Privacy Policy

10scrolls (“10scrolls”, “we”, “us”) is a Bible reading app at 10scrolls.com, operated by T-Graph Cloud Corporation, a corporation organised in the Republic of the Philippines, which acts as the personal information controller. This policy explains what personal data we process, why, and the rights you have. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and the issuances of the National Privacy Commission, and we apply comparable protections for users in the European Union/UK (GDPR) and California (CCPA/CPRA).

1. Data we collect

• Account data: your email address, the name you choose, and a securely hashed password (we never see your password).
• Sign-in with Google or Facebook (SSO): if you choose it, the provider shares your name, email address and profile picture with us. We do not receive your contacts, posts or provider password.
• Content you create: notes, Scroll Marks, prayers, blessings you send, and your reading streak.
• Settings: preferences such as translation, theme, reminder time and time zone.
• Push subscriptions: a browser push endpoint, only if you turn on daily verse notifications.
• First-party analytics: anonymous usage events with device type and country only. We do not store your IP address and we use no third-party advertising trackers. You can opt out at any time in Settings.
• Billing (when Plus is offered): subscription status. Card details are handled by the payment provider or app store; we never see or store them.

Without an account, your reading progress stays in your browser on your device.

2. Why we use it (purposes and legal basis)

• To create and secure your account and sign you in (performance of our agreement).
• To sync your notes, marks, streaks and settings across devices (agreement).
• To send the notifications and reminders you asked for (consent; withdraw anytime).
• To deliver blessings you choose to share (agreement).
• To understand which features help people read and to keep the service reliable (legitimate interest, using anonymous data you can opt out of).
• To process subscriptions and comply with legal obligations.

We do not sell or rent your personal data, and we do not use it for advertising.

3. Service providers (processors)

• Supabase — database, authentication and storage.
• Vercel — website hosting and delivery.
• Stripe — payments, when paid plans launch (and Apple/Google app stores if you subscribe through them).
• Google / Facebook — only if you choose to sign in with them.
• AI provider — when you request an AI verse explanation, only the chosen passage is sent; your notes are not.

These providers act on our instructions under data-processing terms. Some are located outside the Philippines; where data is transferred abroad we rely on contractual safeguards so it receives protection comparable to the Data Privacy Act.

4. Retention

We keep account data and content for as long as your account is active. When you delete your account, your profile, streak, notes, Scroll Marks, blessings, settings and push subscriptions are deleted immediately from our live database and purged from backups within 30 days. Anonymous analytics are kept up to 24 months. Billing records are kept as long as tax and accounting law requires.

5. Your rights

Under the Data Privacy Act you have the right to be informed, to object, to access, to rectify, to erasure or blocking, to data portability, to damages, and to file a complaint. GDPR and CCPA users have equivalent rights, including to know, delete and correct, and not to be discriminated against for exercising them.

• Access and correction: view and edit your name, photo and settings in Profile and Settings, or email us for a copy of your data.
• Deletion: go to Settings › Delete account. This is immediate and permanent.
• Withdraw consent: turn off notifications or analytics in Settings.
• Complaints: you may contact us, or the National Privacy Commission of the Philippines (privacy.gov.ph), or your local data protection authority.

6. Security

Data is encrypted in transit (HTTPS) and at rest, access is protected by row-level security so each account can only read its own data, and staff access is limited to what is needed. If a personal data breach is likely to put you at risk, we will notify you and the National Privacy Commission as the law requires.

7. Children

10scrolls is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

8. Contact and Data Protection Officer

T-Graph Cloud Corporation, Philippines. Email: privacy@10scrolls.com. Data Protection Officer: [DPO name to be designated], reachable at the same address.

9. Changes

If we change this policy we will update the version and effective date above and record it in the revision history below. Material changes will be announced in the app.