Alleluya — Privacy Policy

This is a translation provided for convenience. In case of any discrepancy, the Italian version prevails.

Last updated: October 25, 2026

Alleluya is a Christian social network designed for fellowship, prayer, and spiritual growth. Your privacy is important to us. This policy explains what data we collect, how we use it, and what rights you have.

1. Data Controller

The data controller is Alessandro Alise Editore, III Traversa Via Castagna 71 - 80026 Casoria (NA), Italy, VAT no. IT05331031210. For any request regarding your personal data you can write to us at mail@alleluya.app.

2. Data We Collect

We collect the data you provide when you register and use the app: first name, last name, username, email address and, optionally, bio, location, the community you belong to, and profile images. We also collect the content you create, such as posts, prayer requests, comments, reactions, and private messages.

If you sign in with "Sign in with Apple" or with Google, we receive from the provider an identifier and the associated email address. With "Sign in with Apple" you can choose to hide your email: in that case, we receive an anonymous Apple relay address. We also collect the minimal technical data necessary for operation and security (for example, session tokens and the app version).

For internal statistics we also derive the approximate country where you use Alleluya: from the region set on your phone or, if that is not available, from your internet connection. We keep only the country code (for example IT), never your internet address or your precise location, and we use it only to understand in which countries the community is present.

To show and order content we also record how you use Alleluya: Likes, Amens, comments, shares and saves, the content you have already seen and for how long (for example how many seconds you stay on a post or watch a video) and choices such as "Not interested".

We save the people and pages you search for or visit to show them among your recent searches: only you can see them and you can delete them at any time. If you answer an Alleluya survey we keep your answers to learn the community's preferences: results show only totals and written answers without your name.

In lives the audio travels live between participants through our server and is never recorded or stored; we keep only the title, the description, who opened the live, who took part and in which role (for example who spoke) and the times.

To understand which parts of the app are used and improve them, we record for each day which sections you opened, for how long and how many times, how you opened the app (directly, from a notification or from a link) and what type of content you saw, without the content itself, along with the type of device and the app version. This data stays on Alleluya, we don't give it to outside services, we use it only in aggregate form and we delete it after 120 days. You can turn it off in Settings → Privacy → Usage statistics.

Dedicated links. Some of our links (for example the ones we give to churches or post on our social media profiles) help us understand where new members come from. When you open one of these links we count the click and keep, for 7 days, only an encrypted fingerprint of the network you open it from: never your IP address, no cookies, no data from your phone. If you sign up within 7 days from the same network, we note on your account which link you came from (for example «a church»). We use this only for internal, aggregate statistics. Nobody else sees it and we do not use it to profile you. We do this on the basis of our legitimate interest in understanding which channels work (Art. 6(1)(f) GDPR). You can object at any time by writing to us: we will remove the source from your account.

Automated test accounts. We recognize accounts created by the app stores' automated test devices (for example Google Firebase Test Lab), to leave them out of our statistics and, if needed, suspend or delete them. If you think your account was flagged by mistake, write to us and we will check.

3. How We Use Your Data

We use your data to provide you with the service: displaying your profile, publishing your content, enabling you to follow other people, join groups and lives, send and receive messages, receive notifications about your activity, and ordering the content you see (section 5). We use your email for service communications (for example, registration confirmation or password reset). We do not sell your personal data to third parties.

4. Legal Bases and Special-Category Data

We process your data to provide the service you asked for (contract, Art. 6(1)(b) GDPR), to meet legal obligations (Art. 6(1)(c)) and, for platform security, abuse prevention, moderation and internal statistics, on the basis of our legitimate interest (Art. 6(1)(f)).

Alleluya is a community of faith: your prayers, the content you publish and the churches, Pages and Groups you follow may reveal your religious beliefs; in prayer requests and other content you may also choose to share information about your health or other personal matters. The GDPR treats these as special-category data (Art. 9). We process them only with your explicit consent (Art. 9(2)(a)), which we ask for with a separate checkbox when you sign up (or at your first sign-in, if you joined earlier or with Apple or Google), so that you can use Alleluya and to personalize the content you see. We do not sell them, use them for advertising or share them with others for other purposes.

You can withdraw your consent at any time by deleting your account or writing to mail@alleluya.app; withdrawal does not affect processing carried out before. Without this consent Alleluya cannot be used, because faith content is at the heart of the service.

For internal statistics we also record, day by day, whether you used Alleluya and roughly for how long: it helps us understand how the community grows and is not shared with anyone.

5. Content Personalization

The order of content in Home and TV is calculated by Alleluya based on the people and Pages you follow, the language of the content (which we also derive from the texts you write), your interactions (Likes, Amens, comments, viewing time, "Not interested") and how recent the content is. In Faith, content is shown newest first and selected based on language and on whom you follow. The Alleluya team may also give, free of charge and at its discretion, a little more visibility to individual items or accounts (for example to people who have just joined), in Home and among the people to follow: this is not advertising and cannot be bought.

All of this happens on our servers, without external services: we derive the language from the most common words in texts, and we also take into account some features of the content, such as its format, its length or whether an image is mostly text.

This may involve faith content: we do it with your explicit consent and to provide the service. We do not use this data for advertising and we do not pass it on to anyone.

You can use the "Following" view, which shows only the people you follow in chronological order (currently on alleluya.app from a computer), hide individual items with "Not interested", and object to personalization by writing to mail@alleluya.app.

6. Content Visible to Others and Shared Links

Your profile and public content (posts, prayers, comments) may be seen by other users of the app. Messages aren't public: only the people in the conversation see them (in groups, the group's members).

When someone shares the link to a post or a prayer, anyone with the link can see that content even without an Alleluya account. Pages (churches, missions, music, media) and the posts they publish are public and may appear in search engines. People's posts and prayers shared with a link are not indexed.

Messages. Messages travel encrypted between your device and our servers, but they are not end-to-end encrypted: they are kept on our servers so you can see your conversations on all your devices. The Alleluya team doesn't read them, except in these cases: when a conversation or a message is reported (we see the latest messages of the chat to check the report, including earlier versions of edited messages) and when a message is held by the automatic check against spam and scams. The spam check examines the text automatically, on our servers. Notifications of new messages may show a preview of the text on your phone.

7. User-Generated Content and Moderation

Alleluya has zero tolerance for offensive, illegal, or abusive content and for harassing behavior. Content that is hateful, violent, sexually explicit, or defamatory, or that infringes the rights of others, is not allowed.

Every user can report posts, prayers, comments, profiles, private messages, Moments, Pages, Groups, events and lives from the "•••" menu or by long-pressing the content, and can block other users from their profile or from the chat. Anyone, even without an account, can report illegal content to us from the page alleluya.app/contatti. Reports are reviewed by people from our team, usually within 24 hours; in the meantime a reported post or prayer may be hidden automatically pending review.

If content breaks the Terms or the law we may remove it, make it visible only to its author, limit its visibility, or suspend or close the account, and we tell the person concerned, with the reasons and how to challenge the decision, except for mass commercial spam.

Anonymous prayers do not show the name to other users, but they remain linked to the account of the person who wrote them: the Alleluya team can see the author for moderation.

For moderation, Alleluya administrators can enter lives without appearing among the participants, to check reports and compliance with the Terms, and they can close a live for everyone. The audio is not recorded.

When you edit a comment or a message, we also keep the previous versions: only Alleluya administrators can see them, for safety and to review reports.

8. Providers and Recipients of Data

To run Alleluya we rely on a few external providers, which process data on our behalf and only for the purposes described. We do not sell your data and we do not use third-party advertising, profiling or analytics services.

Hosting and storage: account data and content (including photos, videos and audio) are stored on our servers in Italy, with the provider Netsons.

Live audio: the audio goes through a LiveKit server installed on our own servers, without external services.

Sign in with Apple or Google: if you choose "Sign in with Apple" or "Sign in with Google", Apple or Google give us an identifier and the linked email address. On the website their services load only when you tap the sign-in button.

Push notifications: to send notifications to your phone we use Apple Push Notification service (iPhone) and Google's Firebase Cloud Messaging (Android), which receive the device code and the text of the notification.

Email: service emails and messages from the team are sent through Resend, which receives your email address and the content of the message and tells us whether the email was delivered.

Gifts from invite campaigns: if you request a gift book, your name, address, phone number and email are used to create the shipping order on Alise Editore's online store, run on Shopify.

YouTube videos and link previews: the preview images of YouTube videos and links (title, image, icon) are fetched by Alleluya's server, which keeps a copy; while you scroll through posts, neither YouTube nor the linked site receives your data. The YouTube player, in privacy-enhanced mode (youtube-nocookie.com), is loaded from YouTube (Google) only when you start the video; from then on YouTube receives your IP address and device data and may use its own cookies, under Google's privacy policy. On the website we ask for your consent first (see section 9).

Domain names: the alleluya.app addresses are managed with Cloudflare's DNS service, which does not receive your content or your account data.

Finding churches: to find churches and communities to invite we use software research tools that consult public sources (see section 10).

Some of these providers (Apple, Google, Resend and Shopify) are based in the United States: data is transferred under the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.

Payments: payments are handled by Apple or Google. When you subscribe, or if you bought an ebook, we only receive the transaction code, the product, the dates and the status of the subscription: never your card details, name or billing address. If you support Alleluya with the “Support Alleluya” subscription, the supporter badge appears next to your name while it is active, visible to everyone; we never show anyone the amount or the dates. We only send Apple or Google an anonymous code of your Alleluya account, to link the purchase to the right account.

9. Cookies and Data Stored on Your Device

The app and the alleluya.app website store on your device only the technical data they need to work: the session that keeps you signed in, your preferences (such as language and theme) and some temporary copies of content so it loads faster. No consent is needed for this technical data.

We do not use third-party advertising, profiling or analytics cookies or tools.

The only external service that may store its own cookies is YouTube, when you start a video embedded in a post. On the website the video loads only after you accept the notice shown on the preview; your choice is remembered on this browser and you can withdraw it at any time from this page.

Withdraw YouTube consent

YouTube consent withdrawn on this browser

10. Data About Churches from Public Sources

To make Alleluya known we create Pages for churches and communities, using only information they have made public themselves (websites, social profiles, public directories): name, city, address, website, contact email and phone, and social profiles. We also find it with software research tools that consult these public sources. The legal basis is our legitimate interest in presenting the service.

Every email contains a link to stop further messages and, for churches, to have the Page we created removed; a church can also claim its Page in the app and manage it directly. You can ask at any time for access to, correction or deletion of this data by writing to mail@alleluya.app.

We keep this data for 24 months from the last contact. For anyone who asks not to be contacted again we keep only the email address, in an exclusion list, so that we do not write to them again.

11. Messages from the Team

If you have an account, we may email you news about Alleluya and its features, as allowed by Article 130(4) of the Italian Privacy Code for people who already use a service. You can object at any time, free of charge, through the link at the bottom of every email or in Settings → Privacy → Emails from the team. Service emails (for example password recovery) are always sent.

For products other than Alleluya, such as Alise Editore's books, we write to you only if you have given us separate consent.

12. Retention and Security

We keep your account data and your content for as long as your account is active. For some categories these periods apply:

• Content you delete and expired Moments: 90 days, then they are erased together with their files.
• Backup copies: deleted within 60 days; database backups are encrypted.
• Log of administrative access: 180 days.
• Reports and moderation decisions: 24 months.
• Encrypted fingerprint of the connection used to recognize Friends of Alleluya invitations: 30 days.
• Encrypted fingerprint of the phone against abuse (invitations, free books, accounts suspended for spam or scams): 180 days.
• Encrypted fingerprint of the sign-up network: 30 days from sign-up.
• Encrypted fingerprint of the network of whoever opens a dedicated link: 7 days, then deleted automatically.
• Link you signed up from (source): as long as your account is active; it is deleted with the account.
• Accounts created before a version is released and never used, usually the app stores' test robots: first they are suspended, then deleted automatically after 14 days without any sign-in. A copy is kept for 30 days so they can be restored.
• Data of churches we contacted: 24 months from the last contact; for anyone who asks not to be contacted again we keep only the email address in an exclusion list.

We take appropriate measures to protect your information: traffic is always encrypted (HTTPS), passwords are stored in encrypted form, never in plain text, the database is password-protected, administrators sign in with two-step verification and their access is logged.

To prevent abuse of invitations and free books and to recognise anyone who signs up again after being suspended for spam or scams, we keep an encrypted fingerprint of the phone you use Alleluya on (not your number or any other phone data). It is only used to recognise several accounts on the same phone and is deleted after 180 days.

13. Your Rights

In accordance with the GDPR, you have the right to access your data, rectify it, request its erasure, restriction of processing (Art. 18) or portability, and object to its processing, including content personalization. You can exercise these rights by writing to mail@alleluya.app: we reply within one month. You also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali, the Italian Data Protection Authority).

You can download a copy of your data from Settings → Privacy → Download my data, and stop emails from the team through the link at the bottom of every email or in Settings → Privacy.

14. Account Deletion

You can delete your account at any time in the app (Settings → Help → Delete account) or, without signing in, from the page alleluya.app/elimina-account. Deletion permanently removes your profile and all your content (posts, prayers, comments, reactions, messages, uploaded photos and videos and group memberships); backup copies are deleted within 60 days. This action cannot be undone.

Deleting your account does not cancel a subscription: you need to cancel it in the store (your Apple or Google account settings).

15. Device Permissions

The app asks for a permission only when it is needed, and you can manage it at any time in your phone settings:

• Photo library and camera: to upload photos and videos for your profile and your content, and to save photos received in messages to your phone.
• Microphone: to record audio and video and to speak in lives.
• Calendar: only to add an event when you ask; the event and your calendar data stay on your phone.
• Notifications: for the alerts you choose in Settings → Push notifications.
• Bluetooth (Android): to use headphones and speakers in lives.

16. Minors

Alleluya is not intended for children under 14, the age from which people in Italy can consent to online services on their own: when you sign up we ask you to confirm you are at least 14. If you believe a child under 14 has given us personal data, contact us and we will remove it.

17. Changes to This Policy

We may update this policy from time to time. Changes are published on this page with the date of the update.

18. Contact Us

For any questions about privacy or requests regarding your data, you can write to us at mail@alleluya.app. To report illegal content and for the point of contact under the EU Digital Services Act: alleluya.app/contatti.

Contact point and reports