Legio Fidelis Privacy Policy

Last updated: October 21, 2026

This policy applies to the Legio Fidelis iPhone and Android apps, operated by the publisher identified on the app's store listing. For questions about this policy, contact breviary.app@proton.me.

Legio Fidelis provides an offline prayer library. A Clerk account is required to open the app. Prayer texts, reading settings, and local alerts are stored on this device. Chapter text and reading position stay on your device. If you are signed in and open a chapter in Library, we store the work ID and section number on your profile. Other signed-in readers may see that work and section title in community and Library reader profiles. We do not store your scroll position.

Clerk manages Apple, Google, and GitHub sign-in and receives the identifier and email address each provider supplies. Supabase receives a verified Clerk user identifier to connect your account to the community database. If you previously signed in through Supabase with Apple, you can confirm that earlier account to transfer its profile and permissions to your Clerk identity. The app does not store your sign-in password. We store the display name, avatar, and short tagline you select. Profiles are visible to other signed-in readers in this version. Your display name, avatar, tagline and last opened Library section can appear in active presence and qualifying Library reader lists. There is no Hidden/Visible switch. Opening the updated app replaces an earlier Hidden preference for that account. Library readership is described below. Your email address is not shown to other readers.

While you are signed in and the app is open in the foreground, we send your selected monastery, prayer room, live-office participation and recent presence time to Supabase, with your profile visible to other signed-in readers. Presence also includes an Active or Idle indicator calculated on your device. Only that coarse status is sent; touch histories and precise interaction timestamps are not uploaded. Idle readers remain included in room and prayer-map totals. Existing block and suspension filters apply. Signing out or leaving the foreground stops your presence refresh; entries expire after about 75 seconds without a refresh. If a refresh cannot reach the server, the app shows a connection error, and an earlier entry can remain until its last heartbeat expires. Presence is associated with your account inside Supabase. Database rows may remain until replaced or your account is deleted. Your monastery and prayer-room participation may indicate religious practice, which is sensitive information. Readers using older versions may still appear anonymously until they update; this version does not recover or reveal their redacted identity fields.

For the lobby and prayer maps, Legio Fidelis estimates a country from your sign-in network. If the native session has no country, it requests a country response from the same Clerk domain, with no sign-in token or cookies, and retains only the country code. Only that code is sent to Supabase; the community database stores no IP address, city or precise coordinates, and no GPS access is requested. The estimate may reflect a VPN or network exit point. Every present reader with a detected country contributes to combined country totals, including Idle readers. Country inclusion is part of map presence and has no separate opt-out. The server returns only country counts for each map, with a caller-relative indicator for your own country; the maps do not show names or individual profile markers. Existing blocks, suspensions and presence expiry apply. The lobby map includes readers throughout the app, and the prayer map includes readers in any open office regardless of scheduled live times. Country markers use fixed reference points, never a person's location within a country. A coarse prayer-presence heartbeat does not disclose an archived office's date or hour. The world outline and country reference points are bundled on the device.

Library reader counts are based on cumulative active time spent within a work's actual text. For a signed-in reader, the app keeps a random installation identifier and sends per-account, per-work reading-time totals to Supabase, capped at 20 minutes per work per device. This timer does not upload touch histories, individual session histories or scroll positions. Once the minimum reading time is reached, the work's reader count and membership can persist after you leave the work or close the app; they are not indicators that you are currently online. Qualifying profiles may appear in the work's reader list, with avatar, username, bio and last opened Library work and chapter. Reader profiles remain visible after you leave the app; signing out stops active presence but does not remove a previously recorded Library membership. Existing block and suspension filters apply. Deleting your account removes its Library reading-progress and readership records from the active community database.

Your all-time Prayer Rate can appear on your social profile and in Office and Library reader lists. The app sends an account-level aggregate to Supabase: your rate start date, completed-office total, snapshot date and time zone. Other signed-in readers receive only the resulting percentage. Individual office records and daily prayer history remain on your device. The rate counts eight possible offices per day from signup (or an account-specific adjusted start date) through the current local day. An installation with less local history does not lower a previously synced completed-office total for the same start date. Block and suspension filters apply; older anonymous profiles do not expose a rate. Deleting your account also deletes its synced prayer-rate total. Like prayer-room participation, this percentage can indicate religious practice.

The chat box is currently hidden in the app. Previously posted messages, together with their room and posting time, may remain in the database until removed by moderation or account deletion. If you report a profile or previously reported a chat message, or block a reader, we store the report or block to operate the safety features. Profile reports include a snapshot of the reported username and bio. Reports can be read by assigned moderators, who may hide a message, dismiss a profile report, or temporarily suspend community access. Blocking hides the other reader's presence from you, and yours from them.

Prayer settings, chosen alerts, and language preferences are stored on your device. The app uses the phone's native notification and alarm services for the reminders you choose. The app has no advertising SDK and does not use community data for advertising or cross-app tracking. Clerk processes Apple, Google, and GitHub sign-in; Supabase processes community data and, if you restore an earlier Apple profile, verifies that earlier sign-in once. The providers process connection data needed to run those services.

Optional automatic prayer translations use Google ML Kit. Translation runs on your device: prayer text and the translated results are not sent to Google. Downloaded language models and cached translations stay on the device; translation caches are excluded from device backup. Google receives model-download requests and SDK diagnostic data, including device/app information, per-installation identifiers, configured languages, performance metrics, and error events, for service operation, diagnostics, and usage analytics. The app does not use these data for advertising or cross-app tracking. See Google's ML Kit terms and privacy information: https://developers.google.com/ml-kit/terms.

In the app's Profile tab, you can change your username, avatar, and bio, unblock readers, sign out, or choose Delete account and community data. Deletion removes your active account record and associated profile, messages, reports, blocks, gathering presence, and moderation assignments from the community database. It does not remove the offline prayer library from your phone. You can also revoke connected accounts in Apple, Google, or GitHub account settings. Service-provider backups and operational records may follow the provider's separate retention practices.

For privacy requests or reports, contact breviary.app@proton.me.