Privacy Policy
Your privacy, in plain words
Summary in plain words
This policy explains what Restore does with your information. The short version:
- What you write in Restore stays on your phone unless you choose to sign in and back it up.
- If you back up, everything is locked (encrypted) on your phone before it is uploaded. We and Google cannot read it. Only your backup key opens it.
- We do not show ads, sell your information, or use analytics or tracking tools in the app.
- We do receive the sign-in details Apple or Google gives us, and anything you choose to send us through Share Your Story.
- If you lose your backup key, no one, including us, can recover your backup.
Who we are and how to contact us
Restore is published by NorthStar Ventures (Sole Trader), New Zealand. For any privacy question, or to ask to see, correct or delete your information, write to restorewalkapp@gmail.com. Our privacy contact is the Privacy Officer, NorthStar Ventures, and we aim to reply within 10 working days.
What information Restore handles
| Information | Where it goes | Why we handle it |
|---|---|---|
| Journal entries, moods, prayers, notes, bookmarks, streaks and settings | Stays on your phone. If you turn on backup, only an encrypted copy leaves it. | To run the app |
| Photos you attach to journal entries | Stays on your phone. Photos are not uploaded to us or included in Restore’s cloud backup. | To show them in your entries |
| Speech for voice-to-text | Turned into text on your phone. The app requires on-device recognition, so audio is not sent to us or to a speech service. | To let you dictate an entry |
| Sign-in details: name, email (or Apple’s private relay address), account ID, and sign-in method | Sent to Apple or Google and to Firebase (Google) when you sign in | To create and secure your account |
| Technical sign-in data such as IP address, app ID and app version | Collected automatically by Firebase Authentication | Security and preventing abuse |
| Your encrypted backup, plus a count of items, the backup time and a random install ID | Uploaded to Google’s Firestore database in the United States | To back up and restore |
| Narration you play (prayers, lessons and devotions read aloud) | The recording (an audio file of about 1 MB, with a tiny timing file) is downloaded from Google’s Firebase Storage in the United States the first time you play it, then kept on your phone. This needs no sign-in. Google receives your IP address and basic technical details, as with any download. We do not link it to you or to your account. | To play narration without making the app very large |
| Bible chapter recordings, background videos and music or sound packs you choose to play or download | Streamed or downloaded from Google’s Firebase Storage in the United States when you play or download them. This needs no sign-in. Google receives your IP address and basic technical details, as with any download. We do not link it to you or to your account. Chapters or packs you download are kept on your phone so they play without a signal. | To play the Bible aloud, and the music and backgrounds, without making the app very large |
| A Share Your Story message, your sharing choice, and your name and email if you give them | Sent through Formspree (a US service hosted on Amazon Web Services), which emails it to our inbox | To read and reply, and to share a testimony only if you said we may |
Some checks run on your phone only, and nothing from them is sent anywhere: Restore looks for certain words in what you write to suggest Scripture, show recurring themes, and show support resources. Journal reminders are scheduled on your phone; we do not send push notifications and hold no notification address for you.
We do not collect your location, contacts, advertising identifier or biometric data. If you turn on the Face ID, Touch ID or passcode lock, your phone does the checking and the app is told only whether it worked.
Your phone’s own backup is separate from Restore’s. If you use iCloud Backup or a computer backup on an iPhone, that backup may include Restore’s data on your phone, such as journal entries and photos, and is covered by Apple’s terms rather than this policy. On Android, Restore turns off Google’s automatic device backup for the app.
What you write can be sensitive, for example your moods or a prayer about your health. Restore does not read it for us, share it or use it for anything except the features you use. It stays on your phone, and if you turn on backup, only an encrypted copy that we cannot read leaves it.
The encrypted backup and your backup key
When you back up, Restore encrypts your data on your phone before it is uploaded. The key is created on your phone and kept in its secure storage (the iOS Keychain or Android Keystore). It is never sent to us or to Google, which is why we and Google cannot read your backup.
Everything in the backup is protected, meaning your journal entries and other Restore data. Not protected: the backup’s size (a count of items), the time it was made, a random install ID, and your sign-in details. Photos, PDFs you export, and data stored on your phone itself are not part of the encrypted backup.
On a new phone you enter your backup key to unlock your backup. Restore shows you how to save the key, for example in a password manager or a note. Anywhere you save or share it is then covered by that app’s or service’s own rules. If you lose the key and your phone, we cannot recover your backup, because we never have the key.
Service providers and third parties
| Provider | What it does for Restore | What it receives |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore and Firebase Storage) | Signs you in, stores your encrypted backup in the United States, and delivers the narration, Bible chapter recordings, backgrounds and music you play or download | Sign-in details, IP address and app information, and your encrypted backup. For audio and background downloads, only your IP address and basic technical details of the download. |
| Google Sign-In | Lets you sign in with your Google account | What Google shares when you choose to sign in |
| Apple (Sign in with Apple) | Lets you sign in with your Apple ID | What you choose to share, which can be a private relay email address |
| Apple App Store and Google Play | Deliver the app and handle any purchases | Payment details. We do not see them. |
| Microsoft (Azure AI Speech) | Made the narration voices. Restore’s own prayers, lessons and devotions were turned into spoken audio ahead of time, before you ever used the app. | Only Restore’s own text. It never receives anything from you or from your phone. |
| ElevenLabs | Made the voice for The Night and The Throne of Grace (“Ash”). Restore’s own bedtime readings and prayers were turned into spoken audio ahead of time, before you ever used the app. | Only Restore’s own text. It never receives anything from you or from your phone. |
| Formspree | Delivers Share Your Story messages to us | The message, your sharing choice, and any name or email you enter |
| Spotify | Restore’s music screen shows Spotify’s own player | Whatever Spotify’s player collects, but only when you open that screen. Spotify’s privacy policy applies. |
The narration in Restore, meaning prayers, lessons and devotions read aloud, was made ahead of time from Restore’s own text using computer-generated (AI) voices from Microsoft’s Azure AI Speech service. These voices are not recordings of a real person. The recordings are stored with Google (Firebase Storage) and downloaded to your phone when you play them. The voice for The Night (bedtime readings) and The Throne of Grace is also computer-generated (AI), from ElevenLabs, and is also not a real person. The Night’s recordings are stored with Google (Firebase Storage) and downloaded to your phone when you open a night, after which that night works without signal. You do not need to sign in to download it. The Throne of Grace recordings are part of the app itself. Nothing you write is ever sent to a voice, speech or AI service.
We do not sell your personal information or share it for advertising. Each provider above has its own privacy policy that covers what it collects.
Their policies: Google, Apple, Formspree, Microsoft, ElevenLabs and Spotify.
No AI
Nothing you write or share in Restore is sent to, read by, or used to train any AI or machine-learning service. Restore does not call one. The word-matching described above, which suggests Scripture and shows support resources, runs on your phone only.
The one thing that leaves your phone on purpose is a Share Your Story message, which goes to our inbox and is read by a person. The narration voices are AI-generated, as described above, and some other audio and the opening film in Restore were also produced ahead of time with generative tools; none of that involves anything you write. See also our promise.
This website and the launch list
This website, restorewalk.com, does not use analytics, advertising or tracking cookies, and it does not use any third-party fonts or scripts to follow you around.
The site is hosted by Netlify. Like any web host, Netlify handles visitors’ IP addresses and basic technical details of each request in order to deliver the pages and protect the site from abuse. Netlify’s own privacy policy applies to that.
If you ask to be told when Restore launches, you give us your email address and, if you wish, your first name. These are held by MailerLite, a US email service we use for this one purpose. We use them only to send you a single message on the day Restore launches. It is not a newsletter, we do not share the list with anyone else, and we delete the list once the launch message has gone out. You can ask to be removed at any time with the unsubscribe link in that email or by writing to restorewalkapp@gmail.com.
Their policies: Netlify and MailerLite.
Permissions the app asks for
| Permission | Why Restore asks | Where it is used |
|---|---|---|
| Camera | To take a photo for a journal entry | On your phone only |
| Photos | To attach a photo to an entry, and, only if you turn on Copy Camera Photos to Photos, to save photos you take in Journal to your Photos app | On your phone only |
| Microphone and speech recognition | To turn your voice into text for an entry | Recognition runs on your phone. Audio is not sent to us or to a speech service. |
| Notifications and exact alarms (Android) | To deliver the Journal reminders you set, at the time you chose | Scheduled on your phone. We send no push notifications. |
| Face ID, Touch ID or passcode | To lock your Journal and My Walk if you turn the lock on | Handled by your phone. The app is told only whether unlock worked. |
| Background audio playback | To keep prayer and narration audio playing when the screen locks | On your phone only |
You can change any of these in your phone’s Settings at any time. Restore keeps working without them, but the matching feature will not.
How long we keep information and how to delete it
On your phone. Restore keeps your entries and settings until you delete them or uninstall the app. Your backup key can remain in your phone’s secure storage after you uninstall.
Narration recordings. Recordings you play are stored in Restore’s own storage on your phone so they play again without downloading. They are removed when you uninstall the app or clear its data. They contain only Restore’s own text read aloud, nothing of yours. Bible chapter recordings, backgrounds and music you download are kept the same way, and you can remove them at any time from Account settings.
In the cloud. We keep only your latest encrypted backup, because each new backup replaces the last. We keep your sign-in details while your account exists. Firebase may keep technical sign-in logs for a limited time under Google’s own policies.
Share Your Story messages. We keep them as long as we need them to reply and to run testimonies, up to 12 months. We delete them from Formspree and from our email after that. Formspree may keep technical logs for longer under its own policy.
Deleting your account. In Restore, open Account settings, then Sign In & Backup, and tap Delete Account. This permanently deletes your cloud backup and your sign-in record, and, if you signed in with Apple, ends Restore’s access to your Apple sign-in. It can’t be undone, and your backup can’t be recovered afterwards, even with your backup key. You can also write to restorewalkapp@gmail.com and we will delete your account and backup within 30 days of confirming the request comes from you. Deleting your account does not remove data stored on your phone. To remove that, delete your entries or uninstall the app. The steps are also at restorewalk.com/delete-account.
Your rights and choices
Wherever you live, you can ask us what we hold about you, ask us to correct it, or ask us to delete it, by writing to restorewalkapp@gmail.com. Most of what you write in Restore is on your phone, where you already control it. What we hold in the cloud is your encrypted backup and your sign-in details, and we cannot read the backup.
New Zealand. Under the Privacy Act 2020 you can ask for access to, and correction of, personal information we hold about you. If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner.
European Economic Area and United Kingdom. You can ask for access, correction, deletion, restriction and portability, object to processing, withdraw consent at any time, and complain to your local data-protection authority. Our legal bases are: providing the account and backup you asked for (contract), keeping sign-in secure and preventing abuse (legitimate interests), and, for Share Your Story messages, the launch list and anything else you choose to tell us, your consent, which you can withdraw at any time by writing to us. We only handle sign-in details and backups if you choose to sign in. Restore is not currently offered in the EEA or UK; this section is here for anyone who uses it from there.
California and other US states. We do not sell your personal information or share it for cross-context advertising. You can ask to review or delete your information at the contact above. Restore does not track you across other apps or websites, so “Do Not Track” signals change nothing.
Children
Restore is for people aged 13 and older. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to restorewalkapp@gmail.com and we will delete it. In some countries the age at which a person can consent to online services is higher than 13.
Security and its limits
We protect your information in three ways: Firebase connections use HTTPS, your backup is encrypted on your phone with a key we never hold, and you can lock Journal and My Walk with your phone’s Face ID, Touch ID or passcode. No system is perfectly secure. Your phone’s own security, your Apple or Google account, and wherever you save your backup key are outside our control. If a privacy breach happens that is likely to cause you serious harm, we will tell you and the regulators as the law requires.
Changes to this policy
We may update this policy as Restore changes. We will change the effective date at the top and, for changes that matter, tell you in the app before they take effect. The current version is always at restorewalk.com/privacy and inside the app under Account settings.