Privacy Policy

1. Who we are

Selah is operated by Selah (operated by Pirow Engelbrecht), the responsible party for your personal information under POPIA. You can reach us at support@selah.quest.

Our registered business address is: Available on request — write to support@selah.quest
Registration: Available on request — write to support@selah.quest

2. Our Information Officer

In line with POPIA s.55, our Information Officer is responsible for ensuring this policy is followed. You can contact them at support@selah.quest for any privacy-related question, complaint, or data subject request.

3. What we collect and why

Account information

• Email address and display name — to create and identify your account. Provided by you, by Google when you sign in with Google, or by Apple when you sign in with Apple. If you choose Apple's “Hide My Email”, we receive a private relay address, never your own.
• Profile photo — only if you add one.
• Authentication tokens — kept by our auth provider (Supabase) so you stay signed in. In the app, your session is stored encrypted on your device, its key held in the iOS Keychain.

Reading and study activity

• Chapters read, verses studied, game answers and results, journeys joined — to keep your progress and journeys, and to choose what to review next.
• Journal entries, notes, highlights, and bookmarks — kept for you alone. No other reader can see them, and they are never sent to an AI model.
• Friends — the friend requests you send and accept, and the people you block.
• Reports — if you report someone, what you reported and why, so we can review it.

Your faith is special personal information

POPIA treats information about your religious beliefs as special personal information (section 26). Using a Bible app, and what you write in your journal and notes, can reveal your beliefs, so we treat all of your reading and study activity as special personal information. We process it with your consent, which you give when you create your account and use these features (section 27(1)(a)), and only to provide Selah to you. We never sell it, never use it for advertising, never send your journal or notes to an AI model, and never show it to anyone unless you choose to. You can withdraw your consent at any time by deleting your account.

What other readers see

• Your display name and profile photo can be seen by other readers, for example when they search for friends.
• Your profile page (your reading and study progress) can be opened only by you and your friends.
• If you block someone, any friendship between you ends, neither of you can find the other or open the other's profile, and they are not told.

Payment information

• Only on the website, and only for paid plans. Selah is currently free, and the iPhone app has no purchases.
• We do not store your card details. Payment is processed by PayFast (Pty) Ltd, a registered South African payment service provider that holds PCI DSS Level 1 certification.
• We retain the transaction reference, amount, currency, status, and PayFast token so that we can manage your subscription, issue refunds, and meet our tax obligations.

Device and usage information

• IP address, browser or device model, operating system and app version, timestamps — for security, fraud prevention, and to diagnose problems.
• Time zone — so your day begins and ends where you are.
• How you use Selah — the screens you open and the features you use, recorded by PostHog against your account ID, so we can see what helps readers. We do not track you across other companies' apps or websites, and Selah shows no advertising.
• Error reports — when something fails, a report of what went wrong (with your account ID and device model) goes to PostHog so we can fix it.

Notifications

• Push token — if you allow notifications, Apple (in the app) or your browser (on the website) gives us a token so we can send the reminders you turn on and tell you about friend requests. Turn them off in Selah's settings or in your device's settings. The token is deleted with your account.

The app does not use your location, contacts, or camera. It asks for your photo library only when you choose a profile photo.

Email lifecycle

• We send transactional emails (welcome, trial reminders, cancellation confirmations, security alerts). These are essential to the service.
• Any non-essential marketing email is opt-in only and you can unsubscribe at any time.

4. Lawful basis for processing

POPIA s.11 lets us process your information when one of these applies:

• Contract — we process your account, subscription, and payment data to provide the Selah service you signed up for.
• Consent — for non-essential things like marketing emails or social features. You can withdraw consent at any time.
• Consent, for special personal information — see “Your faith is special personal information” above.
• Legitimate interest — for security, fraud prevention, and improving the product. Always balanced against your rights.
• Legal obligation — to meet our tax, accounting, and other South African legal duties.

5. Who else sees your data (operators)

We share personal information only with operators who help us run the service. Each operator is bound by an agreement to use your data only for the purposes we direct.

We never sell your personal information, and we do not share it with advertisers.

6. Cross-border transfers

Some of our operators are outside South Africa, as listed above. POPIA s.72 lets us transfer your information across borders when the receiving country has substantially similar data protection laws, when you consent, or when the transfer is necessary to perform our contract with you. All operators we use meet at least one of these conditions.

7. How long we keep your information

• Account data — for as long as your account is active. When you delete your account (in the app: Profile → Settings → Delete my account), you have 30 days to change your mind and cancel the deletion in the same place. After 30 days we erase your data and your login, and if you signed in with Apple, we revoke Selah's access to your Apple ID.
• Analytics and error reports — kept by PostHog against your account ID only. Email us and we will delete them.
• Payment and tax records — at least 5 years after the transaction, as required by the South African Revenue Service.
• Audit logs — at least 12 months, for security and dispute resolution.
• Backups — automatically expire on a rolling 30-day cycle.

8. Your rights under POPIA

You have the right to:

• Access — request a copy of the personal information we hold about you. In the app, use Profile → Settings → Export my data; on the website, Profile → Privacy → Export my data; or email us.
• Correction — fix anything that is inaccurate or out of date. Most of this you can do yourself in Profile.
• Deletion — delete your account and your personal information. In the app, use Profile → Settings → Delete my account; on the website, Profile → Privacy → Delete my account; or email us. Some records (for example, tax invoices) must be kept by law.
• Object to processing that relies on consent or legitimate interest.
• Withdraw consent at any time for anything we asked your permission for.
• Lodge a complaint with the Information Regulator if you believe we have mishandled your information: inforegulator.org.za

9. Security

We use industry-standard measures to protect your information: HTTPS in transit, encryption at rest in our database, scoped database access policies, hashed and salted credentials, and regular dependency updates. In the app, your sign-in session is encrypted on your device. No system is perfectly secure. If a data breach occurs that materially affects you, we will notify you and the Information Regulator within a reasonable time, as required by POPIA s.22.

10. Children

Selah is intended for users aged 18 and over. If you are between 13 and 17, you may only use Selah with the consent of a parent or guardian, who agrees to these terms on your behalf. We do not knowingly collect personal information from children under 13. If you believe a child has registered an account, please contact us and we will delete the account promptly.

11. Changes to this policy

We will post any material changes to this page and update the “last updated” date. For significant changes we will also notify you by email.

12. Contact us

Privacy and data questions: support@selah.quest
General support: support@selah.quest