Mortify Privacy Policy

Effective October 7, 2026

Mortify is operated by Gentle King, which is responsible for your data (the data controller). Write to us at mortify@gentleking.org with any question about your privacy or your data.

Mortify has no ads, analytics or tracking scripts, and we never sell your data.

Who Mortify is for

Mortify is for adults. When you begin, you confirm that you are 18 years of age or older. If we learn that someone under 18 has an account, we will delete it.

Your account

You sign in with a code sent to your email address. Your account keeps your email address, whether you are a brother or a sister, your chosen battles, any heart roots and occasions of sin you have written for the evening examination, your morning and evening times and time zone, your answer to whether you are trusting in Christ, your protection status, your place in the daily readings, and a record of when you used Flee and how it ended. These follow you to a new phone. Those who run Mortify can see them; your brethren cannot, unless you choose to share them.

Your journal, confessions and reflections

The text you write in the journal, and your confessions and reflections after a fall, are encrypted on your phone with AES-GCM before they are saved. They are encrypted with a random key. Each phone keeps that key locked with its own PIN, and that copy never leaves the phone. Your account keeps the key only locked with the 20-character recovery code you are given when you set your PIN. Your PIN, your recovery code and the unlocked key never leave your phone, and we never receive them, so we cannot read this text.

The battle, the date, and any tags you choose for an examination (such as its occasions and roots) are stored alongside the encrypted text so Mortify can show you patterns. They are not encrypted.

To open your journal on a new phone, or if you forget your PIN, enter your recovery code and choose a PIN for that phone. If you save the code in your browser's password manager, your browser keeps it under its own policies; Mortify does not receive it. If you lose both, no one can recover the text, including us. Your journal text is never shared with your brethren and never appears in notifications.

You may choose to unlock with your fingerprint or face. In the phone apps, the key is then kept in the phone's secure storage (Android Keystore or the Apple Keychain). In the web app, your phone makes a passkey for Mortify that is used only to lock a copy of the key kept on that phone; the passkey is never sent to us. Mortify never receives your fingerprint or face data. If you turn off the PIN lock, anyone who can open Mortify on your phone can read your entries. An export of your data is a readable file; keep it somewhere safe.

Your brethren

If you join a circle of brethren, your account also keeps your profile: the name, sex, church and optional phone number you give. Only brethren of the same sex whom you have accepted can see it, and a circle holds at most eight. When someone enters your code to ask to link with you, they see a short preview of your profile so they can be sure it is you. There is no public feed and no way to search for strangers. You can decline a request and block the person who sent it, and you can get a new code at any time; your old code then stops working.

You can also send an invite: a one-time link for one person of your own sex. Whoever opens it sees the same short preview, and when they confirm, the two of you are linked, because sending the invite was your yes. An invite works once and for seven days. Your account keeps a scrambled copy of it, when you made it, and who used it and when.

You choose whether your brethren can see your battles, when you were tempted or stood firm, your falls, and your protection status. Falls are private unless you turn them on. Messages you send are short plain text without links, and they are stored so your brother or sister can read them. They are separate from your private journal and are not encrypted on your phone.

Reports

If you report a message, the link with the sender is removed and they are blocked at once. The report records who reported whom, and keeps a copy of the reported message and the sender's name at that time. It is kept privately for us to review and is never shown to other users. When a report arrives, we receive an email that names the report but does not include the message. A report is kept until the person who made it deletes their account, even if the reported person deletes theirs, so that abuse cannot be hidden by deleting an account.

Notifications and reminders

With your permission, Mortify sends reminders and lets you know about messages from your brethren. On a phone app, reminders run on the phone itself. On the web, our server sends them. Message notifications travel through web push services, Firebase Cloud Messaging and Apple's push service. We store a notification address for each device so they reach you, and remove ones that have expired. A notification may include the sender's name; if you turn on discreet notifications, it says only that there is a new message. You can turn notifications off in your phone's settings, or remove a device by signing out on it.

Protection on your phone

On Android, if you turn protection on, Mortify runs a filter on the phone that blocks a list of harmful sites, turns on SafeSearch, and sends website name lookups over an encrypted connection to CleanBrowsing's family filter. CleanBrowsing can see the names of sites looked up and your network address; see CleanBrowsing's privacy policy. Mortify does not send your traffic through our own servers, does not read the pages you visit, and keeps no history of your browsing.

On iPhone, Mortify uses Apple's Screen Time controls to turn on Apple's adult website filter after you allow it. Mortify does not receive a list of the sites you visit. On either phone, your brethren see only whether protection is on or off, and only if you choose to share it.

Problem reports

If you use Report a problem in Mortify, your email app opens a message to us that you can read and change before sending. It includes the Mortify version, the kind of device, and your browser's description of itself, and nothing from your account or journal.

Who handles your data

Each handles data under its own policies. Your account data is kept until you delete it. Our database provider makes no scheduled backups of it and keeps its server logs for about a day. Our email provider keeps sign-in and report emails, with their delivery records, for 30 days. So after you delete your account, a copy of your email address may remain in those records for up to 30 days, and then it is gone.

If you live in the UK or the European Union

These laws give you particular rights, and they ask us to say why we use your data.

Your data is stored in the United States. Our providers protect data sent there from the UK and the European Union with the European Commission's standard contractual clauses and the UK's equivalent terms.

You have the right to see the data we hold about you, to correct it, to receive a copy of it (Mortify's export gives you one), to have it deleted, and to object to or limit how we use it. Write to us at mortify@gentleking.org and we will answer within one month. You also have the right to complain to the data protection authority where you live, such as the Information Commissioner's Office in the UK.

Your choices and deleting your data

In Mortify, go to Settings, then Account and data, to download your data or to sign out and clear Mortify from a phone. Clearing a phone leaves your account as it is.

To delete your account, go to Settings, then Account and data, then Delete my account, while connected to the internet. This permanently removes your account and everything in it: your preferences, records, encrypted entries, profile, links, messages, shared events, notification addresses and settings. A brother or sister may still remember a message you sent.

You can also ask us to delete your account without the app. See Delete your Mortify account.

Changes

We will update this policy when our practices change and change the date above.