Privacy

Reading and search

The website remembers whether it has shown the optional app hint on this browser. This preference stays on your device and is cleared with Erase All Local Data.

Patri Bible requires no account. By default, your Local profile, passage references, highlights, saves, folders, reading places, display preferences and other Reader State stay in the current browser or app. You can export a personal backup file and import it on another device without an online service. Exports contain personal records and references, not Scripture text. Web Exact search runs in the current translation in the browser; its query is not sent to a search service. Native iPhone Search uses bundled Pocket locally, online and offline.

New approved Scripture downloads are available in the United States and require connectivity. Downloaded verified Scripture and local Exact search remain available offline in your browser and on iPhone. The browser retains signed editions and its Reader shell in local CacheStorage when storage is available; online Search requires connectivity.

Online Search is primary on the Web Reader. Deliberately submitting a reference, words, phrase, or question sends the query, selected edition and approved release, optional book or Testament filter, and pagination cursor through Patri Bible's Cloudflare Worker to the first-party PatriSearch service. Compatible prepared Pocket is the backup for a new query when the connection fails, a finite request timeout expires, or the service explicitly becomes unavailable. Later pages stay on their original engine; an unavailable online continuation requires an explicit restart. Pocket queries on web and iPhone are not sent to another service and do not carry online storage consent.

Offline Search preparation explicitly downloads the compatible KJV, WEB and BSB Search pack, approved reading resources and Reader shell into this browser. It displays download progress and can be cancelled or removed. Readiness is verified against the approved pack and shell. Browser storage can be denied, evicted or cleared; the browser may remove resources after a successful preparation. Preparation does not save your queries. Other editions keep their independent reading and Exact behavior.

PatriSearch 1.0.0 uses its own Scripture index and local query encoding across approved KJV, BSB, and WEB. Search makes no outside model calls. Each displayed passage is independently verified against the selected approved edition. PatriSearch uses the connection address transiently for United States access and abuse prevention. Search queries are not placed in browser history or Reader State. PatriAI answers are not available; Search returns Scripture rather than generated answers.

Patri Bible has no Reader-usage analytics, advertising or cross-app tracking.

Optional private profiles

Where online profiles are available, signing in through WorkOS AuthKit is optional. Production signup requires an email address and offers optional first and last name. WorkOS processes the account and sign-in information you provide, including any supplied name. AuthKit also derives sign-in and active-user statistics from account-linked authentication events. Patri Bible sends no Scripture, Search queries or local profile to AuthKit. A separate profile join requires your choice of local, online or merged activity and confirmation before private synchronization starts. After confirmation, encrypted personal changes may synchronize when online; signing out stops account requests on this device. Your reading position and downloaded editions stay local. Each display setting is synchronized only if you choose it.

The private profile service stores your chosen username, account identifiers, encrypted profile snapshots and readable account-linked sync metadata: document and key identifiers, revisions, ciphertext hashes, byte and chunk counts, and commit receipts. Key identifiers are not decryption keys. Byte and chunk counts measure encrypted storage. Account and deletion services also retain session identifiers, authentication/session/deletion times, deletion receipt hashes and progress. Server sign-in tokens stay in private server custody. The profile service receives no recovery key, readable personal profile or Scripture text. Complete encrypted conflict copies remain available for review. Keep the recovery file separately: signing in cannot recover a lost encryption key. Local-only reading has no stable online Reader identifier; an optional online profile has an account identifier and private username. It creates no public profile or directory.

Search storage

By default, PatriSearch does not retain raw queries, results, answers, citations, feedback, IP addresses, or a Reader identity. Default technical records contain a random operation ID and timestamp, operation type, latency, consent and training flags, and service, edition, artifact-release, index, and model versions. These records have 30-day retention and are used for service reliability and diagnostics, without a stable Reader or device identifier.

The Web Reader offers an optional Search storage checkbox: “Optional: allow saving my online searches and results for 30 days to improve Search.” It is unchecked by default. Only checking it sends explicit capture consent. PatriData may then retain the submitted online query, returned passages and citations, release/model versions, and timing for 30 days. This choice stays only in the open Search panel and applies to later online searches and result pages until unchecked. Unchecking stops future capture; previously consented records expire under the retention policy. Captured data is not linked to a Reader identity or automatically approved for model training.

Pocket keeps queries only in the active Search session and sends no capture consent. The native iPhone Search flow has no raw-storage consent control and keeps no online query history. Submitting a query alone is not consent to raw storage.

Delivery and diagnostics

Cloudflare transiently processes ordinary connection and country information for delivery, United States gating, security, and abuse prevention, including PatriSearch requests. Request-level logs are disabled and not retained. Only non-identifying aggregate operational measures, including request counts, latency, token use, cost, and validation totals, may remain for at most 90 days.

On iPhone, Apple platform diagnostics are available to Patri Bible only under the Reader’s operating-system diagnostic-sharing choice. Patri Bible adds no Scripture, Reader State, custom breadcrumb, or stable identity payload. Patri Bible-controlled raw Operational Diagnostics expire within 30 days.

Support email

A support email, its sender address and message, and any attachment the Reader deliberately adds are received only when the Reader sends them. They are used only for that support, privacy, or deletion case and are not linked to reading activity. No support evidence is uploaded automatically.

Purelymail stores new support correspondence and processes replies sent as support@patribible.com. Earlier correspondence may remain in a private Gmail inbox hosted by Google; Cloudflare Email Routing and SMTP2GO handled that earlier mail. These providers may retain limited routing logs or backups under their own policies.

When a case is finished, we delete its conversation from the active inbox and remove it from Trash within 30 days. For earlier mail, Gmail Trash removes it automatically within 30 days unless we permanently delete it sooner. After a verified early deletion request, we remove the conversation from the active inbox and Trash, including any earlier Gmail copy, within 30 days and confirm.

Your choices

Use Exact search when you want a query to stay local. Native iPhone Search also stays local through Pocket. Leave the optional Web Search storage checkbox unchecked to prevent online raw capture, or uncheck it to stop future capture. Erasing local data does not delete server-side Search records; those records expire under the retention policy. Erase All Local Data removes Reader State and your Local profile from the current app or browser. On iPhone, uninstalling the app also removes this data. On the web, browser-data controls or storage eviction can remove IndexedDB Reader State, your Local profile and cached offline Scripture; private browsing may limit persistence. Erase All Local Data also clears downloaded browser editions, prepared Pocket Search and the offline Reader shell while retaining authenticated lifecycle authority. Export a profile backup before removing local data. Previously exported files remain where you saved them. Without an online profile, local profile data is not uploaded or synchronized. An acknowledged in-app erase also removes owned account credentials and recovery keys from the device. If account cleanup cannot be confirmed before erasure, erase reports failure and keeps local records. It does not remove optional privately synchronized profiles or their retained encrypted copies.

Where online profiles are available, use You → Online profile → Delete online account to delete the provider account and associated server profile, username and sessions. Reauthenticate the same account and explicitly confirm the request. The app shows pending cleanup until it can confirm completion. Account deletion preserves local Reader records, recovery keys and unsynced changes on this device; it is separate from sign-out and Erase All Local Data.

To request early deletion of deliberately sent support email, write to support@patribible.com from the sender address.