Selah Privacy Policy.

Y7 Technology LLC ("we," "our," or "us") operates Selah, an AI companion for reading the Bible and reflecting on Scripture. This Privacy Policy explains what information we collect, how we use it, and the controls you have. Selah is designed to be private and offline-first. The app runs fully offline with no account required; the features described below apply only when you use them. This Privacy Policy complies with: • Japan's Act on the Protection of Personal Information (APPI) • European Union General Data Protection Regulation (GDPR) • California Consumer Privacy Act (CCPA) • Other applicable privacy laws worldwide

Y7 Technology LLC Representative: Yudai Sasaki Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan Email: support@y7technology.com For EU users: We are the data controller responsible for your personal data. For California users: We are the business as defined under CCPA.

Selah collects as little as possible. Reading the Bible happens on your device. Your reading record (saved verses, highlights and notes, reading progress) is kept on your device and backed up to your account so it follows you to a new device. Account Information (only if you sign in) • Selah signs you in anonymously so your history and reading record can have an identity — this does not require any personal information. • If you choose Sign in with Apple or Google, we receive the identifier (and, if you allow it, name and email) provided by that service. With Sign in with Apple you may use Apple's "Hide My Email" relay. Questions You Ask (only when you use "Ask") • The text of a question you submit is sent to our backend and to our AI providers to generate a grounded reflection (see "Third-Party Services"). • Your questions and the reflections you receive are saved to your history so you can return to them. Read Together (only if you start or join a reading circle) • A reading circle is a small group (at most 12 people), each reading at their own pace, joined only with an invitation code a member sends. • We store the circle's name, the name you choose for that circle, how many chapters you read each day and the last chapter you read that day (for example "Mark 6"), and when you tap "Pray for" another member. • Only the members of your circle can see this — their circle names, whether each read today and which chapter, and who prayed for whom today. Nobody outside the circle can see the circle or its members. • Nothing else is shared with the circle: not your questions, your saved verses, your notes, or any other reading. Your Reading Record (backed up to your account) • Your saved verses, verse highlights and notes, the chapters you have read and on which days, your last-read place, and the reading plan you chose are stored on your device and backed up to your account on our backend, so they come back on a new device when you sign in with the same Apple or Google account. • Only you can read your reading record. It is not shared with reading circles or anyone else, and it is not used to train AI models. Stored On Your Device Only • App preferences (text size, theme, language, reminder time) are stored locally on your device and are not transmitted to us. Anonymous Usage Counts • The app adds 1 to daily counters on our backend for a fixed list of events (for example "a chapter was read", "the subscription screen was shown", "a purchase completed"). Each counter records only the day, the event name, the platform (iOS or Android) and the app version — no user id, device id, IP address or time of day is stored with it. We use these totals to see whether the app is helping readers. Payment Information • If you purchase a subscription, the transaction is processed by the store you downloaded Selah from — the Apple App Store or Google Play. We receive subscription status, not your card details. Device and Technical Data • Selah contains no crash-reporting, analytics, or attribution SDK, and no diagnostic report is sent from your device. • Notification address (only if you are in a reading circle and allow notifications): we store the push token your device's notification service (Apple Push Notification service, through Google Firebase Cloud Messaging) gives the app, with the platform and your app language, so that we can tell you when a circle member prays for you or joins. The notification text passes through Firebase Cloud Messaging. We collect no other device identifiers. • When the app contacts our backend (for "Ask", reading circles, backing up your reading record, anonymous usage counts, sign-in, or account deletion), our hosting provider records a standard server log entry — including the request time, the endpoint, and the originating IP address — as any web service does. We use these logs only to keep the service running and to prevent abuse. We do NOT collect health data, contacts, photos, precise location, or advertising identifiers, and Selah contains no third-party advertising or tracking SDKs.

Service Provision • Signing you in and syncing your Ask history and reading record across your devices • Generating grounded, cited reflections in response to your questions • Showing the members of a reading circle to each other, as described above • Providing and stabilizing the app Service Improvement • Investigating backend errors recorded in our server logs to improve reliability Communication • Responding to customer support inquiries Security and Legal • Preventing abuse of our backend (which incurs paid AI costs) • Complying with legal obligations and enforcing our Terms of Service Payment Processing • Managing subscription status (payments are handled by the Apple App Store or Google Play) We do not use your questions or history to target advertising, and we do not sell your personal data.

Selah quotes Bible verses verbatim from a trusted, licensed text database. The AI's reflection is generated separately and is clearly labeled as commentary. Verse text is never generated by the AI — if a reference cannot be grounded in the source text, it is dropped rather than fabricated. This is a core design commitment, not merely a privacy note.

For EU users, we process your data based on: Consent • Sign in with Apple or Google • Optional profile information you choose to provide Contract Performance • Providing the Selah service and syncing your history • Processing subscriptions Legitimate Interests • Reliability, security, and prevention of backend abuse Legal Obligation • Compliance with tax, accounting, and lawful requests

We use a small number of service providers ("sub-processors") strictly to operate Selah. They are contractually obligated to protect your data and use it only for the purposes below. • Supabase — authentication and secure database hosting for your account, Ask history, reading record and reading circles. • Google Firebase Cloud Messaging — delivers reading-circle notifications to your device (push token and notification text only). • OpenAI — the language model that composes reflections. When you use "Ask," your question text and the retrieved Bible passages are sent to OpenAI to generate the reflection. Under OpenAI's API terms, this data is not used to train their models. • Voyage AI — converts your question into a numerical representation ("embedding") to search for relevant passages. • RevenueCat — manages subscription status (only if in-app purchases are enabled). • Apple / Google — identity providers, only if you choose to sign in with them. • Apple App Store / Google Play — processes any purchases, depending on where you downloaded Selah. We do NOT sell your personal data, and we do NOT share it with advertisers. Legal Requirements We may disclose information if required by court order, law, or regulatory request, or to protect the rights, safety, and security of our users and service. Business Transfers In a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to this Privacy Policy.

Technical Safeguards • Encryption in transit (TLS/SSL) • Encryption at rest for data stored on our backend • Access controls and per-user data isolation (row-level security) Organizational Measures • Data minimization by design • Restricted access to production systems • Incident response procedures No system is 100% secure. If you sign in with a third-party account, keep those credentials safe and report suspicious activity to support@y7technology.com.

On-device app settings (text size, theme, language) remain until you uninstall the app; deleting your account does not change them. Your reading record (saved verses, highlights and notes, reading progress, last-read place, reading plan) is kept on your device and in your account while your account exists. Deleting your account deletes the backed-up copy and erases the copy on that device. Uninstalling the app removes only the device copy. Reading-circle data is kept while you are a member. Leaving a circle deletes your membership and the prayers you sent or received in it. Deleting your account removes you from every circle and deletes your daily reading counts. Account and Ask history are retained while your account is active. After account deletion, associated data is removed from our active systems within 30 days and may persist in backups for up to 90 days. Some records may be retained longer where required by law. You can request deletion of your account and associated data by contacting support@y7technology.com.

General Rights (All Users) • Access: Request a copy of your personal data • Correction: Update inaccurate information • Deletion: Request deletion ("right to be forgotten") • Data Portability: Receive your data in a machine-readable format • Objection: Object to certain processing To exercise these rights: support@y7technology.com GDPR Rights (EU Users) • Withdraw consent at any time • Restrict processing • Lodge a complaint with your local supervisory authority CCPA Rights (California Users) • Know what personal information is collected and disclosed • Say no to the sale of personal information (we do NOT sell personal data) • Request deletion • Non-discrimination for exercising privacy rights APPI Rights (Japanese Users) • Disclosure, correction, addition, or deletion • Suspension of use or of provision to third parties

Your data may be processed in countries other than your own, including Japan, the United States, and Singapore (our database region). For EU users, we rely on appropriate safeguards such as EU Standard Contractual Clauses (SCCs) and require our service providers to meet EU data protection standards.

Selah is not directed to children under 13 (or the age of majority in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact support@y7technology.com and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes take effect 30 days after we post notice; non-material changes take effect immediately. We will notify you of significant changes via in-app notice or on our website. Your continued use after changes constitutes acceptance of the updated Privacy Policy.

For privacy-related questions, requests, or complaints: Email: support@y7technology.com Company: Y7 Technology LLC Representative: Yudai Sasaki Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan Response Time • 30 days (GDPR requirement for EU users) • 45 days (CCPA requirement for California users) • Reasonable time frame for other jurisdictions