Verse Loop Daily — Privacy Policy

Effective: October 11, 2026 · Verse Loop Daily v1.0 (iOS) · Bundle com.tpaulshippy.verseloop

Verse Loop Daily helps you memorize English Standard Version (ESV) Bible verses with spaced repetition. There are no accounts, no analytics, no ads, no third-party SDKs, and no tracking.

Summary: data not collected

We do not collect, sell, or share personal data. Your verses and review history stay on your device unless you turn on the optional encrypted backup — which we cannot read (see below).

What is stored, and where

On your device only (by default): the verse references and texts you add, your SM-2 review schedule (ease, intervals, due dates), grades, mistake counts, and app settings (auto-sync preference). Stored in the app's local JSON file and UserDefaults. Deleted when you delete the app or use Settings → Delete All My Data.
Optional encrypted cloud backup: if auto-sync/backup runs, the app encrypts your full library on-device with AES-GCM (key derived from your random sync code via HKDF-SHA256) and uploads only the opaque ciphertext to our Cloudflare Worker. The server never sees verse text, references, or schedules and has no way to decrypt them.
ESV passage fetch: when you tap "Fetch ESV text", the app sends only the Bible reference you typed (e.g. "John 1:1") to our Worker, which forwards it to api.esv.org and returns the passage text. No identifiers are attached; responses are cached 24h to stay inside ESV quotas.

What we do NOT collect

No name, email, contacts, location, photos, identifiers for advertising, usage analytics, diagnostics, crash SDKs, or health data.
No tracking across apps or websites.

Third parties

Cloudflare (hosting): serves the Worker proxy/backup. It necessarily sees network metadata (IP address, TLS) per Cloudflare's privacy policy, but verse content is end-to-end encrypted ciphertext it cannot read.
Crossway / api.esv.org (scripture): receives only the passage reference you request, to return ESV text under Crossway's terms.
No analytics, ad networks, or other SDKs. Any future third party would be listed here and must provide equal or greater protection.

Data retention and deletion

On-device data is kept until you delete it. Cloud ciphertext snapshots persist until overwritten by a newer push or deleted.
In-app deletion (full equivalent of account deletion — there are no accounts): Settings → Delete All My Data → Delete everything removes all verses, reviews, and history on the device, deletes the encrypted cloud backup for that sync code, and rotates the sync code so the old bucket can never be re-linked.
Revoke consent / stop backup: turn off Settings → Auto-sync after changes to stop all uploads; use Export first if you want a copy of your data.
Deleting the iOS app removes on-device data; run Delete All My Data first if you also want the cloud ciphertext erased.

Data portability

Settings → Prepare JSON export gives you your full library (verses + schedule + tombstones, v2 JSON) at any time.

Children

Verse Loop Daily collects no personal data from anyone, including children, and is rated 4+.

Contact / data requests

Questions or deletion help: see Support or open an issue at github.com/tpaulshippy/verseloop/issues.

Changes

If this policy changes materially we will update this page and note it in the app release notes.