Stones

Privacy Policy

Last updated: 23 August 2026

Your prayers, journal entries, and testimonies are yours. We use them only to make the app work for you. We never sell your data, show you ads, or track you across other apps or websites.
We only collect what the app needs to function.
You can delete your account and everything in it, at any time, from inside the app — it’s gone for good.

Who is responsible for your data

Stones (“Stones”, “we”, “us”) is made by Smith & Johnson Ltd, 7 Bell Yard, London, England, WC2A 2JR. The data controller is Smith & Johnson Ltd, contactable at tj@smithjohnson.co.uk.

What we collect, and why

Account details — your email address (or the private relay address if you use Sign in with Apple and hide your email), and a display name if you add one. Used to create and secure your account so your prayers sync to your devices.
Your content — the prayers you track, notes, testimonies, journal entries and moods, categories, reminder time, and content you deliberately share in a Prayer Board. This is the app itself; it’s stored so it is there when you sit down to pray or choose to pray together.
Activity within the app — how many times you’ve prayed for something, and when, to show your prayer list, testimonies and “Year in Prayer”.
Support (a tip) — if you choose to leave a tip, the purchase is handled by Apple and our payments partner RevenueCat. A tip unlocks nothing.

We do not collect your location, contacts, photos, advertising identifiers, or analytics about how you use the app, and we do not use any third-party tracking or advertising tools.

A note on sensitive data

Because Stones is a prayer app, the content you write can reveal your religious beliefs. Under UK/EU data-protection law this is “special category” data. We only ever process it because you choose to write it and to use the app (your explicit consent), solely to provide the app to you. You can withdraw consent at any time by deleting your content or your account.

How your data is stored and protected

Your account and content are stored using Supabase (our secure cloud database and authentication provider), hosted in Zurich, Switzerland. Switzerland is recognised by the UK and EU as providing an adequate level of data protection.
Data is encrypted in transit and at rest.
Private prayers and journals are protected by per-user security rules, so they can only be accessed by that person’s signed-in account. Prayer Board content is kept separately and can be read only by signed-in people who currently belong to that invite-only board.
The app also keeps a copy on your device so it works offline.

Prayer Boards and other members

Prayer Boards are optional, small invite-only spaces. Your private prayers and journal are never copied into a board automatically. When you join a board, current members can see your display name. When you deliberately add a shared request, encouragement, update, or testimony, current members can read it.

Board invitation links contain a random invitation token, not prayer text. Links expire, can be revoked, and require a signed-in account before joining. Members can report content or people, block another member, leave a board, and delete their own shared request. Board owners can remove members and delete the board. Reports contain identifiers and a concern category only; Stones does not copy the reported prayer words into the report.

Who we share it with

We don’t sell or rent your data. We share it only with the service providers that make the app work, and only as needed:

Supabase — database, accounts, and our account-deletion function (data processor).
Apple — Sign in with Apple and processing optional tips.
RevenueCat — processing optional tips (only if you choose to tip).

Content you deliberately put in a Prayer Board is also shared with the current members of that board. It is not public or searchable.

Each acts as our processor under appropriate agreements. We may also disclose data if required by law.

How long we keep it

We keep your data for as long as you have an account. If you delete your account (Settings → Delete account), your account and all your content are permanently deleted from our systems. If you contact us to ask, we’ll help.

Your rights

Under UK/EU GDPR you have the right to: access your data; correct it; delete it (you can do this yourself in the app); export/port it; restrict or object to processing; and withdraw consent. To exercise any of these, email tj@smithjohnson.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or your local regulator.

Children

Stones is not directed at children. You must be at least 13 (or the minimum age in your country) to create an account.

Artificial intelligence

Stones does not currently use AI to read or process your prayers or journal. If we add AI features in future, we will update this policy and ask for your clear, explicit consent before any of your content is processed — and we’re committed to doing this in the most private way possible.

Changes to this policy

If we make material changes, we’ll update the date above and, where appropriate, let you know in the app.