing to do first: deleting your account does not cancel your subscription. Apple and Google run the billing, so cancel there before you delete, or you will keep being charged.

14. Your rights

Whatever law covers you, we treat these as yours:

• to know what we hold about you, where it came from, and why we have it;
• to get a copy of it, in a form you can take elsewhere;
• to correct it;
• to delete it, and to delete your account;
• to take back a consent you gave;
• to limit what we do with information that can reveal religion or belief;
• to object when we rely on keeping the service safe and working;
• to be treated no worse for asking for any of this.

Write to support@quietroots.app. We answer within 30 days. If a request is complicated, we may need longer, up to 45 more days, and we tell you before the first 30 days are up. If we say no to a request, we tell you why, and you can ask us to look again. Someone you authorize may make a request for you, if you tell us who they are.

Some of these rights come from a law that covers you specifically. If you live in California, the California Consumer Privacy Act gives you the rights to know, delete, correct, and limit the use of sensitive information. If you live in Europe or the United Kingdom, the General Data Protection Regulation gives you those rights plus the right to take your data elsewhere and the right to object. We give everyone the same treatment rather than sorting you by address.

You can also complain to a regulator: your state attorney general, your data protection authority, or whichever body covers you. Nothing in our documents forces a privacy complaint into arbitration.

15. How we protect your data

• Your journal is sealed with a key we do not hold.
• Everything that travels between your phone and our servers is encrypted in transit.
• Passwords are stored only as a scrambled fingerprint that cannot be turned back into the password.
• Inside our systems, access depends on the job someone is doing, and it is logged.

No system is perfect. If a breach affects your data, we tell you and the authorities as the law requires, and we tell you what actually happened.

16. Changes to this Policy

Each version of this Policy is published in full, in every language we support, at the same time, with its own version number and date shown in the app. When you accept, we record the version you saw. Earlier acceptances are never rewritten.

For a small wording fix, we ask nothing of you. For a change worth knowing about, we tell you once. For a change that affects your rights, we ask you to accept the new version before you continue. Even then you can still read our documents, manage your subscription, leave an organization, delete your account, sign out, and contact us.

17. Contact

Yesod Code LLC, a Wyoming limited liability company.
30 N Gould St, Suite R, Sheridan, WY 82801, United States.

Privacy questions, data requests and complaints: support@quietroots.app.