Privacy Policy

Effective October 24, 2026

This policy covers Shema: Sermon Notes & Bible Study, the app for iPhone and Android. Shema: Bible Clock, for Apple TV, has its own privacy policy.

Shema helps you record, transcribe, and study sermons, and grow through daily devotionals. This policy explains what we collect, why, and the choices you have. We wrote it in plain language on purpose.

What we collect

• Audio you create or import — sermon recordings you make in the app, audio files you upload, and audio from YouTube links you choose to import. A recording goes to your own private folder in our cloud store, Supabase, and on to OpenAI to be transcribed.
• Your notes — the transcript of a sermon and the text notes you write on it, kept in your cloud library on Supabase and sent to OpenAI to write the summary, flashcards, and devotionals you asked for. Photos you attach to a sermon, such as a slide, stay on your device: the image itself is never uploaded to us or to anyone else.
• What you write in your prayer journal — the words you type about what is on your heart. This is the most personal writing in Shema, so it gets a line of its own rather than sitting quietly inside "notes": what you type goes to OpenAI, which writes the prayer and the devotional back to you. Once you have added an email to your account, entries are also backed up to Supabase so the journal survives a new phone.
• How you answer the devotional's daily question — where you put yourself on the seven-point scale about your relationship with God today. It goes to our own server and on to OpenAI, because that answer is what the day's devotional is written from.
• The questions you ask — what you type when you ask about a sermon or a passage. Sent to OpenAI to be answered; once you have added an email to your account, the conversation is also backed up to Supabase so it is not lost with the phone.
• Your notes and highlights on a Bible verse — what you wrote against a passage, the words that were on the screen when you wrote it, and which verses you have marked. Backed up to Supabase once you have added an email to your account.
• What you have read — chapters you have read, your reading plans, your devotional streak, and where you stopped in a Bible story's audio. Backed up to Supabase, once you have added an email, so a new phone does not start you over. It is a backup for you, not a report for us.
• Your name and email address — a first and last name, if you enter one, so Shema can greet you, and an email address, if you add one so your library can be recovered on another phone. Both are optional, and both are stored with your account on Supabase.
• An account identifier — every install is given one, before you have typed anything, because it is what keeps your content yours and apart from everyone else's. It is a random identifier rather than a name. It is sent to RevenueCat so Shema+ follows you between devices, and it is attached to a feedback message you send us.
• Whether Shema+ is active — your subscription and purchase state, held by RevenueCat and by Apple or Google, whichever store you bought it through. Payment itself is handled by that store; we never see your card.
• A notification address — if you allow notifications, the push token your device issues is stored on Supabase so we can tell you when your sermon notes are ready. Turn notifications off and there is nothing to store.
• Feedback you send us — your message, the email address you type in if you choose to, and, attached to it, the Shema version and build you are on, your device's operating system version, your account identifier, and the User-Agent your device sends, so we can work out what you were looking at. It is filed to a private store on Supabase that only we can open.
• No analytics, no tracking — Shema contains no analytics, advertising, or crash-reporting service of any kind. Nothing in the app measures what you do and reports it anywhere. Our servers keep the ordinary request logs needed to run the service and fix faults, and we do not build advertising profiles or track you across other apps or websites.

How we use it

• To transcribe your audio and generate summaries, flashcards, insights, devotionals, narration, and artwork from your own content.
• To translate and present that content in the language you choose.
• To back your library up to the cloud so you don't lose your work when you change phones — and, once you add an email, to bring it back on a new one.

Who we share it with

We do not sell your data. We share it only with the service providers needed to run the app:

• OpenAI — our main AI provider. Processes the audio, transcripts, and notes you choose to submit to produce transcripts, summaries, flashcards, insights, devotionals, answers to the questions you ask, images, translations into the language you choose, and some of the narration. OpenAI does not use this content to train its models when accessed through its API, and is contractually required to protect it to a standard equal to this policy. See OpenAI's privacy policy.
• ElevenLabs — narration voices. Receives the text to be read aloud, which includes recap scripts and devotionals written from your own sermon. See ElevenLabs' privacy policy.
• Supadata — YouTube captions. If you import a YouTube link, Supadata receives that link and sends back the video's captions. It gets nothing else — no account information, and none of your recordings, sermons, or notes. See Supadata's privacy policy.
• Supabase — our secure cloud store and database. Your synced library, your recordings, and the feedback you send us all live there.
• Push notification delivery — when Shema tells you your sermon notes are ready, that notification travels through Expo's push service, and the sermon's title is in the message so you can tell which one it is. Turn notifications off and nothing is sent.
• RevenueCat — subscription management. Receives your account identifier and your subscription state, so Shema+ unlocks on every device you sign in to and can be restored when you change phones. It never receives your recordings, notes, or sermons. Apple or Google handles the payment itself, and neither we nor RevenueCat see your card. See RevenueCat's privacy policy.
• Cloudflare — serves this page, and every sermon-note and devotional page Shema publishes when you share one, and delivers the small Shema logo your phone shows on the lock screen while Bible audio plays. Standing in front of those pages means it sees the IP address of whoever opens one, including yours. It never receives your recordings, notes, or account details.
• Bible content providers (AO Lab, Faith Comes By Hearing) — supply the Bible text and audio you read and listen to. We never send them your recordings, notes, or account details. Some of that text and audio is fetched by your device directly from them and from their delivery network, so they see your device's IP address and which passage you opened — the same as visiting any website.
• The video platform you import from — if you paste a YouTube link, your device fetches that video's title, thumbnail, and player directly from YouTube, so YouTube sees your IP address and which video you opened. We send them nothing else about you.

When you share a page

Sharing is a choice you make one thing at a time — nothing is published until you ask for it. Shema can publish three kinds of page: a sermon note, a Bible study, and a daily devotional. In each case Shema builds a real web page and hands you the link to it. The rest of your library stays where it is.

• What goes on a sermon-note page — the sermon's title and date, the preacher's name, the summary, the key takeaways, the insight quotes with their Scripture references, and the artwork Shema made for it. If the note came from a YouTube link, that video is embedded in the page too.
• The preacher's name is not yours — it is personal information about a real person, and publishing the page publishes their name. They are not asked first, and it is your account, not theirs, that can take the page down. Please think about whether they would want it up before you send the link.
• What goes on a study page — the verse reference, the passage itself in the translation you were reading, and the study Shema wrote about it.
• What goes on a devotional page — the day's topic, its verse, the teaching, the prayer, and the artwork.
• Anyone with the link can open any of the three — there is no sign-in and no password on the page. The address is a long run of random characters, so nobody will guess it or stumble onto it. But we do not ask search engines to skip these pages, so they are unlisted rather than hidden. Treat the link as the only thing keeping a page private.
• The page says nothing about you — no name, no email address, no account identifier, on any of the three. A visitor sees the sermon, the study, or the devotional, not who shared it.
• An embedded video means YouTube sees your visitors — the player loads from YouTube for whoever opens the page, so YouTube sees their IP address, the same as if they had watched the video there.

Taking a sermon-note page down. Open the note, tap Share, and choose Stop Sharing This Link: the page comes down and the link stops working. Deleting the note removes its page too, and deleting your account removes all of them. Each of these needs you signed in to the account that published the page, because that is the only account that can take it down. One gap we should name plainly: a page shared from an older version of Shema, before the app kept a record of what it had published, cannot be taken down from inside the app — there is no record of it left to act on.

Study and devotional pages cannot be taken down individually yet. We would rather tell you that than let you assume otherwise. When Shema publishes one of those two, it keeps no record tying that page back to you, so there is nothing inside the app for a "stop sharing" control to act on: deleting the study or the devotional does not remove its page, and neither does deleting your account. Nothing on either page names you, but the page stays up. This is our gap and not something you did wrong by sharing — the takedown described above was built for sermon-note pages first because those carry a preacher's name, and the same work is what the other two need. We intend to close it.

In any of those cases the way through is the same, and it works today: email support@shemaai.com with the link and we will take the page down for you.

Your consent

Before Shema sends any of your content to our AI providers for the first time, the app shows a clear in-app disclosure of what is sent and to whom, and asks for your explicit agreement. You control what is shared: only content you choose to record, import, or submit is processed. You can withdraw at any time by deleting a recording or note, deleting your account, or not using the AI features.

Where it's stored

Your content lives on your device, and in your private, access-controlled cloud account. Every install has such an account, so a recording and the notes on it are backed up whether or not you have added an email. What the email adds is recovery: it is what lets that library come back on a different phone, and it is what turns on the cloud backup for your prayer journal, your chats, your verse notes and highlights, and your reading history. Recordings in the cloud are kept in a private store and served only to you through short-lived signed links. The pages you choose to share are the one exception to all of this — those are public by design, and "When you share a page" above says exactly what is on them.

On Android, your phone's own backup to your Google account can include what Shema keeps on the phone, so a reinstall can pick up where you left off. That backup is held by Google for your account, and we can't see it. You can turn it off in Android's backup settings.

Your choices and deleting your data

• Delete any note, recording, or devotional in the app at any time.
• Delete your account from within the app at any time. That removes your synced content and takes down every sermon-note page you published. Study and devotional pages are the exception, for the reason given under "When you share a page" — send us the link and we will remove those.
• You can also email us at support@shemaai.com to request deletion of your data.
• Or ask us from the web, without the app: shemaai.com/delete-account.

Children

Shema is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes

If we update this policy, we'll change the effective date above and, for significant changes, notify you in the app.

Contact

Questions? Email support@shemaai.com.