Privacy policy

1. Who looks after your data

The controller of the personal data processed on Biblim (biblim.com) is Reinaldo Teixeira, an individual based in Brazil, who is also the person in charge of data protection (data protection officer, or “encarregado”, under Article 41 of the LGPD). Contact: contact.biblim@gmail.com.

This policy explains in plain language what data we process, why, and what your rights are under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

2. Summary

You can read the free episodes without an account. If you sign in, with Google or an email code, we keep only what your account needs to work. We don't sell data or show ads. We use PostHog, a product analytics tool, to understand how the site is used (see sections 3 and 6).

3. Data we collect

When you create an account and use Biblim, we process:

• Data from Google, when you sign in: your name, email, profile photo and Google account ID, plus the technical sign-in data Google provides, used only to authenticate you.
• Email code sign-in: the email address you enter, the name you choose (optional) and a single-use 6-digit code, stored only as a hash and valid for 10 minutes. To prevent abuse, we keep a count of attempts per IP address for a few minutes. If the email already has an account, including one created with Google, you sign in to that same account.
• Profile data you edit: display name, preferred language and, if you choose, your child's age range (a broad range, such as 7–9).
• Session data: a session cookie and, stored with the session for security, your IP address and user agent (browser and operating system).
• Subscription: plan, status (active, canceled, etc.), renewal or access-end date and the Stripe customer and subscription identifiers. We never receive or store card details.
• Technical access data: our hosting provider processes data such as IP addresses and access logs to deliver the site and protect it from abuse.
• Usage data (analytics, via PostHog): pages and episodes opened, clicks and actions on the site (such as viewing the subscription screen or starting sign-in), browser and device, referring site and campaign parameters (utm), approximate location derived from your IP address, and subscription start and cancellation events (plan, currency and amount). If you are signed in, these events are linked to your account's internal identifier, never to your email or name.
• Answers to the pre-subscription questionnaire (analytics, via PostHog): the kids' age range (4–6, 7–9, 10–12 or 13+), daily screen time, whether they already know the Bible stories, and whether you tapped the reading commitment. These answers are sent without your email.
• WhatsApp (optional): if you enter a number on the payment screen, it is stored only with your account. We never use it to send messages, and it is never sent to usage analytics.
• Session recording (PostHog): some visits, about 1 in 10, are recorded anonymously so we can see how the site is used and improve it. A recording shows the screen and movement on the page, but form fields and personal data, such as your email, are masked. Sign-in, email code, payment and profile screens are never recorded.
• New-release emails (optional): if you tick this option at sign-in or in your profile, we store your choice, when you made or withdrew it, and a random code used in the unsubscribe link.

Account data is stored in Cloudflare D1, Cloudflare's database service.

4. How we use it and legal bases

• Creating and maintaining your account, signing you in and unlocking the content you have access to: performance of a contract (LGPD Art. 7, V).
• Showing the site in your language and personalizing recommendations: performance of a contract; for the optional child age range, the parent's consent, which you can withdraw at any time by clearing that field in your profile.
• Protecting your account and the service from fraud and abuse (session data, IP address and user agent): legitimate interest (Art. 7, IX).
• Understanding how Biblim is used and improving it (usage data): legitimate interest (Art. 7, IX).
• Processing subscription payments and meeting legal obligations: performance of a contract and compliance with a legal obligation (Art. 7, II).
• Emailing you when a new story or episode comes out: only with your consent (Art. 7, I), which you can withdraw at any time through the unsubscribe link in every email or in your profile.
• Replying to your messages and requests.

We don't use your data for advertising or for automated decisions that affect you.

5. Children

Accounts must be created and managed by an adult (18 or over), such as a parent or guardian. Children use Biblim under that adult's supervision.

We don't knowingly collect personal data directly from children. The optional child age range is only a broad range provided by the parent (no name, photo or date of birth of the child) and is used only to personalize recommendations.

We always handle this data in the child's best interest, as required by Article 14 of the LGPD and Brazil's Child and Adolescent Statute (ECA). If we learn that we have received a child's data without a parent's involvement, we will delete it. Parents can ask us to delete data at any time.

6. Cookies and local storage

We use essential sign-in and session cookies, which keep you securely signed in. We don't use advertising cookies.

For usage analytics, PostHog keeps a random identifier and its settings in a cookie and in your browser's local storage. If your browser sends the Do Not Track signal, it sends no analytics events. This data is removed when you clear site data.

In your browser's local storage (localStorage) we keep your theme preference (light or dark) and the last episode you opened in each story, to show your progress and the Continue button. This data stays on your device, is never sent to us, and is removed when you clear site data.

7. Who we share data with

We share data only with the providers the service needs to work:

• Google: our sign-in provider. When you sign in with Google, the use of your Google account is also governed by Google's privacy policy.
• Cloudflare, Inc.: hosting, content delivery network (CDN) and the database where data is stored.
• Stripe: processes subscription payments and handles card details directly. We share your name, email and an internal account identifier with Stripe. Biblim never stores card numbers.
• PostHog, Inc.: our product analytics tool, which receives the usage data described in section 3.
• Resend (Plus Five Five, Inc., United States): sends on our behalf, as a processor, the sign-in codes you ask for, a single welcome email when you create your account and the new-release emails, the latter only to people who consented. It receives your email address, your name, your language and the content of the message.
• Public authorities: only when required by law or a court order.

We don't sell or rent your personal data.

8. International transfers

Cloudflare, Google, PostHog and Resend may process and store data on servers outside Brazil, such as in the United States. These transfers take place under the cases allowed by Article 33 of the LGPD, for example when needed to perform our contract with you, and we aim to use providers that offer adequate data protection.

9. How long we keep data

We keep your data while your account is active. If you ask us to delete your account, we will delete your data within a reasonable period, except for data we must keep to meet legal obligations, for example financial records.

Sessions expire automatically, and technical access logs are kept only as long as needed for security and operation of the service.

10. Security

We use encrypted connections (HTTPS), protected session cookies and restricted access to data. No system is completely secure, but we work to protect your information and, in the event of a significant security incident, we will notify those affected and the ANPD as required by law.

11. Your rights

Under Article 18 of the LGPD, you may ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• portability of your data to another provider;
• deletion of data processed based on your consent, and deletion of your account;
• information about who we share your data with;
• information about your option not to consent and its consequences;
• withdrawal of consent.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

12. How to exercise your rights

Email contact.biblim@gmail.com, ideally from your account's email address, and tell us which right you want to exercise. We may ask for information to confirm your identity. We aim to reply within 15 days.

You can also change your display name, language, child age range and new-release emails directly on your profile page.

13. Changes to this policy

We may update this policy. The last-updated date appears at the top of this page, and significant changes will be announced on the site.

14. Contact and data protection officer

Data protection officer (encarregado): Reinaldo Teixeira. Email: contact.biblim@gmail.com.