Castitas legal notice

Privacy Policy

Last updated: October 12, 2026

This notice describes the privacy practices of Castitas version 1.1.

This Privacy Notice for Rodrigo Aboim Pereira (doing business as Castitas) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

Questions or Concerns?

Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.

If you still have any questions or concerns, please contact us at support@aboim.xyz.

Summary of Key Points

This summary provides key points from our Privacy Notice, but you can find more details about any of these topics by using the table of contents below.

Table of Contents

  1. What Information Do We Collect?
  2. How Do We Process Your Information?
  3. What Legal Bases Do We Rely On to Process Your Personal Information?
  4. When and With Whom Do We Share Your Personal Information?
  5. How Do We Handle Your Social Logins?
  6. Is Your Information Transferred Internationally?
  7. How Long Do We Keep Your Information?
  8. How Do We Keep Your Information Safe?
  9. What Are Your Privacy Rights?
  10. Controls for Do-Not-Track Features
  11. Do United States Residents Have Specific Privacy Rights?
  12. Do Other Regions Have Specific Privacy Rights?
  13. Sensitive Self-Reflection Information
  14. Do We Make Updates to This Notice?
  15. How Can You Contact Us About This Notice?
  16. How Can You Review, Update, or Delete the Data We Collect From You?

1. WHAT INFORMATION DO WE COLLECT?

Personal Information You Disclose to Us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you:

Personal Information Provided by You

The personal information we collect may include:

Sensitive Information

When necessary, with your consent or as otherwise permitted by applicable law, we may process the following categories of sensitive information:

Payment Data

We process subscription status, product identifiers, transaction identifiers, purchase and expiration timestamps, purchase amounts and currency when supplied, and sandbox or production environment information. We do not collect your payment-card number or card security code.

Payments are processed by Apple. Superwall presents paywalls and helps manage subscription access:

Payments and subscriptions are processed through Apple's App Store in-app purchase system. We do not collect or store full debit or credit card numbers.

Social Media Login Data

Castitas supports Sign in with Apple, Google sign-in, and email authentication. We receive the account identifier, email address, and name when made available by the chosen provider. We do not request a friends list or store a phone number in your Castitas profile. Authentication providers may separately process login information, including a phone number used with that provider, account settings, identifiers, and IP-based security information under their own policies. Supabase manages authentication and account/profile records; Apple provider tokens may be stored securely to support account deletion and token revocation.

Application Data

Some app features use system permissions. Product analytics and technical diagnostics described below are collected automatically and do not depend on granting notification, photo, or Screen Time permission.

Mobile Device Access

We may request access to:

You may change these permissions through your device settings.

Mobile Device Data

We may automatically collect:

Notifications

If you enable notifications, Castitas schedules local prayer, formation, and risk-window reminders. You can disable notifications in iOS Settings. We record the permission result and the type of reminder opened, without sending its personal content as an analytics property.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Profile Photos and App Protection

A profile photo you choose is uploaded to private Supabase Storage for your account. We do not access your photo library for unrelated purposes. Apple Screen Time frameworks apply your app/category/website selections on your device. Those selections and their opaque tokens are not sent to PostHog.

Information Automatically Collected

In Short: Some information, such as your IP address and device characteristics, is collected automatically when you use our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information may include:

Log and Usage Data

This may include:

Device Data

We may collect information about your:

This data may include:

Product Usage Analytics: PostHog

Castitas uses PostHog to understand how onboarding, sign-in, formation features, app protection, reminders, and subscription access work. The app automatically sends selected usage events, including onboarding progression, authentication results, permission outcomes, protection changes made through onboarding or Settings, notification opens, prayer unlocks, daily formation and mortification activity, weekly review completion, rule-of-life updates, paywall displays, purchase attempts, and restore outcomes. Our backend sends confirmed subscription lifecycle events after verifying the provider webhook.

Events may contain a generated installation identifier before sign-in, an account identifier after sign-in, feature entry point, onboarding step information, protection status, standardized failure category, app language, device and operating-system metadata, and subscription product, environment, trial, refund, amount, or currency information when supplied. These identifiers allow activity to be linked to an account or device.

PostHog identification uses your account identifier and authentication provider. Information collected by an earlier app version remains subject to the retention and deletion practices described in this notice.

Quiz answers, personal reasons, prayer content, relapse triggers and feelings, detailed progress, and app-protection selections are stored on your device. Analytics event properties contain selected action and technical metadata rather than the content of those reflections or selections.

Technical diagnostics include standardized failure categories, operational logs about app startup and authentication, and app or device configuration information. Our infrastructure providers also process connection and security metadata, including IP addresses and approximate location.

Usage analytics are collected automatically. You can contact us through the privacy-request process to exercise applicable rights.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services; communicate with you; provide security and fraud prevention; and comply with law.

We process your personal information for purposes including:

In Short: We process personal information only when we have a valid legal basis under applicable law.

If You Are Located in the EU or UK

We may rely on the following legal bases:

Where permitted by applicable law, legitimate interests may include:

Different processing purposes may require different legal bases. Sensitive information, including information that reveals religious beliefs or a person's sex life, is subject to additional legal conditions. General product-improvement interests do not by themselves establish an exception for sensitive information. This notice describes our practices; it does not treat using the app or reading this notice as explicit consent.

If You Are Located in Canada

We may process your information based on:

Examples include:

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations and with specific third parties.

Vendors, Consultants, and Other Third Parties

We may share your data with third-party providers that perform services on our behalf.

Third Parties We May Share Information With

PurposeThird Party
Third-party account connectionsGoogle Account, Apple Account
Cloud computing servicesSupabase
Functionality and infrastructure optimizationSupabase
Invoice and billingApple App Store / In-App Purchases
User account registration and authenticationSupabase, Sign in with Apple, Google Sign-In
Paywall presentation and subscription accessSuperwall
Mobile product usage analytics, confirmed subscription events, and technical diagnosticsPostHog (EU Cloud), PostHog Privacy Policy

Selected prayer, formation, and practice usage signals can reveal sensitive information about religious practices. We share those signals with PostHog for the analytics purposes described above. We do not sell personal information or use it for cross-context behavioral advertising.

Business Transfers

We may share or transfer your information during mergers, sales, financing, or acquisitions.

5. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you sign in with Apple or Google, we receive information needed to create and maintain your account.

The profile information we receive may include:

We use this information only for purposes described in this Privacy Notice.

We do not control how third-party social media providers use your information. Please review their privacy notices separately.

6. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Your information may be transferred to and processed in countries other than your own.

Our Supabase project is hosted in the United States. The current PostHog project uses EU Cloud infrastructure in the European Union. Other providers and support operations may process information in countries where they operate. EU analytics hosting does not mean all Castitas data stays in the EU.

If you are located in the EEA, UK, or Switzerland, we will take appropriate safeguards to protect your information, including using European Commission Standard Contractual Clauses where applicable.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as necessary for the purposes described in this Privacy Notice unless otherwise required by law.

When we no longer have a legitimate business need to process your information, we will:

Account/profile information is retained while your account exists, subject to required legal, security, fraud-prevention, transaction, or provider obligations. Analytics and diagnostic information is retained only while needed for the stated purposes, subject to applicable legal obligations and provider storage and deletion processes.

Verified account deletion records a durable request to remove the associated PostHog person and linked event history. Provider deletion is asynchronous, and failed requests are retried. Minimal identifiers and cleanup status are retained to finish and verify deletion, handle delayed deliveries, and support follow-up cleanup. Completed cleanup-job records are removed after 30 days; unresolved jobs remain until addressed. Information that cannot be connected to an account, and legally required records, may be handled separately through the privacy-request process.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use technical and organizational safeguards to protect your personal information.

Despite our efforts, no internet transmission or storage technology can be guaranteed to be completely secure.

You should only access the Services in a secure environment.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your location, you may have rights regarding your personal information.

These rights may include:

Withdrawing Consent

Where processing relies on consent, you may withdraw it at any time by contacting us. You may also exercise applicable rights to object to or restrict processing.

App Privacy Choices

In Settings, you can turn off Share feature usage counts to prevent optional daily support-feature count contributions and clear any pending counts. This setting applies to those counts. The account-linked usage analytics and technical diagnostics described in Section 1 continue to be processed separately. You can also contact us to exercise applicable privacy rights.

Account Information

You may:

Account deletion removes the cloud account, profile, and avatar and queues deletion of account-linked PostHog usage history. It also clears pending feature counts and turns off the feature-count sharing preference on your device. Analytics deletion may finish later in the background. Signing out resets the local analytics identity but does not erase earlier events. History that has not been linked to an account may not be identifiable from that account alone.

Your local progress and app-protection settings remain on the device after account deletion. Uninstall the app to remove its local app data. Account deletion does not cancel an App Store subscription; manage or cancel subscriptions through Apple. Required legal, security, transaction, or provider records may be retained separately.

For questions about your privacy rights, email: support@aboim.xyz

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and mobile operating systems include Do-Not-Track ("DNT") settings.

Currently, there is no uniform standard for recognizing or implementing DNT signals, so we do not respond to DNT signals at this time.

If standards change in the future, we may update this Privacy Notice accordingly.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Residents of certain US states may have specific rights regarding their personal information.

Categories of Personal Information We Collect

CategoryExamplesCollected
A. IdentifiersName, email address, account name, IP addressYES
B. California Customer Records InformationAccount contact information; we do not request employment history or full payment-card informationYES
C. Protected Classification CharacteristicsAge-at-first-exposure answers provided in onboarding and stored on your deviceYES
D. Commercial InformationSubscription status, product and transaction metadata, amounts/currency when suppliedYES
E. Biometric InformationFingerprints and voiceprintsNO
F. Internet or Similar Network ActivityApp feature interactions and usage events; not external browsing historyYES
G. Geolocation DataApproximate location inferred from IP address; not GPS trackingYES
H. Audio, Electronic, Sensory InformationVoluntarily uploaded profile photosYES
I. Professional or Employment InformationJob title and work historyNO
J. Education InformationStudent recordsNO
K. Inferences Drawn from Collected InformationFormation preferences derived locally and feature-use measurementsYES
L. Sensitive Personal InformationReligious/sexual-habit reflections stored on your device, prayer and practice usage signals, and authentication informationYES

Sensitive reflections personalize the support you request on your device, while selected feature-use signals help improve the service. We do not use this information for targeted advertising or to infer characteristics for unrelated purposes.

Sources of Personal Information

See Section 1: "What Information Do We Collect?"

How We Use and Share Personal Information

See Section 2: "How Do We Process Your Information?"

Categories Disclosed for Business Purposes

Depending on the feature used, information disclosed to service providers for the purposes in Section 4 includes:

Your Rights

You may have rights including:

Additional rights may apply depending on your state of residence.

How to Exercise Your Rights

You may contact us by:

Request Verification

We may verify your identity before processing your request.

Appeals

If we deny your request, you may appeal by emailing support@aboim.xyz.

California "Shine The Light" Law

California residents may request information regarding disclosures for direct marketing purposes once per year free of charge.

12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

Australia and New Zealand

We process personal information under:

You may request access to or correction of your personal information by contacting us.

You may also file complaints with:

13. SENSITIVE SELF-REFLECTION INFORMATION

The app may ask you to provide sensitive self-reflection information, including:

This information is used to personalize your app experience.

Quiz answers, personal reasons, prayer content, relapse triggers and feelings, and detailed progress are stored on your device to provide the support and formation features you request. Separately, selected events about prayer unlocks, formation and mortification activity, weekly reviews, and rule-of-life updates are sent to PostHog. Those usage signals can reveal religious practices even when the content of your reflections remains on your device.

Account deletion does not clear local progress or protection settings. You can remove local app data by uninstalling the app, or use a specific reset setting where the app provides one. Cloud-account deletion and provider analytics deletion are separate from local data removal.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We may update this Privacy Notice to remain compliant with applicable laws.

If material changes are made, we may notify you through:

We encourage you to review this Privacy Notice regularly.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments, contact us at:

Rodrigo Aboim Pereira
Rua da Crasta
Sao Pedro do Sul, Viseu 3660-666
Portugal

Email: support@aboim.xyz

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on your location and applicable laws, you may have the right to:

To submit a request, visit:

www.castitas.online/data-request