JOMATS FZCO

Privacy Policy

Effective and last updated: October 28, 2026.

This policy covers HolyNote on iOS and Android. Your personal library stays on your device unless you request online processing, such as creating an AI note or Scripture study. Separate technical, subscription, and measurement information is processed as described below; the integrations differ between platforms.

1. Who we are

HolyNote and its related services (together, “HolyNote” or the “Service”) are provided by JOMATS FZCO, company number DSO-FZCO-14516, at Dubai Silicon Oasis, DDP, Building A2, Dubai, United Arab Emirates (“we”, “us”, or “our”). JOMATS FZCO is the controller of personal data described in this policy.

For privacy questions or requests, email support@holynote.app and include “HolyNote Privacy” in the subject line, or use the details on our Support page.

2. Information stored on your device

HolyNote stores the following information locally so the app can work:

• notes, folders, transcripts, generated summaries, Scripture studies, flashcards, and reflections;
• recorded or imported audio and any images you attach to a note;
• Bible chat history, highlights, personal verse notes, reading position, and display preferences;
• Today completion, streak progress, onboarding choices, and app settings;
• technical installation/session identifiers, delivery receipts, and temporary retry queues used by the measurement integrations described below.

This local information is not automatically synced to a HolyNote account. You can delete notes and conversations inside the app. Removing the app or erasing its data generally removes local information. On iOS, copies may remain in device backups controlled by you or Apple. Android app backup and device transfer are disabled. Deleting local data does not automatically delete records held by our service providers.

3. Information processed online

HolyNote does not need your name, email, contact list, precise location, or Apple or Google account credentials to provide its current core features. Purchases and store sign-in are handled by the relevant app store, not by entering your store password into HolyNote.

4. Camera, microphone, photos, and notifications

We request device permission only when needed for a feature you choose:

• Microphone: to record a sermon or other audio you choose to capture.
• Camera: to scan a Bible passage or add a photo to a note.
• Photo library or Files: to select an image or audio file you choose to import.
• Notifications: for optional reminders or completion prompts you enable.

You can change these permissions in your device's Settings on iOS or Android. Denying a permission affects only the related feature.

5. AI processing and sensitive content

HolyNote uses OpenAI API services to transcribe audio and generate requested notes, studies, and answers. We configure supported Responses API requests with storage disabled. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. OpenAI may retain API content in abuse-monitoring logs for up to 30 days unless a different approved retention control applies or longer retention is legally required. See OpenAI’s API privacy information.

Sermons, prayer requests, religious beliefs, names, voices, and personal stories can be sensitive. Avoid including information you do not have the right to share. AI output may be inaccurate or incomplete; verify Scripture wording and important conclusions before relying on or sharing them.

6. Service providers

Depending on the app version and the features you use, we may use the following processors:

• OpenAI — audio transcription and generation of requested AI notes, studies, and answers.
• Apple — App Store distribution, payments, subscription management, device permissions, and optional notification services.
• Google Play — Android distribution, payments, and subscription management. See Google’s Privacy Policy.
• Adapty — subscription status, paywall delivery, purchase analytics, and a pseudonymous app profile. Collection of the Apple advertising identifier (IDFA) remains disabled in our iOS configuration. In iOS versions with a configured native Meta integration, Adapty IP-address collection is enabled; otherwise this iOS collection is disabled. Adapty may process purchase history, app-instance or other device identifiers, device model, operating system, language, and paywall interactions. The app can associate Meta's app-instance identifier and other configured measurement identifiers with the Adapty profile. See Adapty’s End-Users Privacy Policy.
• AppsFlyer (iOS) — installation attribution and measurement of selected app or subscription events. Depending on configuration and consent, it may process an AppsFlyer identifier, IP address and inferred approximate location, device and app information, install source, and event data. See AppsFlyer’s Privacy Policy.
• Meta (iOS) — native installation, activation, advertising and subscription measurement. When this integration is present and configured, Meta receives a pseudonymous SDK app-instance identifier, connection IP address, app/device technical information, event times, and available automatically detected StoreKit purchase metadata. Configured subscription events can also reach Meta's separate web-measurement channel through Adapty and AppsFlyer. Our native client does not manually duplicate financial lifecycle events into AppsFlyer. See Meta’s Privacy Policy.
• Jomlink / HolyAttribution (our first-party service) — operated by us at jomlink.shanovo.app to collect app/link measurement records, compare acquisition information, and diagnose delivery and attribution differences. It receives the categories described in section 7. It is separate from our AI-processing service and is not a second native purchase-event sender to Meta.
• Amplitude (iOS) — product analytics, including technical onboarding steps and completion, navigation, permission outcomes, paywall interactions, feature-operation outcomes and engagement timing. It receives a randomly generated app-installation identifier, session and event times, app and device technical information, language, and configured subscription events forwarded by Adapty. The app passes the Amplitude identifiers to Adapty to associate these lifecycle events with product usage. See Amplitude’s Privacy Notice; Amplitude processes our end-user analytics data on our behalf.
• AppsFlyer (Android) — install and session attribution, campaign measurement, and fraud prevention. It may process a pseudonymous AppsFlyer app-instance identifier, IP address and inferred approximate location, device and app technical information, launch timing, install-referrer and campaign information. Its identifier and limited attribution fields are passed to Adapty. Configured Meta partner sharing is enabled for installation and attribution measurement; AppsFlyer-to-Meta in-app event postbacks are disabled. See AppsFlyer’s Privacy Policy.
• Meta (Android) — installation and app-event measurement, advertising attribution, campaign optimization, and subscription measurement. Meta receives the Facebook SDK app-instance identifier, app and device technical information, event times, selected interaction events, and subscription events forwarded by Adapty. Network requests also expose connection information such as IP addresses to the receiving provider. See Meta’s Privacy Policy.
• Google Firebase Crashlytics (Android, optional) — crash and reliability diagnostics when you enable “Crash reports.” Data can include installation identifiers, app and device versions, operating-system information, crash stack traces, and diagnostic metadata. Google Analytics is not enabled in this integration. See Firebase’s Privacy and Security information.
• GitHub Pages — hosts this public policy and support website and may process standard web request data under GitHub’s policies.

We do not intentionally send the content of your sermons, prayers, Scripture scans, notes, Bible passages or references, YouTube links, or AI questions to Adapty, AppsFlyer, Amplitude, Meta, Firebase, or Jomlink. HolyNote uses the same pseudonymous installation identifier as the Adapty customer identifier so our server can verify Premium access; the signed credential itself is not sent to these analytics providers. The separate random Amplitude installation identifier is not your name, email, Apple account, or advertising identifier. Terms such as “anonymous ID” in an SDK do not mean that the related records are unidentifiable: identifiers and timestamps can associate information with an app installation or profile. Providers may act as processors or independent controllers depending on their service and applicable terms.

7. Analytics, attribution, and tracking

HolyNote does not show third-party ads or sell personal data. We use the measurement integrations described here to understand acquisition, product use, subscriptions, and advertising performance. The prepared iOS configuration does not collect Apple’s advertising identifier (IDFA) and does not display an App Tracking Transparency (ATT) prompt. This describes those technical controls; it is not a claim that every use of other identifiers or device/network information falls outside Apple's definition of tracking. A privacy policy or the absence of IDFA does not replace any required permission.

iOS native Meta measurement: in versions containing the configured integration, Meta starts with the app and automatically handles its installation/activation and available purchase detection. It may receive product and transaction identifiers, amount, currency, purchase timing, and trial/offer information available to the SDK. Detection of every trial, renewal, or other subscription event is not guaranteed. HolyNote passes the Meta SDK's pseudonymous app-instance identifier to Adapty so that the profile can be associated with that identifier. Our configuration disables IDFA collection, automatic screen metadata, codeless debugging, and product-improvement data collection, and limits Meta event-data usage. It does not provide a separate in-app Meta opt-in or measurement switch. These restrictions do not make the remaining information anonymous or stop the receiving server from seeing connection information.

iOS first-party Jomlink measurement: versions containing HolyAttribution start it independently of note creation, onboarding, and purchases. It can collect a random installation identifier, event/session identifiers, first-SDK-open and delivery times, launch/session metadata, app version/build, Apple vendor identifier (IDFV), device model and operating-system version, language/locale, time zone and clock format, screen size/scale/brightness/orientation, and available App Store storefront information. It can also record limited availability diagnostics and heuristic indications of VPN use or device modification. These indications are not proof of a person's identity, VPN provider, or device security status. Our server sees the IP address of the HTTPS connection; the app's additional public-IP and AppTransaction probes are disabled in this integration.

Jomlink also receives genuine AppsFlyer UID and Adapty profile identifiers when available, limited attribution outcomes and campaign/ad-set/ad/source fields from provider callbacks, and allowlisted acquisition-link context such as a click identifier or source/referrer information. It does not receive full private note links or arbitrary URL query strings. Provider identifiers are comparison keys, not proof that two records identify the same person. An existing user's first launch of this SDK is not necessarily a new App Store installation. There is currently no separate in-app Jomlink opt-in or measurement switch.

Jomlink link pages: pages running our web measurement code can send selected campaign and click parameters supplied in the link (including platform click identifiers), user-agent and available browser/platform information, language, time zone, screen dimensions/scale, and referrer origin. The web SDK can use browser local storage for its delivery queue; link pages may retain a receipt for handing a click identifier to the app. Clearing browser storage does not delete records already accepted by our server. This is separate from our static legal/support pages, which do not run this measurement code.

Jomlink's current diagnostic comparison can use timing, connection IP, language, time zone, and screen context to suggest a possible connection between a link visit and an app record. Such suggestions are heuristic, can be ambiguous or wrong, and are not verified personal identities or calibrated probabilities. Disclosure of this processing does not by itself establish that a particular matching use is permitted by platform rules or applicable law.

iOS product analytics: versions including Amplitude start technical product measurement with the app. This helps us understand where onboarding stops, whether features complete successfully, and how to improve the product. The app does not provide a separate Amplitude opt-in or analytics switch. Onboarding answers and user-generated content are excluded. Session replay, automatic screen, element and network capture, remote automatic-capture configuration, and SDK diagnostics are disabled. The Amplitude SDK does not populate IP address, IDFV, carrier or geographic-location event properties in our configuration; as with other online services, a receiving server still sees connection information. Data is processed using our US Amplitude project. Subscription lifecycle events, such as trial start, conversion, renewal and cancellation, are forwarded by Adapty rather than duplicated as client financial events.

Android app measurement: the current Android build initializes the Meta SDK when the app enters the foreground. It reports installation and app activation, plus a limited set of commercial events such as onboarding completion, paywall views, plan selection, checkout outcomes, and restore outcomes. These client events do not contain your answers, Scripture, notes, prayers, or AI content. The current build has no in-app advertising-measurement switch and does not wait for a separate advertising opt-in.

Android acquisition attribution: AppsFlyer starts with the application and measures installations and sessions. HolyNote passes its pseudonymous app-instance identifier and a limited set of available campaign, ad-set, ad, source, and attribution-time fields to Adapty after the subscription profile is available. Android ID, IMEI, App Set ID, and advertising-identifier collection are disabled. This does not prevent the receiving provider from processing the IP address or deriving approximate location from it. The Android client sends no custom interaction or financial events to AppsFlyer; subscription lifecycle delivery to Meta continues through Adapty. AppsFlyer measurement does not depend on the separate optional crash-report setting.

Subscription measurement: the Android app passes the Facebook SDK’s “anonymous” app-device identifier to Adapty after SDK activation. Adapty can then associate subscription events with that identifier and forward configured trial, purchase, conversion, renewal, cancellation, expiry, billing, and refund events to Meta. This identifier is pseudonymous: its name does not mean that the related data cannot be associated with an app installation or combined with other information by a provider. Financial lifecycle events are forwarded by Adapty rather than duplicated by the Android client.

Android collection of the Google Advertising ID is disabled, and the app does not request the Advertising ID permission. Meta automatic purchase logging, codeless events, and advanced matching are disabled in the app. These restrictions do not eliminate the separate app-instance identifiers or event sharing described above.

Optional Android diagnostics: Firebase Crashlytics remains disabled until you enable “Crash reports” in HolyNote’s Settings. You can turn it off there. This preference is independent of Meta measurement; turning it off does not disable subscription verification or Meta events.

8. Subscriptions and purchases

Apple processes App Store payments on iOS, and Google Play processes purchases on Android. The relevant store manages your subscription account. We do not receive your full payment-card number. We and Adapty may receive purchase identifiers, product, price, currency, transaction timing, renewal, trial, refund, and subscription-status information so we can provide paid access, restore purchases, prevent fraud, and understand subscription performance. On Android, configured lifecycle and purchase information, including transaction identifiers, product, amount, and currency where applicable, is also shared with Meta for subscription and advertising measurement.

On iOS, versions with native Meta automatic purchase detection can also send available purchase metadata to Meta as described in section 7. The existing configured subscription-measurement path through Adapty and AppsFlyer is separate. Jomlink's installation/provider-identifier observations are not a second purchase-reporting channel.

9. Retention and deletion

• Local content: remains on your device until you delete it, erase app data, or remove it through device management or backup controls.
• Temporary media: is normally deleted from HolyNote’s processing server when the job succeeds, fails, or is cancelled. A system crash may delay cleanup until operational maintenance.
• AI job transcripts and results: remain in the current server’s temporary in-memory job store for no more than 24 hours by default, or until the service restarts.
• Jomlink server records: accepted click, first-SDK-open, provider-identifier, context and delivery records are retained for 96 hours from receipt by our server. Linked observations expire no later than their parent first-SDK-open record and can therefore be removed sooner. Automatic cleanup runs on requests, at service startup, and approximately once per minute while the service is running; maintenance or an outage may delay cleanup until the service resumes. This is separate from the AI job store's 24-hour retention period. Uninstalling HolyNote, deleting a note, or clearing browser storage does not itself delete these records. Temporary migration backups are checked approximately once per minute and removed when the oldest record in that backup reaches its 96-hour deadline; backups do not intentionally extend this retention period.
• Jomlink local delivery state: the app and web SDK use temporary retry queues with a 24-hour delivery window, separate from the server's retained records. Local installation identifiers, accepted receipts, and any page-specific handoff state may remain until the relevant app or browser data is removed. A retry window does not set a deletion deadline for information already stored on our server.
• Provider data: is retained under the relevant provider’s policy, including OpenAI’s default abuse-monitoring period described above and Apple, Google Play, Adapty, AppsFlyer, Amplitude, Meta, or Firebase records used for purchases, product analytics, attribution, diagnostics, fraud prevention, and legal compliance. Retention varies by provider and purpose; uninstalling HolyNote does not automatically erase these records.
• Security logs: are kept only as long as reasonably necessary for security, reliability, abuse prevention, dispute handling, and legal obligations.

HolyNote currently has no user account, so we may need limited additional information to locate a server job, installation, or provider profile. For a Jomlink access or deletion request, contact support@holynote.app and provide only a relevant record/installation identifier if you already have it, or the approximate date and context of the activity. Do not email sermon audio, prayer text, full payment details, or other sensitive content. We may need to verify a request; a date or shared IP address alone does not prove ownership of a record. We assess applicable rights and any legal or security retention obligations when handling requests, including relevant backup copies. There is no in-app Jomlink server-deletion control at present.

10. Legal bases

Where laws such as the GDPR or UK GDPR apply, we process information as necessary to provide the features you request and perform our agreement with you; with consent for optional permissions or tracking where required; for legitimate interests such as security, reliability, fraud prevention, and service improvement; and to comply with legal obligations.

11. International transfers

JOMATS FZCO is based in the United Arab Emirates, and our providers may process information in the United States and other countries. Where required, we rely on lawful transfer mechanisms and contractual safeguards provided by our processors.

12. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal data, withdraw consent, and complain to a data-protection authority. You may also:

• delete local notes and chats in HolyNote;
• revoke camera, microphone, photo, or notification permission in your device's Settings;
• enable or disable optional Android “Crash reports” in HolyNote’s Settings;
• manage or cancel subscriptions in your Apple account or Google Play account, as applicable;
• contact us for a privacy request at support@holynote.app.

We will not discriminate against you for exercising a privacy right.

The prepared iOS Meta and Jomlink integrations do not currently provide separate in-app measurement switches. Removing the app stops future requests made by that installed app, but it does not cancel your subscription, erase retained measurement records, or stop events processed independently by stores or service providers. Contact support@holynote.app for privacy requests concerning those records.

13. Children

HolyNote is not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from a child without appropriate authorization. If you believe a child has provided information, contact us so we can review and delete it where applicable.

14. Security

We use safeguards such as encrypted HTTPS transport, secret separation, access controls, request limits, restricted temporary storage, redacted application logs, and deletion routines. No service can guarantee absolute security, so please avoid uploading information that is unnecessary for the feature you request.

15. Changes to this policy

We may update this policy when HolyNote, its providers, or legal requirements change. We will update the date above and provide additional notice when required. Material changes apply prospectively unless the law permits otherwise.

16. Contact

JOMATS FZCO
Dubai Silicon Oasis, DDP, Building A2
Dubai, United Arab Emirates
Company number: DSO-FZCO-14516
Telephone: +971 4 228 52 85
Email: support@holynote.app (subject: HolyNote Privacy)