Ora! Privacy Policy

This policy applies to Ora!. The global So Good Co website privacy policy applies to the public website and company-level support pages.

Sign in with Apple is required to use Ora!. Ora! does not request a person's Apple name or email address. It keeps Apple's app-specific account identifier locally to validate the credential and isolate each Apple account's device-only data. Signing in does not turn private prayer data into cloud data. Signing out immediately returns Ora! to sign-in and hides that account's local data. Signing back into the same account restores only that account's device-local data.

Private intentions, Private Chapel candles, Rosary intention and progress, Prayer Journal entries, Nightly Examen reflections, Confession preparation, and After Confession reflections remain device-only. Ora! does not upload, analyze, synchronize, or read them. They never enter CloudKit, the Cathedral, Global Prayer, or the backend. Private Chapel candles use a separate local candle store, cannot be promoted or moved into the public Cathedral, and expire 24 hours after their original lighting time.

The Cathedral is public. When a person deliberately lights a Cathedral candle, its intention text, original lighting time, and an opaque account-linked contributor identifier are stored in Apple's CloudKit public database and appear immediately. No public name or email is included. Each manual Cathedral candle expires exactly 24 hours after its original lighting time. A person may have at most three manually created Cathedral candles actively burning, may extinguish only their own candles, and cannot silently edit public intention text. Blank public intentions appear as: An intention held in silence.

Reporting an intention immediately hides its words on that reporter's device. Three reports from three distinct signed-in users hide the intention text for everyone while the candle remains visible. Blocking a contributor hides that contributor's current and future intention text on that device only. Ora! retains only the safety relationships needed to enforce distinct reports and ownership. Ordinary intentions are not sent to an AI reviewer.

Send a Candle records one private, idempotent sender-to-candle relation. The sender sees Candle Sent. and the original poster receives A Pilgrim is praying with you. At most one small companion flame appears beside a candle regardless of how many unique senders participate. Ora! exposes no sender identity, public count, badge, ranking, popularity order, or public companion history. Duplicate delivery is coalesced, and companion state expires and is deleted with the target candle.

A person may intentionally schedule one public Global Prayer intention per Eastern Ora prayer day for one upcoming prayer slot. Scheduling is not moderation or an approval queue. The intention appears once without a name in the selected prayer's noninteractive scrolling ribbon. The formal prayer keeps its natural duration, and the ribbon may begin before and continue after it until every intention in that frozen chronological snapshot has appeared once. There is no rollover or intention debt, and a person may use Leave Quietly at any time. After its appearance, the intention becomes one ordinary public Cathedral candle exactly once. Its 24-hour clock begins at the appearance time, and it does not consume one of the person's three manual candle spaces.

While the Cathedral is open, Ora! uses a separate opaque identifier for a short-lived presence heartbeat and approximate live count. It is not used to create a movement history.

A person may optionally show a coarse locality — a city, region, and country description — beside their public Pilgrim number. When this is turned on, Ora! asks Apple Location Services once, derives the locality description on the device, and never stores the coordinates or sends them anywhere. The derived locality text itself is stored in Apple's CloudKit public database and appears publicly beside that Pilgrim number. Coarse locality is off by default and never required for any prayer feature. Turning it off removes the published locality.

Delete Ora Account & Data is separate from sign out. After fresh Sign in with Apple authorization, Ora! revokes its Apple session, removes active public candles and scheduled Global Prayer submissions, removes or irreversibly detaches companion and report relationships, and erases that account's private device-only namespace on the current device after server deletion is confirmed. A deletion tombstone/version tells another device to purge that namespace before a recreated account can use it. Deleting your Ora account or the app does not cancel an App Store subscription. Manage or cancel monthly support in your Apple Account's subscription settings. Optional one-time support purchases do not recur.

Optional one-time and auto-renewing monthly support are processed by Apple through StoreKit. Ora checks Apple-verified purchase and subscription status on your device to display your support status and provide restore and manage controls. Ora does not receive your payment-card details or send support transactions to its Cathedral or Railway backend. Monthly support renews automatically unless canceled through Apple. Support unlocks nothing and provides no badge, rank, candle, priority, recognition, or spiritual distinction. Everyone receives every Ora feature, prayer, devotional, event, update, and future addition.

Prayer reminders are local notifications scheduled only after permission is granted. New accounts start with the daily invitation, all four Global Prayer reminders, Living Prayer Book, and Nightly Examen selected. A one-time setup explains the schedule and how to adjust it. You can change individual times, turn individual reminders off, or pause all Ora reminders in Settings. Saved reminder choices are preserved when updating the app. Names and private prayer text are not included in these reminders.

Special calls to prayer are a separate, optional category of remote invitations about national or global events, planned for version 1.0.1. Newly configured notification settings select this category, but registration requires the setup disclosure and Apple's notification permission. Existing accounts are not enrolled automatically: they can enable the disclosed new choice in Settings. The master Notifications switch and the category switch both control enrollment.

When enabled, Ora stores an installation identifier, Apple's push token, delivery environment, consent state, refresh and expiry dates in CloudKit. The registration is creator-private: other ordinary Ora users cannot read or enumerate it. Trusted Ora operators use it solely to deliver these invitations through Apple Push Notification service. It contains no private prayer, journal, confession, location or advertising data. A registration is eligible for delivery for up to 90 days without refresh. Delivery eligibility ending is not a guarantee that its CloudKit record is deleted at that moment. Tokens that Apple rejects as invalid are excluded from further delivery, with removal requests retried if needed.

Category off, master off, sign-out and account deletion request withdrawal. Failed withdrawals are retained locally and retried; a token-free record-ID cleanup journal can survive account deletion until withdrawal succeeds. Changing the iCloud account can delay removal until the creating account is available again. A record can remain in CloudKit after it is no longer eligible for delivery if removal has not succeeded. Offline opt-out cannot instantly reach the service, and notifications already sent cannot be recalled. Apple's Notifications settings provide system delivery controls; normal Focus rules apply. Ora does not use critical alerts. Remote messages contain only the deliberately public call to prayer and an allowlisted public app destination.

Ora! can send first-party, content-free daily use counts for five broad entry points: app, Cathedral, Library, Bulletin, and Nightstand. Each signal contains only its UTC day, signal name, app build number, expiry date, and schema version. Ora! never includes prayer text, intentions, names, locations, routine choices, detailed behavior, or advertising identifiers. A signal is sent at most once per day, expires after 35 days, is removed during account deletion, and can be disabled under Privacy & support in Settings. Ora! contains no advertising SDK and does not track people across other companies' apps or websites.

Ora! is a tool created to encourage prayer. It is not a church and is not a substitute for church, Mass, parish life, the sacraments, or spiritual direction.

For Ora! privacy or moderation questions, contact info@sogoodltd.co.