Privacy Policy

Last updated: 2 July 2026

This Privacy Policy explains how Mercy Through Mary ("we", "us", "our") collects, uses, and protects your personal information when you use our website, iOS app, and Android app (together, the "Service"). It also describes the rights you have over your information.

We built Mercy Through Mary to help you pray. We collect as little as we can, we never sell your data, and we designed our analytics to be private by default. This document is the detail behind that commitment.

This Privacy Policy is provided in English, which is its authoritative version. Where the Service is offered in other languages, those translations are for convenience only.

Who we are

Mercy Through Mary is the ministry that operates the Service. If you have any question about this policy or your data, contact us at privacy@mercythroughmary.org.

For users in the European Economic Area (EEA) or the United Kingdom, Mercy Through Mary is the data controller of your personal information.

Information we collect

Information you give us

• Account information. To create an account you provide your email address. Sign-in is passwordless — we email you a one-time code, so we never ask for or store a password. You may optionally add a display name.
• Prayer and devotional activity. When you use the Service we record the things you choose to track: prayers and rosaries you complete, your consecration journey and chosen feast day, prayer streaks and counts, and your daily reminder time.
• Community activity. If you join or create a group or a rosary circle, we store your membership, the circles or groups involved, and related activity such as scheduled meetups and events.
• Store orders. If you buy something from our store, we store your order details and status. Payment card details are handled by our payment processor, Stripe — see "How we share information" below.
• Preferences. Your chosen language and notification settings.

Information we collect automatically

• Usage analytics. We run our own first-party, cookieless analytics. We do not use advertising cookies or third-party trackers. Specifically:
• We store a random identifier in your browser's local storage (or the app's local storage) so we can count returning visits. It is not tied to your identity and you can clear it at any time by clearing site data.
• We do not set cookies, and we do not collect or store your IP address.
• We derive only a coarse location — your device's time zone — never precise location.
• We record basic technical details such as the pages or screens you view, the actions you take (for example, starting a rosary), and your operating system and device type.
• We honour Do Not Track (DNT) and Global Privacy Control (GPC) signals.
• Push notification tokens. If you enable push notifications, we store the notification token your device provides so we can send them, delivered through Firebase Cloud Messaging. (Daily prayer reminders are scheduled locally on your device and do not send any token to us.)

We do not collect your date of birth or age. See "Children's privacy" below.

How we use your information

We use your information to:

• provide and operate the Service — sign you in, save your prayers and progress, and run groups, circles, events, and the store;
• send you the reminders and notifications you have asked for;
• process and fulfil store orders;
• understand how the Service is used, in aggregate, so we can improve it;
• keep the Service secure and prevent abuse; and
• comply with our legal obligations.

Legal bases (EEA/UK users)

Where the law requires a legal basis for processing, we rely on: performance of a contract (to provide the Service you asked for), your consent (for example, push notifications, which you can withdraw at any time), our legitimate interests (to secure and improve the Service, balanced against your rights), and compliance with legal obligations.

How we share information

We do not sell your personal information, and we do not share it for advertising. We share information only with service providers who help us run the Service, and only as needed:

• Amazon Web Services (AWS) — hosting, database, authentication (Amazon Cognito), and content delivery.
• Stripe — payment processing for store purchases. When you check out, your payment is handled directly by Stripe under its own privacy policy; we receive only the order result and a customer reference.
• Firebase Cloud Messaging (Google) — delivery of push notifications, where enabled.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or in connection with a merger, acquisition, or transfer of the ministry's operations.

International transfers

We are based in the United States and our providers may process data there and in other countries. Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep information

We keep your account and devotional data for as long as your account is active. If you delete your account or ask us to, we delete or anonymise your personal information within a reasonable period, except where we must retain certain records (for example, order records for tax and accounting) to meet legal obligations. Aggregate analytics that cannot identify you may be kept indefinitely.

Your rights

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — request a copy of the information we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — ask us to delete your information.
• Portability — receive your information in a portable format.
• Objection and restriction — object to or restrict certain processing.
• Withdraw consent — withdraw consent at any time where we rely on it (for example, turning off notifications).

EEA/UK (GDPR). You have the rights listed above and the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA). California residents have the right to know what personal information we collect and how we use and disclose it, to request deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

To exercise any right, email us at privacy@mercythroughmary.org. We will respond within the time required by applicable law. We may need to verify your identity first.

Children's privacy

Mercy Through Mary is intended for a general audience and is not directed to children under 13 (or the equivalent minimum age in your country). We deliberately do not collect date of birth or age, and we do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact us at privacy@mercythroughmary.org and we will delete it.

Security

We protect your information with industry-standard measures, including encryption in transit and access controls on our systems. No method of transmission or storage is completely secure, but we work to safeguard your information and to notify you and the authorities of any breach as required by law.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after an update means you accept the revised policy.

Contact us

Questions, requests, or concerns about your privacy:

Mercy Through Mary Email: privacy@mercythroughmary.org Web: mercythroughmary.org