Privacy Policy
Last updated — Version 1.0 — Effective: September 1, 2026
1. Introduction
This Privacy Policy explains how Final Global Movement, Inc. collects, uses, stores, and protects your personal information when you use The Emancipator daily devotional application (the "App") and the website at emancipatorgld.org (the "Website"), together referred to as the "Service."
By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
2. Who we are
The Emancipator is operated by Final Global Movement, Inc., a US-registered 501(c)(3) nonprofit corporation with an explicitly religious purpose.
For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar data protection laws, Final Global Movement, Inc. is the data controller of the personal data described in this policy.
Our contact information: Final Global Movement, Inc., 4030 Wake Forest Rd, Suite 349, Raleigh, NC 27609. Email: info@emancipatorgld.org
3. Information we collect
We collect only what we need to deliver the Service. The categories below are exhaustive — we do not collect data that isn't described here.
3.1 Account information
When you create an account, we collect your email address for authentication. If you sign in through Apple or Google, we receive the name and email address those services share with us. We also collect your first name (required) and last name (optional) during onboarding. You may optionally add a profile photo (avatar) to your account. If you sign in with Apple, we also store a revocation token supplied by Apple. It is used for exactly one purpose: ending your Apple sign-in relationship with the app when you delete your account, as Apple requires.
3.2 User preferences
To personalize your experience, we store your preferred language, timezone, font size, display theme, and notification time for daily devotional reminders.
3.3 User-generated content
You may create personal content associated with your account, including bookmarks (saved devotionals), reactions ("This Blessed Me" indicators), testimony submissions (including any optional photos you attach), and feedback messages submitted through the app (including any optional screenshots you attach). Bug reports may include device diagnostic information (operating system, app version, device model, network status).
3.4 Usage data
We track your reading progress to allow you to resume where you left off and to show which devotional entries you have completed. We also record your reading streaks and activity dates (the days on which you read) to display your streak. This data is associated with your account and synced across your devices.
3.5 Device information
If you enable push notifications, we collect your push notification token (a unique identifier assigned to your device by Apple or Google), your device platform (iOS or Android), and an installation identifier — a random value the App generates once and keeps in your device's secure storage to identify this installation of the App. We use the installation identifier for one purpose only: to keep a single active notification registration per device, so that you do not receive the same notification twice. It is not used for advertising, tracking, analytics, or profiling, is not shared with any third party, and is deleted when the registration is removed or your account is deleted. These tokens are used solely to deliver daily devotional reminders and service announcements. We also record notification read receipts (whether a notification we sent was opened).
When the app registers for notifications, we derive your approximate location — your country, region and city, derived from your IP address at that moment; used only for aggregate ministry-reach statistics. The IP address itself is not stored.
3.6 Crash and diagnostic data
We automatically collect crash reports and diagnostic data when the app encounters errors. This includes stack traces, device model, operating system version, app version, and the sequence of actions leading to the crash. Crash reports are configured to scrub direct identifiers (names, email addresses, message content) before data leaves your device.
3.7 Product analytics (with your consent)
With your explicit consent, we may collect pseudonymous usage analytics to understand how the Service is used and to improve it. Analytics data is tied to a random identifier, not to your email or name, and does not include the content of your bookmarks, feedback, or devotional reading. You may opt in or out of analytics at any time in Settings.
Note: "pseudonymous" means the data is not directly linked to your identity but can theoretically be re-associated with you using the random identifier. It is not fully anonymous in the legal sense, and ministry staff with content-administration access could technically associate the random identifier with your account.
3.8 Consent records
When you grant or withdraw consent for specific processing activities, we record your decision (granted or withdrawn), the consent category, the timestamp, the policy version in force at the time, and the version of the consent wording you were shown. This consent log is append-only and serves as a legal compliance record.
4. How we use your information
We use the information we collect for the following purposes:
- Deliver the Service. Provide daily devotional content, sync your progress and personal content across devices, maintain your account.
- Send notifications. Deliver daily devotional reminders at your preferred time and service announcements (such as updates to these terms).
- Respond to you. Process feedback, questions, and support requests you submit through the Service.
- Ensure stability and security. Use crash and diagnostic data to identify, diagnose, and fix technical issues. Monitor for unauthorized access, abuse, and security threats. Enforce rate limits.
- Improve the Service. Analyze pseudonymous usage patterns (with your consent) to identify areas for improvement and inform new features.
- Comply with legal obligations. Respond to lawful data access requests and fulfill our obligations under applicable laws.
We do not use your data for advertising, ad targeting, or profiling of any kind. We do not make automated decisions with legal or similarly significant effects about you. We do not engage in behavioral profiling.
5. Legal basis for processing (GDPR)
If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following:
5.1 Performance of a contract (Article 6(1)(b))
Processing your account information, preferences, and user-generated content is necessary to provide the Service you signed up for.
5.2 Legitimate interest (Article 6(1)(f))
We process crash reports, diagnostic data, consent log records, and rate-limiting records based on our legitimate interest in maintaining the security, stability, and reliable operation of the Service. We also process aggregate ministry-reach statistics — your approximate location (country, region and city), derived from your IP address when the app registers for notifications — based on our legitimate interest in understanding the geographic reach of the ministry. We have conducted a Legitimate Interest Assessment weighing this against your rights and freedoms, and concluded the processing is proportionate and minimally invasive. You may object to this processing at any time by contacting info@emancipatorgld.org, and we will honor valid objections.
5.3 Explicit consent (Article 6(1)(a))
We process product analytics data and send push notifications based on your explicit, freely given consent. You may withdraw consent at any time in Settings with no effect on the rest of the Service.
5.4 Processing of religious belief data (Article 9(2)(d))
The Emancipator is a Christian devotional application, and your engagement with the Service (reading progress, bookmarks, "This Blessed Me" reactions) reveals data about your religious beliefs. Under Article 9 of the GDPR, this is special category data requiring an additional legal basis.
We process this data under Article 9(2)(d): processing carried out in the course of the legitimate activities of a not-for-profit body with a religious aim, in respect of persons who have regular contact with the body in connection with its religious purposes. Final Global Movement, Inc. is a US-registered 501(c)(3) Christian nonprofit, and The Emancipator serves persons engaging regularly with our religious content.
Personal data revealing your religious beliefs is not disclosed outside Final Global Movement, Inc. without your explicit consent, except to processors acting strictly on our behalf under written data processing agreements.
6. Information sharing and processors
We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising. We share information only with service providers strictly necessary to operate the Service, each bound by a written data processing agreement.
6.1 Categories of processors we use
- Cloud database, authentication, and file storage provider (United States). Receives your account data, preferences, user-generated content, and consent records.
- Website and application hosting provider (United States). Receives website request logs (IP addresses, user agents) for essential operation.
- Crash and diagnostic data processor (European Union — Germany). Receives stack traces, device metadata, and error events. Configured to scrub direct identifiers (names, email addresses, message content) before data leaves your device.
- Push notification delivery services, including the Expo push service, Apple Push Notification service and Firebase Cloud Messaging for final delivery to your device. These services receive only the push token and notification content.
- IP geolocation service — ip-api.com PRO (Roubaix, France / European Union). When the app registers for notifications, this service transiently receives your IP address, solely to derive your approximate location (country, region and city). Nothing else is shared with it.
- Product analytics service (when product analytics is enabled). Receives pseudonymous usage events only. Analytics is off by default and no usage analytics are collected until you have given explicit consent. The one exception is a single event recording your answer to the consent question itself (whether you said yes or no), which we use to prove the question was asked.
- Transactional email delivery provider (United States). Receives your email address and message content for delivery of password resets, verification emails, and service announcements.
- Editorial AI content processing tool (United States). Used for editorial workflows on ministry-authored devotional content (drafting, structuring, translation review). This processor does not receive any user personal data and is contractually prohibited from using processed content for model training.
- Google / YouTube. Video teachings in the app are played through an embedded YouTube player. When you watch a video, YouTube receives your IP address and your viewing interactions, which Google processes under its own privacy policy.
6.2 Social sign-in providers (if you use them)
If you choose to sign in with Apple or Google:
- Apple Inc. — Sign in with Apple. Receives your authentication request; shares the name and email you authorize with us. When you delete your account, we transmit the Apple-supplied revocation token to Apple to revoke your sign-in, as Apple requires.
- Google LLC — Sign in with Google. Receives your authentication request; shares the name and email you authorize with us.
7. International data transfers
The Service is operated by a US-based controller. Our processors are primarily US-based — with the exceptions that crash and diagnostic data is processed within the European Union (Germany) and IP geolocation lookups are processed within the European Union (France). If you access the Service from outside the United States, your personal data will be transferred to, stored, and processed in the United States.
The European Commission has adopted an adequacy decision for the EU-US Data Privacy Framework (DPF). We rely on DPF certification where our US processors are certified under the framework. For processors not DPF-certified or for transfers to other countries, we rely on the European Commission's Standard Contractual Clauses (SCCs) together with supplementary technical and organizational measures (including encryption, access controls, and data minimization) as required by the Schrems II judgment.
We acknowledge that US service providers may in principle be subject to US government access requests, including under the Foreign Intelligence Surveillance Act Section 702. We have assessed this risk for the categories of data we process and implemented supplementary measures appropriate to that risk. We will update this policy if the legal landscape for international data transfers changes materially.
8. Data storage and security
We implement appropriate technical and organizational measures to protect your personal data:
- All data is encrypted in transit using TLS and encrypted at rest on our infrastructure provider's servers.
- Authentication tokens on your device are stored in platform-native secure storage (iOS Keychain on Apple devices, Android Keystore on Android devices).
- Our database enforces row-level security, ensuring that each user can only access their own personal data.
- API endpoints are protected by rate limiting to prevent abuse and input validation to guard against injection attacks.
- Administrative access to user data is restricted to authorized personnel and logged in an immutable audit trail.
No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to promptly investigating and addressing any security incidents.
9. Data retention
We retain personal data only as long as necessary for the purposes described in this policy:
- Account data, preferences, user-generated content — retained for the life of your account. Deleted immediately when you delete your account, and in any event within 30 days.
- Crash and diagnostic data — 90 days from collection, then deleted.
- Product analytics data (if enabled) — retained while your account is active; deleted together with your account.
- Consent records — retained for the life of your account, to demonstrate that consent was asked and answered. Deleted together with your account.
- Apple sign-in revocation token — kept for the life of your account; deleted with it.
- Email delivery logs — 30 days from sending.
- Server request logs — 30 days from the request.
- Backup copies — up to 30 days after the primary data is deleted, for disaster recovery.
When you delete your account, your personal data is deleted from our active systems immediately and permanently — and in any event within 30 days. Backup copies are purged within a further 30 days.
10. Data breach notification
Notification to supervisory authorities. Where required by applicable law, we will notify the relevant data protection supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.
Notification to affected users. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR Article 34. Our notification will describe the nature of the breach, the likely consequences, the measures taken or proposed to address it, and a contact point for further information.
11. Your rights
Depending on your location, you may have the following rights regarding your personal information:
11.1 Rights available to all users
- Access. View your personal data within the app at any time. You may request a complete copy of your data by using the Download my data feature in Settings, or by emailing info@emancipatorgld.org. The export lists the existence of your Apple sign-in credential with the token value redacted, just as it does for device push tokens.
- Correction. Update your profile information, preferences, and settings directly within the app.
- Deletion. Permanently delete your account and all associated data in the app under Profile → Manage Account → Delete Account. Deletion takes effect immediately and is irreversible.
- Withdraw consent. Disable analytics or push notifications at any time in Settings.
11.2 Additional rights for EEA and UK residents (GDPR)
In addition to the rights above, you have the right to:
- Restrict the processing of your personal data in certain circumstances.
- Object to processing based on legitimate interests, including our crash and diagnostic data processing. Contact info@emancipatorgld.org to object.
- Data portability. Receive your personal data in a structured, commonly used, machine-readable format (provided as JSON through the Download my data feature).
- Lodge a complaint with your local data protection supervisory authority. A list is maintained by the European Data Protection Board at edpb.europa.eu. UK residents may contact the Information Commissioner's Office at ico.org.uk.
11.3 Additional rights for California residents (CCPA/CPRA)
California residents have the following additional rights:
- Right to know the categories and specific pieces of personal information we have collected about you.
- Right to delete your personal information (exercised through the in-app account deletion feature).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. We do not sell or share (as defined by the CPRA) your personal information.
- Right to limit use of sensitive personal information. Under the CPRA, data revealing religious beliefs is sensitive personal information. We process this data only for the purposes described in this policy and do not use it for purposes that would trigger the right to limit.
- Right to non-discrimination for exercising any CCPA/CPRA rights.
12. Children's privacy
The Service is not directed to children under the age of 13. We require all users to confirm they are 13 years of age or older when creating an account. We do not knowingly collect personal information from children under 13.
If we become aware that we have collected personal information from a child under 13, we will delete it promptly. If you believe that a child under 13 has provided us with personal information, please contact us at info@emancipatorgld.org.
Users in certain EU/EEA jurisdictions may be subject to a higher age of consent (typically 16). If you are in such a jurisdiction and are under the applicable age, your parent or guardian must consent to your use of the Service.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Each version of this policy is assigned a version number and an effective date, both shown at the top of the document.
Material changes — new categories of data collected, new categories of processors, changes to legal basis, or changes to international transfers — will be communicated to you by email to your registered address and through a non-blocking in-app banner. Continued use of the Service after a material change constitutes acceptance of the updated policy. If you do not agree with the changes, you should stop using the Service and delete your account.
Non-material changes — typo fixes, clarifications, formatting — will be reflected in the version number and effective date but will not trigger a notification.
Previous versions of this policy are available on request.
15. Contact us
For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Email: info@emancipatorgld.org
Final Global Movement, Inc.4030 Wake Forest Rd, Suite 349
Raleigh, NC 27609
info@emancipatorgld.org