Privacy Policy

Effective September 18, 2026

This policy describes how Torato LLC ("Torato," "we," "us") handles information in the Torato apps for iOS and Android and the services at torato.ai. The short version: you can read and study without an account, the questions you type are never stored on our servers or shown to anyone else, and we do not run ads, sell data, or use third-party analytics or advertising SDKs.

Information we collect

Device registration

When the app first connects, it registers your device with a random installation identifier and a device-integrity check from the platform — Apple's App Attest on iPhone, Google's Play Integrity on Android. We keep the identifier, the platform, and the outcome of the integrity check. The identifier is not your name, email, phone number, or store account; we use it to authenticate requests, prevent abuse, and apply per-device service limits. The app shows the short form of this identifier under About → Account so you can reference it when contacting support.

Account information (optional)

You do not need an account to use the app. If you create one, we collect your email address and either a password or the sign-in you choose from a supported provider, handled securely with our partners. We store your email address, a stable identifier from the sign-in provider, and your service tier. Your account links your service tier and limits across devices.

The on-device model

Reading and studying can run entirely on your phone using a language model (Google's Gemma) that the app downloads from our servers on request. So that the download stays available only to registered devices, we record which device fetched which model version and when, the app's user-agent string, and a keyed hash of the network address the request came from. Questions answered by the on-device model never leave your phone.

Questions and study activity

• Questions you type yourself are never stored on our servers and are never shown to other users. If a typed question is answered by Cloud AI, the question text and the selected passage are sent to our server and processed with our partners to generate the answer. We do not use your questions for any other purpose, and we would retain or disclose them only where the law requires it (for example, a valid law-enforcement request). Our partners process them under their own policies, linked below.
• Questions generated by the app (study cards, the historical-setting question, and "define a word" lookups) may be stored with their answers after an automated review, and promoted to other users based on aggregate interest. They contain no personal information — they are machine-authored.
• When you view a community or reviewed answer, the app saves a copy on your device, and interactions (a card being opened, a vote, a report) are recorded against your anonymous device identifier so that voting is one-per-device and moderation works. A report includes the category you chose, any note you write, the passage, the question, the answer text, and the app version — please don't put personal information in a report note.

Cloud AI usage and subscriptions

To enforce the monthly Cloud AI allowance and prevent abuse, we record per-device (or per-account) totals of cloud usage and its cost. If you subscribe to Cloud AI, the purchase is made with the App Store or Google Play — we never see your card or bank details. The store gives us a purchase token, the product and plan you bought, the subscription's state and expiry, and whether it renews; we store these against your device or account to grant access and to restore purchases on a new phone, and we verify them with the store.

Sharing

When a subscriber shares a study, the link opens a public page on torato.ai showing the passage, the question, and only an answer that has already been reviewed and approved. The page does not show who shared it, and we do not record who opened it beyond standard server logs.

Maps

When you open a historical map, the map imagery is loaded from map providers — Apple Maps on iPhone, Esri's World Imagery on Android, and the Digital Atlas of the Roman Empire for the ancient-roads layer. Like any web request, loading tiles reveals your network address to the provider. The places shown come from the passage, never from your location.

Contact form and beta list

If you write to us through the support form, we keep your name, email address, message and a keyed hash of your IP address for as long as needed to answer you and to prevent abuse of the form, then delete them. If you join the beta list, we keep your email address, the platform you chose, your name if you gave one, and the time you consented, until the beta ends or you ask to be removed; we use them only to send beta invitations and beta-related updates. Neither list is shared with anyone or used for marketing.

Pastor partner accounts

Pastors who review study material through our partner portal give us their name, email, church, a short bio, a photo, credentials, and public profile links. With their agreement, the name, bio, photo, credentials and links are published on torato.ai and in the app next to the answers they reviewed. Portal actions are logged for accountability.

Email

If we send you transactional email (for example, account notices or a beta invitation), we record delivery events such as bounces and complaints so we stop emailing addresses that don't want or can't receive mail.

Server logs

Like nearly every internet service, our servers keep standard request logs (including IP address and request metadata) for security, abuse prevention, and troubleshooting. Logs are retained for a limited period and are not used to profile you.

What we do not collect

• No advertising identifiers, no ad networks, no data brokers.
• No third-party analytics or tracking SDKs.
• No tracking across other companies' apps or websites.
• No location data. Historical maps show ancient places from the text, not your location.
• No contacts, photos, microphone, or other device content.
• No payment card or bank details — purchases are handled by the App Store and Google Play.
• We never sell personal information.

How we use information

We use the information above only to provide and secure the service: authenticating devices, answering questions, delivering the on-device model, syncing community content, enforcing usage allowances, granting and restoring subscriptions, moderating reported content, running the beta programme, and responding to support requests.

Third parties

We share data only with our partners, and only what each needs to help us run Torato. Our partners process data on our behalf under terms that require protection of user data equal to this policy. Questions answered by Cloud AI are processed with an AI partner to generate the answer; we do not send your name, email, or device identity alongside them. Our AI partner states that it does not use this content to train its models; the model providers it routes requests to operate under the policies linked below. Answers generated on your device do not leave your device. Device-integrity checks and subscription verification are performed with the platform that runs your phone's app store. We do not share data with anyone else unless required by law.

Our partners

• Amazon Web Services, Inc. — Privacy Notice
• Apple Inc. — Privacy Policy
• Google LLC — Privacy Policy
• OpenRouter, Inc. — Privacy Policy · Terms of Service
• Esri (Environmental Systems Research Institute, Inc.) — Privacy Statement

We will keep this list current as our partners change.

Cookies

The torato.ai website sets no tracking or advertising cookies. We use only essential on-device storage — for example, remembering that you dismissed the cookie notice. The app likewise keeps your settings and saved content on your device, not in cookies.

Retention and deletion

• Account data is kept while your account exists. You can delete your account in the app at About → Account → Delete Account, which permanently removes your account and the data associated with it from our servers. If you can't access the app, contact us through the support form using your sign-up address and we'll verify it and delete the account for you.
• Anonymous device records (identifier, integrity outcome, votes, usage totals, model-download records, subscription state) are kept while the installation is active. Deleting the app removes everything stored on your device; you may also ask us through the support form to have a device record deleted — include the device code from About → Account.
• Subscription records are kept for as long as needed to honour the subscription and to answer billing questions afterwards.
• Support messages and beta signups are kept as described above.
• Server logs and email delivery events are retained for a limited period and then deleted.

Your choices

Using the app without an account keeps you anonymous to us. You can revoke any consent and exercise access, correction, or deletion rights at any time — in the app where a control exists, or through the support form. We respond to all requests within 30 days.

Children

Torato is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

Security

All traffic between the app and our servers is encrypted in transit (TLS). Server data is stored encrypted at rest with access limited to what operating the service requires.

Changes

If we change this policy, we will update this page and its effective date. Material changes will be flagged in the app.

Contact

Questions about this policy or your data: use the support form.