koinonia-legal

Koinonia — Privacy Policy

Effective date: May 13, 2026 Last updated: May 13, 2026

This Privacy Policy explains how Koinonia (“we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use the Koinonia mobile application (the “App”). By using Koinonia, you agree to the terms described in this policy.

Koinonia is a community platform for believers to share faith through scripture, reflection, and conversation. We take your privacy seriously and aim to be honest and direct about what data we collect and why.

1. Who we are

Koinonia is an independent project operated by Mauricious Frimpong. We are based in Ghana but operate the App globally. You can contact us at:

Email: koinoniaapp.app@gmail.com

This email is the contact point for all privacy questions, data requests, and complaints under this policy.

2. Information we collect

2.1 Information you provide to us

When you create an account, we collect:

Email address (required, used for login)
Username (required, displayed publicly)
Display name (required, displayed publicly)
Password (required, never stored in plain text — we store only a cryptographically hashed version using bcrypt, which cannot be reversed)

When you update your profile, you may optionally provide:

Bio (a short description, displayed publicly)
Profile picture (uploaded by you, hosted on a third-party image service — see Section 5, displayed publicly)

2.2 Information generated by your use of the App

As you use Koinonia, we collect:

Posts you create (content, optional title, topic category, timestamps) — displayed publicly
Comments you write (content, timestamps) — displayed publicly under the relevant post
Likes, reposts, and favorites you make on posts (which post, which user, when) — aggregate counts are public; we do not publish individual user lists
Follows between users (who follows whom) — counts are public
Post views (which posts you have opened) — used internally to display view counts; we do not expose your viewing history to other users
Notifications generated for you (when someone likes, comments, reposts, or follows you) — visible only to you

2.3 Authentication tokens

When you log in or register, we issue a JSON Web Token (JWT) that is stored locally on your device in encrypted storage (iOS Keychain or Android Keystore). This token is sent with each request to authenticate you. We do not store the token on our servers — it lives only on your device.

2.4 Information we do NOT collect

We want to be explicit about what we do not collect:

We do not collect your phone number
We do not collect your location or GPS coordinates
We do not collect device identifiers, advertising IDs, or tracking IDs
We do not access your contacts
We do not access photos other than profile pictures you explicitly upload
We do not collect payment information (the App is free to use)
We do not send analytics data to third parties
We do not use third-party advertising networks

3. How we use your information

We use the information we collect to:

Provide the core features of the App (allow you to post, comment, like, repost, favorite, follow, and view content)
Authenticate you and keep your account secure
Show notifications to you when other users interact with your content
Display public information (posts, comments, profile details) to other users
Calculate aggregate statistics shown in the App (such as like counts, view counts, follower counts, and total likes per user)
Respond to your inquiries and support requests

We do not use your information for advertising, profiling, or any commercial purpose beyond operating the App.

If you are in the European Union, the United Kingdom, or another jurisdiction governed by the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

Performance of a contract — we need to process your data to provide the App’s services to you
Consent — when you create an account, you consent to this processing
Legitimate interest — to keep the App secure, prevent abuse, and improve functionality

You can withdraw your consent at any time by deleting your account (see Section 8).

5. Third-party services

We use the following third-party services to operate Koinonia. Each handles a specific portion of your data:

5.1 Cloudinary

When you upload a profile picture, the image is sent directly from your device to Cloudinary’s servers. We store the resulting image URL in our database. Cloudinary may also process the image (resize, optimize) according to their own privacy practices. Cloudinary’s privacy policy is available at https://cloudinary.com/privacy.

5.2 Neon (PostgreSQL database)

All your account information, posts, comments, and activity are stored in a PostgreSQL database hosted by Neon (Neon Inc.). Neon’s servers are located in London, United Kingdom. Neon’s privacy policy is available at https://neon.tech/privacy-policy.

5.3 Render

Our backend application is hosted on Render. All API requests you make pass through Render’s servers (located in Frankfurt, Germany) before reaching our application. Render does not retain your personal data outside of standard server logs (kept for 7 days). Render’s privacy policy is available at https://render.com/privacy.

5.4 Google Play

The App is distributed through the Google Play Store. Google may collect information about your installation and use of the App according to their own policies. Google’s privacy policy is available at https://policies.google.com/privacy.

We do not use any other third-party services that process your personal data. We do not integrate with analytics services, crash reporting tools, advertising networks, or social login providers.

6. Data storage and security

6.1 Where your data is stored

Database: Neon servers in London, United Kingdom (within the EU)
Backend: Render servers in Frankfurt, Germany (within the EU)
Profile pictures: Cloudinary’s global content delivery network
Authentication tokens: Only on your own device

6.2 How we protect your data

All communication between your device and our servers uses HTTPS encryption (TLS)
Passwords are stored as bcrypt hashes, which cannot be reversed
JWT tokens are stored in your device’s secure storage (encrypted by the operating system)
Database access is restricted to our application using authenticated connections
We do not transfer personal data to any party outside the services listed in Section 5

6.3 Limitations

No system is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. If we ever become aware of a data breach affecting your information, we will notify affected users promptly through the App and by email.

7. Data retention

Your account data (email, username, profile, bio, profile picture URL) is retained for as long as your account exists. When you delete your account, this data is removed permanently from our active systems within 30 days.
Your posts and comments are retained until either you or the author deletes them, or you delete your account (which also deletes everything you created).
Likes, reposts, follows, and favorites are retained until the underlying record (the post, the user, etc.) is deleted, or you delete your account.
Notifications directed at you are retained until you delete your account, or until 90 days have passed since their creation (we may add automatic purging of older notifications in the future).
Server logs are retained by our hosting provider (Render) for approximately 7 days, after which they are automatically purged.
Authentication tokens are stored only on your device and expire after 30 days, after which you will be asked to log in again.

When you delete your account, we cascade-delete all data you created (posts, comments, likes, follows, favorites, notifications, profile picture URL, account record). Profile pictures hosted on Cloudinary may persist for an additional period determined by Cloudinary’s own retention policy; contact us if you require immediate removal.

8. Your rights

You have the following rights regarding your personal data:

8.1 Right to access

You can view all the data we have about you directly within the App: your profile screen shows your account details, your posts, your followers and following, and your activity. If you require a structured export of your data, contact us at the email above.

8.2 Right to rectification

You can edit your display name, bio, and profile picture at any time through the Edit Profile screen.

8.3 Right to erasure (“right to be forgotten”)

You can delete your account at any time through the Delete Account option on your profile screen. This permanently removes your account and cascade-deletes all data you created.

By deleting your account, you withdraw consent for us to process your personal data.

8.5 Right to lodge a complaint

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with a data protection authority. In Ghana, this is the Data Protection Commission. In the EU, this is your national supervisory authority.

8.6 Right to data portability

If you would like an export of your data in a portable format, contact us at koinoniaapp.app@gmail.com and we will provide it within 30 days.

9. Children’s privacy

Koinonia is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided personal information to Koinonia, please contact us at koinoniaapp.app@gmail.com and we will delete the information promptly.

Users between 13 and the age of majority in their jurisdiction should obtain parental or guardian consent before using the App.

10. Public content disclaimer

Posts, comments, and profile information you share on Koinonia are visible to other users of the App by design. Do not share information that you do not want to be public. Even after you delete a post or comment, other users may have already seen, screenshotted, or otherwise recorded the content. We cannot guarantee that public content can be completely erased from all third-party copies.

11. Guest mode

You may use Koinonia in “guest mode” without creating an account. In guest mode, we do not collect any personal information about you — no email, no username, no posts, no activity. The only data exchanged is what is needed to display public content (which posts to fetch, etc.). Guest sessions do not persist across app launches; closing the App ends your guest session entirely.

12. International data transfers

If you are using Koinonia from outside the European Union, your personal data will be transferred to and stored on servers in the EU (Neon in London, Render in Frankfurt). By using the App, you consent to this transfer. We rely on Standard Contractual Clauses (SCCs) and the legal frameworks of these regions to safeguard your data during transfer.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date at the top of this document. If the changes are material, we will notify you through the App or by email. Continued use of the App after a policy update constitutes acceptance of the revised policy.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Mauricious Frimpong Email: koinoniaapp.app@gmail.com

We aim to respond to all privacy-related inquiries within 30 days.

This policy is provided in good faith. It is not legal advice. If you require legal certainty for compliance purposes, consult a qualified attorney in your jurisdiction.