← Back

Privacy Policy

This is a translation of the German Privacy Policy (Datenschutzerklärung). In case of any discrepancy, the German version shall be the legally binding document.

Last updated: March 18, 2026

1. Data Controller

Theosis OÜ
Harju maakond, Tallinn, Kesklinna linnaosa
Registry code: 270425
Email: support@theosis-app.com

Competent data protection supervisory authority: Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn, Estonia.

2. Overview of Processing

THEOSIS is an Orthodox spiritual companion app. We process personal data exclusively within the scope of the purposes and legal bases described below.

3. Data Collected and Purposes

3.1 Registration and Authentication

Upon registration, we collect:

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Social login data is processed only on the basis of your active decision.

Provider: Authentication is handled via Supabase Auth (GoTrue), hosted in the EU (AWS Frankfurt). In case of social login, data is transmitted from Google LLC or Apple Inc. (see Section 8).

3.2 App Usage Data

During use of the App, we store the following in your user account:

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3.3 Community Features

When you use community features, the following data is processed:

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Note on AI moderation: Community posts are automatically reviewed by an AI system (Google Gemini via OpenRouter) for violations of the community guidelines. No automated decision with legal effect is made; flagged content is reviewed manually. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the safety of the community).

3.4 Payment Data

When subscribing (EUR 55/year), payment data is processed exclusively by Stripe, Inc. We only store the subscription status and Stripe Customer ID, but no payment method details.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3.5 Transactional Emails

We send you the following emails:

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3.6 Marketing Emails (Drip Campaign)

After registration, you may opt in to our welcome email series (day 1, 3, and 7 after registration). These emails contain tips on using the App and invitation codes.

Legal basis: Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time -- in the settings under "Email notifications" or via the unsubscribe link in each email.

3.7 Error Reports and Performance

For error detection, we use Sentry. Technical data such as stack traces, browser information, and (anonymized) IP addresses are transmitted. A sampling rate of 10% applies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability of the App).

3.8 Rate Limiting

To protect against abuse, we use Upstash Redis for rate limiting. IP addresses and request counters are stored for a short period.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security).

4. Cookies and Tracking

4.1 Strictly Necessary Cookies

Legal basis: Art. 6(1)(f) GDPR (legitimate interest); strictly necessary under applicable ePrivacy legislation.

4.2 Analytics and Marketing Cookies

We only deploy analytics and marketing cookies when you actively consent via our consent banner (Usercentrics):

Legal basis: Art. 6(1)(a) GDPR (consent via Usercentrics). The default consent setting is "declined" (Consent Mode v2) -- without your active consent, no tracking cookies are set.

You may withdraw your consent at any time via the cookie banner (fingerprint icon at the bottom left or in the settings).

5. Recipients and Data Processors

We share your data with the following categories of recipients:

5.1 Hosting and Infrastructure

5.2 Authentication

5.3 Communication

5.4 Payment Processing

5.5 Analytics and Marketing (with consent only)

5.6 Error Tracking

5.7 AI Services

We use AI models for various functions. Processing is carried out through the following providers:

Note: For community moderation, user-generated content is transmitted to the respective AI provider. The providers process this data exclusively for the purpose of fulfilling the request and do not use it for training their own models (API usage). For all other AI functions (translations, TTS), no personal data is transmitted.

6. Transfers to Third Countries

Some of our data processors are based in the United States. Data transfers are carried out on the basis of the EU-US Data Privacy Framework (DPF) pursuant to Art. 45(3) GDPR and/or on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

Specifically:

7. Data Retention

8. Your Rights

Under the GDPR, you have the following rights:

To exercise your rights, please write to: support@theosis-app.com

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:

Andmekaitse Inspektsioon (AKI)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee
Web: https://www.aki.ee

You may also contact the supervisory authority of the member state in which you reside or are located.

10. Account Deletion

You may delete your account at any time in the App settings, or contact support@theosis-app.com. Upon deletion, all personal data is immediately and permanently removed from 18 database tables (cascade deletion). Recovery is not possible.

11. Changes

We reserve the right to amend this Privacy Policy as needed, for example in the event of changes to our services or the legal situation. The current version is always available at this URL.