Privacy Policy

Effective as of October 14, 2026.

This policy explains, in plain language, what data Barzel collects, what we use it for, who processes it with us and what your rights are, in compliance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018). The data controller is Fernando Tavares, contact contato@barzelapp.com.br.

1. Data we collect

Sign-up: name, username (@), email, phone number and, if you choose, a profile photo. If you sign in with Apple using a hidden email, we also ask for a contact email. The phone number and the contact email are never shown in the app or to other users.
Sign-in with Google or Apple: when you choose to sign in with one of them, we receive the name and email that the provider sends us.
Your personal content: journal notes, personal habits and your daily entries, reading plans, highlights and notes you make in the Bible, and the recommendations you keep in your Profile.
Your content in groups: check-ins, the proof photos and videos you choose to send, comments and reactions.
Prayer requests: the text you write, the duration you choose, the answer you share when the request is answered and the record of who marked Prayed on each day. This text may contain sensitive data and follows the rules in section 4.
Recommendations: the type (book, podcast, film or sermon), the link with the page preview image, the title and the note you write when you recommend something to the group or keep it for yourself.
Usage and device: simple usage events, such as the day you opened the app, read the verse or made a check-in; the platform (iPhone, Android or browser) and the app version; the date and time of your last access; your notification preferences, whether they are allowed on the device and the device's notification token.
Source of the visit: the channel through which you reached Barzel, read from the campaign parameters of the link (UTM) or from the name of the site you came from (referrer), stored in your profile when the account is created. On the presentation page, visits are counted anonymously, with only the type of visit, the channel and the day.
Website presentation page: visitors to the presentation page (www.barzelapp.com.br and its English version) are measured by the Meta Pixel, which records the visit and the clicks on the store buttons and on the web app button. This happens only on that page: the Pixel is not inside the app, nor in the web app.
What you send us: the messages sent through Report a problem and the content reports.
Apple Health (iPhone only, and only if you turn it on): when you turn on "Mark from Apple Health" for a habit, Barzel reads, on the device itself, the workouts logged in the Health app, only to mark that habit on the day of the workout. No health data leaves your iPhone: what goes to our cloud is only the habit entry, just as when you mark it by hand. You can turn it off at any time in the habit itself or in the iPhone Settings, under Health, Data Access and Devices.

We do not collect location, address book contacts or data from other apps, except for reading Apple Health workouts as described above, when you turn it on.

2. What we use it for

To operate the app: your account, your habits, your reading, your groups and syncing between devices.
To show the members of your group what belongs to the group: your name, @, profile photo and the check-ins, photos, videos, comments, prayer requests and recommendations you post in it.
To let the author of a prayer request know when a brother prays for him, and to let those who prayed know when the author shares the answer.
To send the notifications you allowed, such as the reminder for the verse and for the reading plan, and the group alerts.
To send account emails, such as the password change, and the weekly summary, which you turn off in the Profile tab, under Settings, in the Weekly summary by email option.
To understand how the app is used and where people come from, in aggregate form, in order to improve it.
To measure and target Barzel ads on Facebook and Instagram, based on visits to the website presentation page.
To review reports and keep groups safe.
To contact you about your account when necessary (which is why we ask for the phone number and, in some cases, the contact email).

3. What we do not do

We do not sell or rent your data to anyone.
We do not show ads inside the app and we do not use the data you put in the app for advertising. The only ad measurement is on the website presentation page, done by the Meta Pixel and described in item 5.
We do not store, share or use any Apple Health data for advertising.
We do not put the text of prayer requests in the content of notifications, and we do not show it outside the group where it was posted.
The personal journal is private: it is not seen by other users, by the groups or by the Barzel administration panel. It is stored in our cloud only to sync your devices, and we only access it at your request, for support.

4. Prayer requests and recommendations

Prayer requests. What you write in a prayer request may reveal sensitive personal data, such as health, religious belief or family life (LGPD, Article 5, II). That is why requests follow their own rules:

Legal basis: your consent, given specifically when you post the request (LGPD, Article 11, I). The request screen tells you that only the brothers in the group can see it and that you can ask for prayer without giving details. Write only what you want to share and do not expose details about other people, such as the name or the health problem of a relative.
Who sees it: only the members of the group where the request was posted. It does not appear in other groups, in the Today tab, in image sharing or in the weekly summary email. The text never goes in the content of notifications: the alert only says who asked for prayer and in which group.
Who prayed: when a brother marks Prayed, only the author of the request sees his name. The other members see only how many prayed.
Answered prayer: if you tell the group what happened, your account is visible only to the members of the group, and those who prayed receive an alert that there was an answer, without your account.
Access by the Barzel team: we do not read prayer requests. The team only accesses a request when it is reported, in order to review the report.
Moderation: any member can report a request or block the person who posted it, and the group owner can remove any request from the group.
Deleting and withdrawing consent: you can delete your request whenever you want. When you delete it, the text is removed and the prayers recorded on it stop being shown. Deleting the request is the way to withdraw, in the app itself, the consent given for it.
Retention: when the request is closed, by you or at the end of the duration you chose (3, 7 or 30 days), its text is deleted from our servers within 90 days.

Recommendations. Books, podcasts, films and sermons you recommend or keep:

What you recommend to the group (type, link, title and why you recommend it) is visible to the members of that group, with your name. Anyone who saves one of your recommendations keeps a copy of it in their own Profile, with the title, the link, the note and your first name. That copy belongs to the person who saved it and stays with them even if you delete the original or delete your account.
What you add under Recommendations, in your Profile, including the note, is visible only to you.
When you recommend a link, Barzel fetches the public preview image and title of that page through its own server, without sending any of your data to the site, and keeps the image address with the recommendation. The image is loaded straight from the original site, which receives the IP address of whoever sees the card on the wall or the recommendation in the Profile.
Links open outside the app, in the browser or in the corresponding app, on third party sites such as YouTube, Spotify or bookstores. These sites are not controlled by Barzel and have their own privacy policies. When the link is from YouTube, the video thumbnail is loaded from YouTube's servers, which receive the IP address of whoever sees the card on the wall.

5. Who processes the data with us

For Barzel to work, some providers process data on our behalf, as processors, solely to provide the contracted service:

Supabase: database, authentication and files. Stores your account, your content and the photos and videos from groups.
Vercel: hosting of the site and of the app in the browser. Receives the IP address and the page requests of those who visit.
Resend: sending emails. Receives your email, your name and the content of the message, such as the weekly summary and the password change.
Google and Apple: signing in to the account, when you choose one of them. They confirm your identity and send us the name and email.
Firebase Cloud Messaging (Google) and Apple Push Notification service: notifications. They receive the device's notification token and the text of each alert, which never includes the text of a prayer request.
Cloudflare R2: Bible audio. Receives the IP address and the request for the audio file when you listen to the reading.
Meta (Meta Pixel): only on the website presentation page. Receives the IP address, browser data, the page visited and the clicks on the store buttons, to measure and target Barzel ads on Facebook and Instagram. Meta also processes this data under its own privacy policy. You can limit this use in the ad settings of your Meta account or with a browser blocker.

Some of these providers store or process data on servers outside Brazil, such as in the United States. This international transfer happens only to provide the service, with providers that adopt data protection safeguards, in accordance with Article 33 of the LGPD.

Traffic is encrypted (HTTPS) and access to the database is protected by rules that limit what each account can read and change.

6. How long we keep it

For as long as your account exists, with one exception: the text of a closed prayer request is deleted within 90 days, as explained in section 4. When you delete the account (Profile tab, under Settings, "Delete my account"), the following are permanently removed: your sign-up data, including the phone number and contact email, the journal, the habits, the reading with its highlights and notes, the check-ins, the comments, the notification tokens and the usage events. The photos and videos you sent in groups are deleted from our servers within 7 days after the deletion. The groups you created are not deleted: they pass to the longest-standing member; if you were the only member, the group is deleted. If you signed in with Apple, when the deletion is done through the app we also ask Apple to revoke the authorization given to Barzel. Copies of your recommendations that other people saved in their own Profile are not removed: they keep the title, the link, the note and your first name, as explained in section 4.

7. Your rights (LGPD)

Access and correction: your profile data can be viewed and edited in the app itself.
Deletion: full deletion is available in the app, with no need to ask anyone. If you prefer, see how to delete your account.
Portability, information and withdrawal of consent: contact us at the contact email and we will respond within the time limits set by law.

8. Minors

Barzel is intended for people over 13 years of age. We do not knowingly collect data from children; if we identify an account belonging to someone under 13, it will be removed.

9. Changes

If this policy changes, the current version will always be on this page, with the date at the top, and we will notify you in the app when the change is relevant.

10. Contact

Any questions about privacy: contato@barzelapp.com.br, or reach us directly in the app, in the Profile tab, under Settings, in the Report a problem option.