Privacy Policy

Summary in plain English

• We only collect what we need: what you give us (your message when you ask a question, your account details when you sign in, your card information when you make a payment) plus basic security records that protect the site from abuse.
• We don't sell or share your personal data with anyone for advertising. Ever.
• We don't send newsletters or marketing email.
• You can delete your account and its data yourself, instantly, from your profile page — or email us and we'll do it within 30 days.

1. Who we are

HonestApologist is an independent Christian apologetics ministry operated as a sole proprietorship by the site owner ("we", "us", "our"). We are the data controller for the information described in this policy.

Site: honestapologist.com
Contact: contact@honestapologist.com

2. What information we collect

We only collect what we actually need to run the site. Specifically:

• Former newsletter sign-ups. We no longer run a newsletter and no longer collect email addresses for one. If you signed up before it was discontinued, we hold the email address, optional first name, topics and frequency you gave, the sign-up date, and a one-way fingerprint of your IP address. We send nothing to that list. We keep it only until we delete it, and you can ask us to remove your entry at any time.
• Questions and prayer requests. What you wrote, your name and email if you provided them, and a hashed IP address. If you check the consent box, a selected question (with our answer) or prayer request may be published on the site without your name.
• Donations and store purchases. Your name, email, billing address (when shipping is needed), the items you bought, and the amount. Card numbers go directly to Stripe — we never see them or store them. Donations are voluntary support payments to an independent sole proprietorship. They are not tax-deductible charitable contributions unless we state otherwise in writing.
• Reader accounts. If you sign in to bookmark, comment, or react, your email address (via Google sign-in through Firebase Authentication), your display name, and your activity on the site. If you use My Study, the notes, highlights, and saved pages you create are stored on our server so they follow you between devices — they are private to your account and nobody else can read them. Your profile photo (from Google, or one you upload) is stored too. Comments and reactions you post on published questions and prayers appear publicly with your display name and photo. Comments and reactions on articles are stored only in your own browser.
• Honest Prayer & Apologetics (Android app). The app shows the same prayers and articles as this site. Signing in is optional; if you do (with Google, through Firebase Authentication), we store your account ID and email, and, so your progress follows you between devices, the prayers you save, the plan days you complete, and the days you prayed. Prayer requests sent from the app are handled exactly like requests sent from the website (above). Downloaded recordings, your reminder time, and your settings stay on your device and are never sent to us. You can delete your account and its synced data at any time in the app (Settings → Delete my account) or on your profile page.
• Sign-in security log. When you're signed in, we record when you use the site, your country, your browser type (for example "Chrome on Windows"), and a one-way fingerprint of your network made from your IP address with a secret key — it can't be turned back into the address, and we never store the address itself. We use this only to protect the site and its readers from abuse (for example, to spot one person running many accounts, or to block a network that sends threats). The activity log is deleted after 30 days; the account summary is deleted with your account.
• Restrictions for abuse. If your account or network is restricted for abuse, a record of the restriction is kept even if you delete your account, so it can't be used to get around it.
• Server logs. Cloudflare automatically records each request your browser makes to our site (IP address, user agent, response code, timestamp). We use this only for security and abuse prevention. Cloudflare retains these per their privacy policy.

We do not collect: your phone number, your physical location beyond what's in a billing address, your contact list, your browsing history outside our site, or anything from cookies that track you across other sites.

3. How we use your information

• To respond to your questions or prayer requests.
• To process and fulfill your donations or orders.
• To run and secure the site (block spam, prevent fraud, fix bugs).
• To comply with legal obligations (financial records for donations and orders, lawful subpoenas).

We do not use your information for advertising, profiling, or automated decisions that legally affect you.

4. Who we share it with

We share information only with the service providers we need to run the site. Each is bound by their own contract and privacy policy:

• Cloudflare — hosts the site, our forms, and our database (Workers + Durable Objects). All site traffic flows through Cloudflare. Privacy policy.
• Resend — the email service our discontinued newsletter used. We no longer send email through it. Privacy policy.
• Stripe — handles all card payments. Receives your name, email, billing address, and card details. Privacy policy.
• Firebase (Google) and Google Identity Services — handle reader sign-in. When you sign in, your browser contacts Google's sign-in servers, which receive your IP address, and Firebase receives your email and authentication tokens. Privacy policy.
• Cloudflare Turnstile — checks forms for bots; receives your IP address and browser signals.
• YouTube (privacy-enhanced mode) and Vimeo — only when you view a page with an embedded video.
• OpenStreetMap — map tiles on the interactive maps, requested by your browser (so they receive your IP address).
• eBible.org and the Internet Archive (archive.org) — only when you press play in the Audio Bible: the public-domain recordings stream from them, so they receive your IP address.
• Crossref — the text of a search on our Study page (up to 200 characters) is sent to find journal articles; nothing that identifies you.
• Google Cloud Text-to-Speech — only the text of published articles, to create the "Listen" audio; never anything you write.
• Google (Gemini) — the site owner's writing and drafting tools run on Gemini. Only the owner's own drafts and already-published article titles and summaries are sent. Nothing you write — questions, prayer requests, comments, or notes — is ever sent to an AI service. Privacy policy.
• OpenAI — a fallback for the same owner-only drafting tools when Gemini is unavailable. Same rule: no reader-submitted content and no personal data are sent. Privacy policy.

One thing worth stating plainly, because people ask: if you use the Community / friends feature, other signed-in readers can find you by typing your exact email address, and will see your display name. They cannot browse or download a list of members, and your address is never shown to people who are not already connected to you.

We never sell your personal data. We never share it with advertisers, data brokers, or marketing partners. The only other situations where we might disclose information are: (a) to comply with a valid legal request, (b) to protect against fraud or abuse of the site, or (c) if HonestApologist is ever transferred to another operator, in which case we will notify subscribers in advance.

5. Cookies and similar technology

HonestApologist does not use advertising or tracking cookies. The only cookies and local-storage items we set are:

• Strictly necessary: sign-in session token (when you log in), language preference, font-size preference, and similar essentials. These can't be turned off without breaking the site.
• Cloudflare security: Cloudflare may set short-lived cookies (e.g. __cf_bm) to distinguish humans from bots. See their privacy policy.

We do not use Google Analytics, Facebook Pixel, or any advertising or profiling SDK, and we set no tracking cookies of our own.

We do use Cloudflare Web Analytics to count page views. We mention it here rather than bury it, because it is a third party: it records the page visited, the referring page, the browser type, and the IP address of the request. It is cookie-less — it cannot follow you between sites or build a profile of you — and it is switched off entirely for visitors in the EU, the wider EEA, the UK and Switzerland. More about it.

6. How long we keep it

• Former newsletter sign-ups: until we delete the list. You can ask us to remove your entry any time (see "Your rights").
• Questions and prayer requests: until you ask us to delete them or we remove them.
• Donations and orders: 7 years, to meet US business tax and financial-recordkeeping requirements. Payment details are kept by Stripe under their retention policy. If you delete your account or ask us to erase your data, your name, email and address are removed from order records; the items, amounts and dates stay for our accounts.
• Reader account data: until you delete your account.
• Prayer app progress: until you delete your account.
• Sign-in security log: 30 days.
• Backups: the site's database, including account data, is backed up nightly. Backup copies are deleted on a rolling schedule within 12 months, so anything you delete disappears from backups within that time.
• Server logs: per Cloudflare's retention policy (typically 30 days for analytics-level logs).

7. How we protect it

• HTTPS across the entire site, with HSTS, a strict Content-Security-Policy, and other modern security headers.
• Admin access is gated by Cloudflare Access (a one-time sign-in code plus an explicit email allowlist).
• Passwords are never stored by us — sign-in goes through Google (Firebase Auth) and never touches our servers.
• Card numbers are never stored by us — they go straight to Stripe via their secure JavaScript SDK.
• API keys and secrets are stored only as Cloudflare Worker secrets, never in source code.
• IP addresses on form submissions are hashed together with a secret key before storage, so the stored value cannot be turned back into an address — not by us, and not by anyone who obtained the data.
• We do not keep raw IP addresses of signed-in readers.

We will notify you and any required regulator within 72 hours if we discover a personal-data breach, in line with GDPR Art. 33–34 and equivalent obligations under LFPDPPP and US state laws.

8. Your privacy rights

Wherever you live, you can:

• Unsubscribe from the old newsletter list with the link in any email you received from it, or by writing to contact@honestapologist.com.
• Access the personal data we hold about you.
• Correct any information that is wrong.
• Delete all of it. Use Delete my account on your profile page to do it instantly, or email us and we'll do it within 30 days, unless we're legally required to keep some part (donation records, etc.).
• Object to certain uses, such as processing for marketing.
• Receive a copy of your data in a portable format (JSON or CSV).

To exercise any of these, email contact@honestapologist.com from the address you used on the site. We may ask one follow-up question to confirm it's really you.

9. For visitors in the EU / UK (GDPR / UK GDPR)

HonestApologist is the data controller. Our lawful bases for processing are:

• Consent (Art. 6(1)(a)) for optional account features and any optional cookies. You can withdraw consent at any time without affecting earlier processing.
• Contract (Art. 6(1)(b)) for processing donations, orders, and account features you signed up for.
• Legitimate interest (Art. 6(1)(f)) for site security, fraud prevention, and basic server logs. You may object to processing under this basis at any time.
• Legal obligation (Art. 6(1)(c)) for retaining donation and order records to meet business tax and financial-recordkeeping rules.

You have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office. In each EU country there is a national authority — see edpb.europa.eu.

We do not transfer personal data outside the EEA / UK except as needed to use the service providers listed above. Each of those providers has its own GDPR safeguards (Standard Contractual Clauses or equivalent).

10. Para visitantes en México (Aviso de Privacidad — LFPDPPP)

Esta sección cumple con la Ley Federal de Protección de Datos Personales en Posesión de los Particulares.

Responsable. HonestApologist (operado como ministerio independiente). Contacto: contact@honestapologist.com.

Datos personales recabados. Los descritos en la sección 2 anterior: correo electrónico, nombre opcional, mensaje (en preguntas u oraciones), información de pago (procesada por Stripe), y datos de inicio de sesión (procesados por Firebase).

Finalidades del tratamiento. Las descritas en la sección 3: responder mensajes, procesar donaciones y compras, asegurar el sitio, y cumplir con obligaciones legales.

Transferencias. Compartimos datos únicamente con los proveedores de servicios listados en la sección 4. No vendemos ni transferimos sus datos a terceros con fines comerciales.

Derechos ARCO. Usted tiene derecho a:

• Acceso: conocer qué datos tenemos sobre usted.
• Rectificación: corregir datos incorrectos.
• Cancelación: solicitar la eliminación de sus datos.
• Oposición: oponerse a usos específicos.

También puede revocar su consentimiento o limitar el uso o divulgación de sus datos en cualquier momento. Para ejercer cualquiera de estos derechos, escriba a contact@honestapologist.com desde la dirección que usó en el sitio. Responderemos dentro de los 20 días hábiles que establece la LFPDPPP.

Si considera que su derecho a la protección de datos personales ha sido vulnerado, puede acudir al Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).

11. For California residents (CCPA / CPRA)

If you live in California, you have the right to:

• Know what personal information we collect, use, disclose, and (for completeness) "sell" or "share" — though we do not sell or share your personal information for advertising.
• Delete personal information we collected from you, with limited exceptions.
• Correct inaccurate personal information.
• Opt out of any "sale" or "share" of personal information. (Again — we don't.)
• Non-discrimination for exercising your rights.

To make any of these requests, email contact@honestapologist.com. We will respond within 45 days.

12. Children

HonestApologist is not directed at children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

13. Changes to this policy

If we change this policy in a way that materially affects how we use your information, we'll post a notice at the top of this page for at least 30 days. The "Last updated" date at the top of this page always reflects the current version.

14. How to contact us

For any privacy-related question or to exercise any right described above:

Email: contact@honestapologist.com
Web: honestapologist.com

If you want a written reply by mail, please include a return address in your message and we will respond using the contact channel you specify.