Data collected

What	Why
Google account email	Allow-list check to grant or deny access
Google display name	Shown in the account section
Session cookie (doulos_sess)	Keeps you signed in
Highlights you create	Saved to your account so they persist and follow you across devices

Your highlights (the passages and words you mark, with their colour) are stored server-side against your account so they persist across reloads and devices. No other reading activity — what you read, search, or look up — is stored server-side.

Retention

• Session cookie expires on sign-out or after 30 days of inactivity.
• Server logs (to the host journal, not a database) record a truncated SHA-256 hash of your email on login — not reversible — plus a per-request access line: a random request id (returned as X-Request-Id, not tied to your identity), method, path, status and timing. Paths reveal what you fetched in transit but are not retained per account.

Third-party sharing

Your data is not sold, rented, or shared with any third party. When error monitoring is configured (Sentry / self-hosted Glitchtip), unhandled server errors are captured with cookies stripped and no personal data attached; if none is configured, nothing is sent.

Deletion / contact

Open an issue at github.com/barryoosthuizen/doulos (label "privacy") or email privacy@doulos.bible.

← Back