Privacy Policy

Vision Labs LLC · Last updated: September 12, 2026 · Effective: May 30, 2026

Who we are

DiscipleOS is owned and operated by Vision Labs LLC, a limited liability company organized under the laws of the State of Arkansas, United States ("DiscipleOS," "we," "us," or "our"). This Privacy Policy explains what information we collect through discipleos.com (the "Site") and the DiscipleOS mobile application (the "App," together the "Service"), how we use it, and the choices you have. Vision Labs LLC is the data controller responsible for your personal information. You can reach us at miguel@discipleos.com.

By using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

Information we collect

We collect only the information needed to operate the Service.

On the Site, information you provide:

Sign-in and dashboard records. When you sign in on the Site with your email or your phone number, we receive an account identifier for that sign-in. If you lead a church, campus or community, what you enter on its dashboard (its page, events, groups, service times, and the people it records) is stored with that organization. The questions you ask its assistant are stored as your own rows, tied to that organization, and readable and deletable only by you.
Web purchases. If you buy Kingdom Premium or a community plan on the Site, or give to the mission, Stripe sends us the transaction record (product, amount, status, and renewal date). We never receive your full card number.
Early access and partnership forms. When you submit the early access form, we collect your name, your email address and, if you choose to provide it, your phone number. For partnership or ministry inquiries, we also collect your name, organization, partnership type, and the contents of your message.
Information collected automatically. When you submit a form, we record limited technical context to prevent spam and abuse: a one-way hashed version of your IP address, your browser's user-agent string, the referring page, and any UTM campaign parameters present in the link you arrived from.

We do not knowingly buy or receive personal information about you from data brokers.

In the App, information you provide:

Account information. When you sign in with Apple, Google, or a phone number, we receive an account identifier and, where available, your name and email address. If Apple Private Relay is used, we receive a relay email rather than your personal address.
Profile information. Your first and last name and an optional profile photo you choose to add.
Habit and reflection content. The habits you create, your schedules and reminder times, check-ins, streaks, reflections, and the answers you give during onboarding and the assessment.
Accountability connections. Invitations you send or accept and the role (for example Mentor, Disciple, or Friend) you assign to a connection.
Communications. Messages you send to support and your related contact details. Messages, prayers, voice memos, and photos you add in the App are private to your account and the people you explicitly connect with. Every voice memo you send is transcribed by our AI providers so it can also show as text.
Companion AI conversations. Stored with your account so the conversation can continue, and processed by the AI providers listed below to generate replies. Companion AI runs only after you consent in the App.
Purchase and giving records. If you subscribe to a paid plan in the App or give to the mission, our payment partners (Apple and RevenueCat in the App, Stripe on the web) send us transaction records such as the product, amount, status, and renewal date. We never receive your full card number.

Information generated for you:

Soul Profile. An identity profile (for example archetype, vision, and drift) generated from your assessment answers using an artificial-intelligence model.

Information collected automatically:

Device and usage data. App version, device type and operating system, language, and time-zone, carried with diagnostics and with the requests the App makes to our servers. The App sends no product analytics events today.
Notification tokens. If you enable reminders, a push token tied to your device.
Diagnostics. Crash and performance logs. A crash report is not linked to your account.
Location, only if you allow it. When you look for churches, campuses, communities, or events near you, and you grant the location permission, the app sends your device's current position once with that search. We use it to order results by distance and we do not store it. If you separately turn on the member map, we store a rounded general area for you, a grid cell of about fifteen miles, never an exact position, and we delete it when you turn the map off.

We do not collect payment card numbers or government identification numbers, and we never store your exact location. We do not use third-party advertising trackers. The App has no advertising SDKs and does not track you across other companies' apps or websites.

Apple Health. If you connect Apple Health, the app reads your step count, resting heart rate, sleep, and workouts from your device, and only those. All of it stays on your phone. The one line of reasoning you see in your Physical life area is written on the device from those numbers, so your step count, resting heart rate and sleep hours are never sent to us and never reach our AI providers. The app never writes anything back to Apple Health. Other health information reaches us only when you enter and save it yourself, for example a body weight entry or a workout you record in the app, and that is stored in your own account.

Sensitive information (please read)

DiscipleOS is a faith-oriented habit and identity app. The content you choose to enter (for example reflections, identity statements, and assessment answers) may reveal religious or philosophical beliefs and other personal matters. Under the EU/UK GDPR this can be "special category" data, and under California law it can be "sensitive personal information."

We process this information only to provide the Service to you, based on your voluntary choice to enter it and, where required by law, your explicit consent. We do not use it to infer characteristics about you for advertising, and we do not sell or share it. You can edit or delete this content at any time, and you can withdraw consent by deleting the content or your account.

How we use information

We use the information we collect to:

notify you when early access opens;
send launch-related updates and respond to your inquiry;
send SMS launch alerts to the phone number you provide, but only if you opted in by submitting it for that purpose (see "SMS messaging" below);
create and maintain your account and profile;
provide core features (habit tracking, streaks, the Soul Profile, and accountability connections);
send reminders and notifications you have enabled;
generate your Soul Profile and personalize your experience;
respond to support requests;
monitor, secure, and improve the Service, prevent fraud, spam, and abuse, and debug problems;
comply with legal obligations and enforce our Terms.

We will not sell your personal information, and we will not send you marketing unrelated to DiscipleOS without your separate consent.

Legal bases for processing

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of our contract with you (providing the Service); your consent (for example email and SMS communications, notifications, the optional photo, and faith-related content, which you may withdraw at any time); our legitimate interests in operating, securing, and improving the Service (balanced against your rights); and compliance with legal obligations.

SMS messaging

If you provide your phone number, you consent to receive SMS launch alerts from DiscipleOS related to the Service. Message and data rates may apply. Message frequency varies. You can opt out at any time by replying STOP to any message, after which we will send a single confirmation. Reply HELP for help, or contact us at the email below. Consent to receive SMS is not a condition of using the Service, and we do not share your phone number with third parties for their own marketing.

How we store and protect it

Lead data is stored in Supabase, a Postgres-based cloud database hosted on Amazon Web Services. Row-level security is enabled: anonymous visitors can only insert records, never read them. Your IP address is hashed using SHA-256 with a server-side salt before storage; we never store raw IP addresses. We retain lead data only as long as needed for the purposes described above, and we delete or anonymize it when it is no longer needed or upon a valid deletion request.

We use reasonable technical and organizational measures designed to protect your information, including encryption in transit, access controls, and use of reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law.

Analytics

We run our own first-party, cookieless analytics to understand how the Site is used, for example which pages are visited and how many people ask for early access. We do not use analytics cookies, we do not fingerprint your device, and we do not track you across other websites. To count unique visits within a single day without identifying you, we derive a one-way hash from your IP address, your browser's user-agent, and a secret value that is rotated and discarded every day, so the same visit cannot be recognized from one day to the next. We store no raw IP addresses and no personal data in our analytics, we record only a fixed list of events (never the content you create), and we share this data with no one. We use no tracking pixels and no third-party advertising networks.

The Site sets one functional first-party cookie, named ref, only when you arrive through a creator partner link (for example discipleos.com/<name>). It remembers which partner referred you so we can credit them, and it is not used for advertising or cross-site tracking.

Artificial-intelligence processing

These parts of the Service send your content to our AI providers and show you what comes back. In the App: your assessment answers, to generate your Soul Profile; your Companion AI messages, to generate replies; every voice memo you send and every voice note you record, to transcribe it; the group Bible study, workout builder, Soul Workshop (reverse-engineering a vision or weaving your testimony) and stewardship narrative, each when you ask for it. On the Site, the leader dashboard's assistant sends a leader's questions, together with the records of their church or community that the leader can already see on the dashboard (people, shared assessment results, gatherings, groups and the discipleship tree), to the same providers to answer them, and keeps that conversation as the leader's own rows. AI output is generated for personal reflection and may be inaccurate or incomplete. We do not permit a provider to use your content to train its general-purpose models except as allowed by that provider's terms.

Service providers

We share information with the service providers (processors) that help us operate the Service, each bound to use it solely on our instructions, and with the people and organizations you choose, named after the list:

Supabase. Database, authentication, file storage, lead storage, and first-party analytics storage.
Vercel. Website hosting and content delivery.
Apple and Stripe. Payment processing for subscriptions and giving. We never see card numbers.
RevenueCat. Subscription management for App Store purchases.
Expo and Apple/Google push services. Push notification delivery.
Fly.io. Application server hosting.
AI providers (DeepSeek, Anthropic, or OpenRouter). Generate every piece of AI output named under "Artificial-intelligence processing", in the App and on the Site: your Soul Profile, Companion AI replies (only after you consent in the App), the Physical life area reasoning, transcripts of voice memos and voice notes, the group Bible study, workout, Soul Workshop and stewardship text the App writes for you, and the leader dashboard assistant's answers.

Your church or community and its leadership. When you join a church, campus or community in the App, its leaders see the records it keeps about you: your name on its roster, the gifts you gave it and their amounts, check-ins, pledges you made, and what you chose to share with it in Circle. They never see your private practice, your Soul Profile, or your check-in notes unless you shared them. What stays with a church after you leave is listed under "Your rights".

Accountability partners you choose. People you invite can see the limited habit and identity information the feature displays to them. You control whom you invite and what role they hold.

Legal, safety, and corporate events. We may disclose information where required by law or legal process, to protect rights, safety, and the integrity of the Service, or in connection with a merger, acquisition, financing, or sale of assets, with notice where required.

We do not sell or rent your personal information, we do not share it for cross-context behavioral advertising, and beyond the providers, churches, communities and partners named here we share it with no one, except where required by law or to protect our legal rights.

Tracking across other apps. We do not currently track you across other companies' apps or websites, so we do not show Apple's App Tracking Transparency prompt. If that ever changes, we will ask for your permission first through Apple's prompt, you will be free to decline, and even if you allow it we will still never sell your personal information.

Retention

We keep your information for as long as your account is active and as needed to provide the Service. When you delete your account (Settings, then "Delete account and data"), we delete or de-identify your personal information from our active systems within 30 days, and the app clears your data from the device. We may retain limited records where necessary for legal, security, accounting, or fraud-prevention purposes, and backups are purged on a rolling schedule. A few records a church made about you keep your name, such as a guardian check-in or a pledge a leader recorded; they are listed under "Your rights" below.

International data transfers

We are based in the United States, and our service providers process data in the United States and other countries that may not provide the same level of protection as your home country. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum. You may request a copy of the relevant safeguards at miguel@discipleos.com.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent at any time. You can edit your profile in Settings, delete your account and data at any time in Settings, and manage reminders in Settings or in your device settings. Where we rely on consent, you can withdraw it without affecting prior processing.

EEA and UK residents may have rights to access, rectify, erase, restrict, or object to processing, to data portability, and to lodge a complaint with a supervisory authority.

California residents (CCPA/CPRA). In the past 12 months we collected the categories of personal information described in "Information we collect" and "Sensitive information" above (identifiers, account and profile data, user content, sensitive information you provide, and device and usage data), for the purposes in "How we use information," and disclosed them to the service providers listed above. We do not sell or share personal information and have not done so in the past 12 months, so no opt-out of sale is required. You have rights to know, access, correct, and delete your personal information, to limit the use of sensitive personal information, and not to receive discriminatory treatment for exercising these rights.

Gift records after you delete your account. Deleting your DiscipleOS account removes your profile, and what you made or wrote in the app either goes with it or stays with the church or community it was made for, with your name taken off. Each gift you gave stays on your church's books without your name: the amount, the date, the fund, and the payment reference the church needs to match its bank statement stay; your name and email come off the record, and the gift is no longer connected to you. That record is the church's financial record, not ours, and it keeps the church's totals, audits, and bookkeeping whole. A gift with no name on it cannot appear on a year-end giving statement, so if you want your giving history for taxes, ask your church for it before you delete. You can also export your data from Settings first. If your church later needs to connect a gift to a person again, its leadership can do that. If you have a question about a gift record, ask your church, because it belongs to them. Payment cards never reach us.

Rooms, invitations, and records other people made. A group room or a direct message you created passes to its longest-standing member when you leave it or delete your account, so nobody else loses their messages; a room with nobody left in it is closed. An invitation record that named you loses your name and email when you delete your account. A check-in record naming you as a child's guardian, or a pledge a leader recorded in your name, stays with the church as its own record and keeps your name on it: the first says who may pick up a child, the second is a promise the church wrote down. The AI assistant's trail in a group keeps the line that something was done, with your name replaced.

To exercise any of these rights, email miguel@discipleos.com. We will verify your request using your account information and respond within the timeframe required by applicable law (generally within 30 to 45 days). You may use an authorized agent where the law allows. To unsubscribe from emails, use the unsubscribe link in any message we send. One tap. No dark patterns.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact miguel@discipleos.com and we will delete it.

Third-party services

The Service may link to or rely on third-party services (for example your sign-in provider). Their use of your information is governed by their own privacy policies, not this one.

Changes to this policy

We may update this policy as the product and legal requirements evolve. When we make material changes, we will revise the "Last updated" date above, provide in-app notice, and, where appropriate, notify users who have opted in by email. Your continued use of the Service after an update constitutes acceptance of the revised policy.

Contact

Vision Labs LLC
Attn: Privacy, DiscipleOS
miguel@discipleos.com