Legio Fidelis Privacy Policy

Last updated: October 14, 2026

This policy covers the Legio Fidelis app for iPhone and Android, previously called Panagia and Ninja Scribe, operated by LEGIO FIDELIS CORP. Contact breviary.app@proton.me with privacy questions or requests.

Accounts and service providers

A Clerk account is required to open the app. Clerk manages Apple, Google, GitHub and existing-account username sign-in. It processes account identifiers, the email address supplied by a sign-in provider, authentication information, an app-specific device identifier, and connection and security information needed to operate sign-in. The app does not retain your password. Supabase receives your verified Clerk user identifier to connect your account to its community records. These services process data over encrypted HTTPS connections.

Profiles, presence and reading

We store the display name, selected avatar and optional bio you choose. While you are signed in and the app is in the foreground, we send your selected room or office, prayer participation, visibility setting and recent presence time to Supabase. When you open a library section, we store its work ID and section number; detailed scroll position stays on your device. Participation and reading choices can reveal religious interests or practice.

New profiles start Hidden. Hidden readers appear to other readers as Anonymous Pilgrim, without their profile, country or reading details. Choosing Visible lets other signed-in readers see your username, selected avatar, bio and current library work or section while you are active. You can return to Hidden in Profile. Your email address is never displayed to other readers. Presence expires from the active list after about 75 seconds without a refresh; the database row may remain until replaced or your account is deleted.

Country estimate and the prayer map

We estimate a country from sign-in connection information, including an IP-derived country response from our Clerk domain. We store only a two-letter country code in the community database. We do not request GPS permission or collect precise coordinates, city or street location. The hosting and authentication services still receive the IP address needed to deliver network requests.

Only readers whose profile is Visible and whose country sharing is on contribute a public country total. The map shows country counts at fixed country locations, never another reader’s username or exact location. Turning country sharing off hides your country from other readers; it does not delete the stored country estimate. Hidden profiles disclose no country publicly.

Information kept on your device

Prayer texts, offline books, reading position, display settings, alert choices and prayer-completion history are stored locally. Personal prayer statistics are not uploaded to the community database. Account deletion clears the account’s local prayer history and preferences on the device where deletion is performed. Other devices may retain local copies until you remove the app or its local data.

Alerts use the phone’s operating-system notification and alarm services. You control notification and alarm permissions in system settings. The app does not access your contacts, camera or microphone.

Safety features and older messages

Profile reports, a snapshot of the reported username and bio, and reader blocks are stored to operate moderation and safety features. Assigned moderators can review reports and restrict community access. Blocking hides your presence from the blocked reader and theirs from you. The chat interface is currently hidden; previously posted messages, room and posting times may remain until moderation or account deletion.

How we use and disclose information

We use account and community information to provide sign-in, profiles, presence, the map, reading status, safety and account deletion. Clerk and Supabase process information to provide these services, including necessary connection and operational records. We do not sell personal information. The app contains no advertising and does not use community information for advertising, behavioral analytics or cross-app tracking. Clerk’s sign-in SDK includes its own operational components; its documented developer telemetry does not collect app users’ information in production. Optional profile and country disclosure happens only through the visibility and sharing controls described above.

Deletion and retention

You can edit your profile, change visibility and country sharing, unblock readers, sign out, or select Delete account in Profile. Deletion removes the active Clerk account and its associated community profile, presence, country, reading status, messages, reports, blocks and moderation assignments. Service-provider backups, security logs and records that must be retained for legal or security reasons follow the providers’ retention practices and are not displayed as an active profile.

You can request deletion without reinstalling the app using our account-deletion page. We may verify account ownership before acting on a request. You can also revoke sign-in connections in your Apple, Google or GitHub account settings.

Contact

For privacy, access or deletion requests, email breviary.app@proton.me. Updates to this policy will appear on this page with a revised date.