Privacy policy

In short

• There are no accounts, no sign-in and no advertising. We never sell or rent information, and we don’t track you across other apps or websites.
• Analytics are off until you accept them, and they use a random number, not your name, phone number or contacts.
• Films and books you share with a nearby phone go straight from your phone to theirs. They do not pass through us.
• You can delete what analytics recorded from your phone at any time on the Delete my data page.

The iPhone and Android apps

The apps contain the same library as this website and follow this same policy. They ask the same analytics question the first time you open them. When you accept, each record also says whether it came from the iPhone app, the Android app or the website, and the app’s version number, so we can spot a broken release.

• Camera. Used only while you scan a QR code, to open a library or receive a film from another phone. Pictures are read on your phone and are not saved or sent anywhere.
• Wi-Fi and local network. Used for sharing with no internet: one phone makes a small Wi-Fi network of its own and the other joins it to receive files. Files travel only between the two phones.
• Location (older Android phones only). Android 12 and older require location permission before an app can start that Wi-Fi network. The app never reads or records where you are. Newer phones ask for “nearby devices” instead.
• Storage. Films and books you choose to keep are saved inside the app on your phone. Removing the app removes them.
• Internet. When online, the app checks this site for app updates (sending only “iPhone” or “Android” and the app’s version number), loads library items from their publishers and, if you accept, sends analytics.

What we measure when you accept

• Pages opened, the selected library language, and resource IDs for content you open, play, save or share. Playback events may include the number of seconds reached.
• Sharing methods you choose in the site, such as email, WhatsApp, Telegram, copying a link or Nearby, and whether a supported action completes, fails or is cancelled.
• Visits from shared links. With analytics accepted, a shared link can contain a random reference and the sharing method. A visitor arriving through that link is counted only if they also accept analytics.
• The referring website’s domain, when the browser supplies it, and a broad country when the hosting platform supplies it. A country is an estimate, not your precise location.
• A random browser identifier and a session identifier, event times, and transferred byte counts where the site knows them. These identifiers let us count browsers and sessions; they do not identify a person.

Resource activity can reveal what religious material you use. Accept analytics only if you are comfortable including that activity in the site’s private reports.

What sharing reports can tell us

We can confirm copying a link, writing a file through the site, or receipt of a Nearby transfer. Opening an email app is a sharing attempt. Opening or handing data to your phone’s share sheet does not confirm delivery. A browser-managed download does not let us verify that you saved the file.

We cannot read your email, contacts, private messages or shared file contents. We cannot see who receives a link, where a copied link is pasted, which app you choose in the native share sheet, or later sharing outside this site. We do not record precise GPS locations, raw IP addresses, personal filenames, pairing codes, search text or complete referring URLs in analytics.

Sharing an item with a friend

When you share an item from its page, the name you type is remembered on your phone so you don’t have to type it again, and it goes into the message and the link so the person you send it to knows it came from you. The link also carries a step number for the sharing chain. Neither your name nor theirs is sent to the analytics dashboard.

If you send by email, this site’s outreach mailbox sends one message to the address you type. We use that address only to send that message and, in a scrambled one-way form, to limit how many emails one address can receive in a day. We don’t keep it or add it to any list.

Printed QR codes

Our printed library QR codes open a short link that adds one to a daily count for that library, with a broad country when the hosting platform supplies it, and then opens the library. This count is kept whether or not you accept analytics because it holds no browser identifier, cookie, IP address or activity, only the number of scans per library, day and country. Counts are kept for up to 90 days.

Storage and retention

We remember your accept/reject choice in browser storage for up to 180 days. After acceptance, a random browser identifier lasts up to 90 days, and a session ends after 30 minutes of inactivity. Activity records are retained for up to 90 days and are available to the site administrator through a password-protected dashboard.

The online edition sends accepted analytics to this site’s own endpoint. Its database can be provided by Upstash Redis. A library served from a local computer or Raspberry Pi stores accepted activity on that server; it is not uploaded to the online dashboard. Expired local records are cleared hourly while that server runs and when it next starts or accesses the database. A library opened directly from a card with file:// collects no analytics. Temporary unsent activity is held in page memory for up to 10 minutes and may be lost when you close the page.

Necessary local preferences, such as language and theme, and the service worker’s offline app cache support the library independently of analytics. Administrators use a necessary, temporary sign-in cookie. External publishers and the Nearby connection broker may receive their own connection requests when you use their services; rejecting this site’s analytics does not block those requested services.

Services we rely on

The website and its small database are hosted by Vercel and Upstash. Library items stream from their publishers, such as the Digital Bible Society, and online phone-to-phone sharing uses a PeerJS connection broker to introduce the two phones. Emails you ask us to send go out through our outreach mailbox. Each of these receives only what it needs to do that job, such as your phone’s internet address when it connects.

Children

The library is for everyone, including families. We don’t ask anyone for their name, age or contact details, and analytics hold no personal information. If you believe a child has sent us personal information, for example by writing to us, email us and we will delete it.

Deleting your data

The Delete my data page turns analytics off and deletes every record sent from your phone or browser, straight away. Without that, records are deleted automatically after 90 days. Removing the app or clearing this site’s data deletes everything stored on your phone. You can also email villageserverinitiative@gmail.com and we will help.

Changing your choice

Use Cookie settings on any library page to turn analytics on or off. Rejecting analytics stops future collection, clears this browser’s analytics identifiers and discards unsent activity. Previously received activity remains until its retention period ends. Clearing browser storage removes your preference and the site will ask again.

If your browser sends Global Privacy Control, analytics stays off. Browsers that block storage may ask again on another page. The library continues to work.

Changes and contact

If this policy changes, we update it here and change the date at the top. For anything else, see Help and contact.