Privacy & Data Notice

We keep this simple and honest. This notice explains what data Rooted holds, why, and the rights you have under the EU General Data Protection Regulation (GDPR), the EU Data Act (Regulation (EU) 2023/2854) and the EU AI Act (Regulation (EU) 2024/1689).

Last updated: 26 August 2026

Who is responsible for your data

Rooted is the controller of the personal data you provide when you use this application. If you have any question about this notice or wish to exercise your rights, you can reach us through the app.

The information we collect

  • Account data: your name, email address and an encrypted password.
  • Content you create: journal entries, study notes, guided-study answers, reading progress and any materials you upload.
  • AI conversations: the messages you send to, and receive from, the AI study companion.
  • Preferences: your chosen translations, theme and reading settings.
  • Anonymous analytics (consent-based): aggregate page-view statistics, collected only if you accept analytics.

Why we use it, and our legal bases

  • To provide the service — keeping you signed in and saving your work (performance of a contract).
  • To operate AI features you choose to use (performance of a contract).
  • To improve Rooted through anonymous analytics (your consent, which you may withdraw at any time).
  • To keep the service secure and prevent abuse (our legitimate interest).

We do not sell your personal data, and we do not use it for advertising.

Cookies & analytics consent

We use only essential cookies needed to keep you signed in. Anonymous usage analytics are collected only after you accept them in the consent banner. You can change or withdraw your choice at any time from Settings → Account & privacy → Cookie & analytics preferences, which reopens the consent banner.

Artificial intelligence & transparency (EU AI Act)

Rooted includes an AI study companion. In line with the EU AI Act’s transparency obligations, we make the following clear:

  • When you use the companion, you are interacting with an AI system, not a person. This is labelled in the interface, and AI responses are marked as AI-generated.
  • AI output may be inaccurate, incomplete or biased. It is a study aid, not a source of pastoral, theological, legal, medical or other professional advice — always verify with Scripture and trusted sources.
  • The AI does not make automated decisions that produce legal or similarly significant effects about you. You remain in control and exercise your own judgement (human oversight).
  • To generate a reply, the messages and any materials you attach to a conversation are sent to our AI processing provider solely to produce that response; they are not used to train third-party models.

Who we share data with

We share data only with service providers that help us run Rooted — secure cloud hosting and storage, and the AI provider that powers the study companion — acting on our instructions as processors. They may process data outside the EU/EEA; where they do, appropriate safeguards such as the European Commission’s Standard Contractual Clauses are used.

How long we keep it

We keep your account and the content you create for as long as your account is active. When you delete your account, your personal data is erased from our live systems promptly (see “Your rights” below). Anonymous analytics cannot be linked back to you and may be retained in aggregate.

Your rights & the EU Data Act

Under the GDPR and the EU Data Act you have the right to:

  • Access the personal data we hold about you.
  • Portability — receive your data in a structured, machine-readable format. Use Settings → Account & privacy → Export your data to download a complete JSON copy at any time.
  • Rectification — correct inaccurate data (edit your profile and content in the app).
  • Erasure — permanently delete your account and all associated data via Settings → Account & privacy → Delete account.
  • Restriction and objection to certain processing.
  • Withdraw consent for analytics at any time, without affecting the service.

Security

Passwords are stored using strong one-way encryption, and access to your private study data requires authentication. We take reasonable technical and organisational measures to protect your information.

Children

Rooted is not directed at children under 16, and we do not knowingly collect their personal data.

Complaints

If you are in the EU/EEA and believe your data rights have been infringed, you have the right to lodge a complaint with your local data protection supervisory authority.

Changes to this notice

We may update this notice from time to time. When we make material changes, we will update the date at the top of this page.