Privacy Policy — Jessya
1. Introduction
Jessya is a Catholic prayer app operated by Wycro Software Developers CIA. LTDA. (Quito, Ecuador). This policy explains what personal information we collect, why, who we share it with, and what rights you have. It applies to the mobile apps, to app.jessya.com and to jessya.com.
If you are in Canada, read Section 3.1 — it is written for you and covers PIPEDA, Quebec Law 25 and CASL.
2. Information We Collect
Sensitive information — please read this first
Using Jessya reveals your religious beliefs, and your prayer intentions may reveal information about your health, your family, a bereavement or other personal circumstances. Under most privacy laws this is sensitive (or "special category") information, and we treat it that way. In practice, today we collect your acceptance of this processing together with the Terms and this Policy, on a single checkbox at sign-up: we do not yet offer a separate opt-in for sensitive data, and we do not retain a timestamped consent record. We say so here rather than describe a mechanism we have not built; building it is outstanding and prioritised.
If you would rather not have this information processed at all, please do not use Jessya. You can withdraw consent at any time by deleting your account. Questions: privacy@wycro.com.
2.1 Account information
Email address, display name or nickname, and optionally a profile photo, handled through our authentication provider. You choose a public username; your email and display name are never shown to other users.
Age: the Terms of Service require a minimum age of 13, but we do not currently collect or verify your date of birth. We state that here rather than imply an age check we do not perform. If you believe someone under the minimum age holds an account, write to privacy@wycro.com and we will remove it.
2.2 Prayer and activity data
Prayer history, personal reminders, bookmarks and favourites, and progress tracking such as streaks. We use this to deliver the service, resume where you left off and show your own progress back to you. Note that this data reveals the frequency of your religious practice, which is itself sensitive by inference.
2.3 Community intentions
Prayer intentions you post, and the prayers and reactions you give to others. Anonymous mode is on by default — your name is hidden from other users unless you choose otherwise. Anonymity is not the same as invisibility: the text you post is visible to the community, so please do not include details you would not want read by strangers.
Posting anonymously does not prevent us from identifying the author internally for moderation purposes.
2.4 Audio and streaming
Playback requests are served from Google Cloud Storage. Server logs are kept for a limited period.
2.5 Device and technical information
Device model, operating system, app version, language, IP address, and crash diagnostics.
2.6 Payment information
Payments are processed by Apple, Google or RevenueCat. We never receive or store your full card number. We receive only the plan, amount, date and subscription status.
2.7 Location
We do not track your precise location. We may infer an approximate region from your IP address or device locale to select the right liturgical calendar and language.
2.8 Analytics
We use product analytics and error monitoring to understand which features are used and to find crashes. We do not sell this data, and we do not use it for advertising or for targeted profiling.
2.9 Abuse reports and moderation
If you report content, or if your content is reported, we keep a record of the report, the outcome, and an internal trust score for the account.
2.10 Use of artificial intelligence
- Content moderation: prayer intentions and other user content are screened automatically for spam, abuse and rule-breaking. This means the text of your intention is sent to a third-party AI provider (Google Gemini) located in the United States. It is not used to train third-party models.
- Translation (optional "Translate this" feature) — when you use it, the text is sent to the same provider solely to produce the translation.
- Editorial drafting — some reflections, saints' biographies and transcripts are AI-assisted and reviewed by our team before publication.
Automated decisions: automated moderation can hide an intention before a human reviews it — for example once it reaches three or more reports, or where the account's trust score is low. This can significantly affect the visibility of your content. You may always request human review by writing to abuse@wycro.com; see Section 3.1 for the additional rights that apply in Quebec.
AI output is provided "as is" and must not be treated as infallible medical, psychological, legal or doctrinal advice — see Section 5.1 of the Terms of Service.
3. Legal Compliance
Jessya complies with data-protection law in multiple jurisdictions, including:
- Canada: PIPEDA (federal), Quebec's Law 25, and CASL — see Section 3.1
- Ecuador: Ley Orgánica de Protección de Datos Personales (LOPDP) and its regulations
- European Union / EEA: the GDPR. Religious belief is special-category data (Article 9), processed only on your explicit consent
- United States: comprehensive state privacy laws, including the New Jersey Data Privacy Act and California's CCPA/CPRA
- Brazil: the LGPD
3.1 Canada — PIPEDA, Quebec Law 25 and CASL
This section applies if you reside in Canada. It supplements the rest of this policy; where they conflict, this section prevails for Canadian residents.
Who is accountable, and who to write to
The data controller is Wycro Software Developers CIA. LTDA. (Quito, Ecuador). We have designated a Privacy Officer accountable for compliance with this policy, reachable at privacy@wycro.com; their name and title are available on request, in line with Principle 1 (Accountability) of Schedule 1 to PIPEDA.
Your data is stored in the United States
Cross-border transfer notice. All of Jessya's production infrastructure — database, file storage and application servers — runs in Google Cloud's us-central1 region (Iowa, United States). Your personal information is therefore stored and processed outside Canada and, while it is there, is subject to United States law, including the possibility of lawful access by US authorities (for example under the CLOUD Act), which we may not always be able to notify you about in advance.
PIPEDA permits this transfer for processing, but we remain accountable for your information while it is with our processors, and we use contractual means to require a comparable level of protection from them. We tell you about this transfer expressly so that your consent is meaningful. If you are not comfortable with your data being processed in the United States, please do not use Jessya.
Sensitive information and express consent
Using Jessya reveals an interest in the Catholic faith, and your prayer intentions may reveal your health, your family circumstances or a bereavement. Under PIPEDA the form of consent must be proportionate to the sensitivity of the information. We acknowledge openly that our current mechanism does not yet meet that standard: acceptance is collected on a single checkbox alongside the Terms, and no consent record is retained. Building a dedicated, auditable mechanism for sensitive data is outstanding work; until then we would rather state the gap than assert a control we do not have.
Risks you should know about before consenting (an element required by the OPC's meaningful-consent guidance):
- The text of your intentions is sent to a third-party AI provider (Google Gemini, in the United States) for automated moderation.
- If you post an intention without anonymous mode, it is visible to other users. Anonymous mode is on by default.
- Your prayer history reveals how often you practise your religion, which is sensitive by inference.
Your rights under PIPEDA
- Access: you may request access to your personal information. We answer within 30 calendar days (not business days), extendable once under PIPEDA with notice to you of the extension and the reason. Access is free or at minimal cost.
- Account of disclosures to third parties: in addition to your own data, you may ask us for an account of the third parties to which we have disclosed your personal information. This right is specific to PIPEDA and we answer it within the same 30 days.
- Correction: you may require us to correct inaccurate or incomplete information.
- Withdrawal of consent: you may withdraw consent at any time, subject to legal or contractual restrictions and on reasonable notice. Please note that withdrawing consent to the processing of religious and prayer data makes it impossible to provide the service, so it is equivalent to closing your account.
- Deletion: you can delete your account and data at jessya.com/data-deletion or from the app.
- Portability: you may request an exportable copy of your data.
Automated decisions (Quebec Law 25, section 12.1)
Some moderation decisions are made automatically and can affect you significantly. If you reside in Quebec, Law 25 gives you the right to know how they work:
- Which decisions: automatically hiding an intention once it reaches three or more reports; subjecting your posts to stricter AI moderation; and, in persistent cases, limiting the reach of your account.
- What data we use: the number and type of reports received, the result of automated text analysis, and a trust score (0–100) attached to your account, which falls when your content is flagged.
- Principal factor: a score below 75 triggers AI moderation of all your posts.
- Your rights: you may ask us to tell you the score and the factors applied in your case, submit observations, and request review by a person rather than a machine, by writing to abuse@wycro.com.
Commercial electronic messages (CASL)
The prayer reminders you configure and service emails (such as the confirmation that your account was deleted) are messages you asked for, not advertising. If we ever send you a commercial message, we will do so only with your consent as required by CASL, identifying ourselves clearly and always including an unsubscribe mechanism that we action within 10 business days and that stays valid for at least 60 days. You configure and turn off prayer reminders in the app's settings; for any other kind of message you can unsubscribe from the message itself or by writing to privacy@wycro.com.
How to complain
- Write to us first at privacy@wycro.com. We will acknowledge your complaint and give you a reasoned response.
- If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca.
- If you reside in Quebec, you may also go to the Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca.
- Alberta and British Columbia also have provincial Information and Privacy Commissioners.
4. How We Share Your Data
We share the minimum necessary with processors under data-processing agreements:
- Google Cloud — hosting, database, file storage (United States)
- Google Gemini — automated content moderation and optional translation (United States)
- Authentication provider — sign-in and identity
- Analytics and error monitoring — product analytics, crash reporting
- Apple / Google / RevenueCat — payment and subscription status
- Push notification delivery — reminders you configured
Wycro will NEVER share your data with advertisers, data brokers or governments, except under a valid legal order.
4.1 International transfers
Most of our processors are located in, or process data in, the United States — our primary infrastructure runs in Google Cloud's us-central1 region. If you access Jessya from Canada, Ecuador, the EU, Brazil or another jurisdiction with cross-border transfer rules, this is a transfer of your data out of your country. Canadian residents should read the specific notice in Section 3.1.
5. Your Rights
Wherever you live, you can request access, correction, deletion, restriction, portability, and to object to processing, and you can withdraw consent.
How: write to privacy@wycro.com with your name, registered email, the specific right you are exercising, and proof of identity.
Response times: 30 days in most cases. If you write from Canada, we respond within 30 calendar days as PIPEDA requires, extendable once with a reasoned notice. Requests are free in most cases.
Supervisory authorities: Canada — the OPC (priv.gc.ca), and in Quebec the CAI (cai.gouv.qc.ca). Ecuador — the SPDP. EU — your national data protection authority. Brazil — the ANPD. United States — your state Attorney General.
6. Data Retention
We keep your personal information for as long as your account is active and you continue to use the service. When you delete your account we delete your personal records; community intentions you authored are anonymised rather than destroyed, because other people prayed for them. Anonymised intentions carry no link back to you.
We may retain limited records where the law requires it, for example transaction records for tax purposes, and records relating to abuse and moderation for as long as needed to keep the community safe.
7. Security
- In transit: TLS encryption on all connections
- At rest: encrypted storage and database
- Access: least-privilege access controls, secrets held in a managed secret store
- Monitoring: anomaly detection, alerting and regular audits
Limitations: security is never perfect. If a breach occurs that presents a risk to your data, we will notify you within 48 hours of confirming it, and the competent data protection authority within 72 hours of detection.
Canada: under PIPEDA we will report to the OPC and notify affected individuals as soon as feasible where a breach creates a real risk of significant harm, and will also notify any organisation that can help reduce that harm. Quebec residents will additionally be reported to the CAI. The 48- and 72-hour commitments above are stricter than the Canadian standard, and we keep them.
8. Cookies and Tracking
The mobile apps do not use advertising cookies or third-party ad trackers. On the web we use a session cookie to keep you signed in and a preferences cookie. We do not use cookies for advertising.
9. Changes to This Policy
We may update this policy. Material changes will be announced by email and in the app before they take effect. Quebec residents receive the separate 30-day notice described in Section 8 of the Terms of Service.
10. Contact
- Privacy questions and rights requests: privacy@wycro.com
- Moderation appeals: abuse@wycro.com
- Security issues: security@wycro.com
- Data controller: Wycro Software Developers CIA. LTDA., Quito, Ecuador
11. Acceptance
By using Jessya you confirm that you understand this policy and accept the processing of the sensitive information described in Section 2. As stated there, that acceptance is general rather than separate today — there is no dedicated opt-in for sensitive data and no timestamped consent record. If you do not accept it, please do not use Jessya.
Thank you for praying with Jessya. Your privacy is sacred.