Legal

Privacy Policy

Last updated: October 1, 2026.

1. Who we are and what this policy covers

This Privacy Policy explains how HemApp OpCo LLC, a New York limited liability company ("The Hem," "we," "us," or "our"), handles personal information across The Hem app, touchthehem.com, its waitlist, and related services ("Services").

The Hem is a Christian prayer app rooted in Scripture and centered on Jesus Christ. You speak or type what you want to pray about. Artificial intelligence ("AI") generates a personal prayer grounded in Scripture, read aloud in a preset voice or, if you choose Voice Cloning, an AI version of your own voice.

Read this policy with our Terms of Service. Our Consumer Health Data Privacy Policy (Appendix A) also applies to Washington State and Nevada residents. If you choose Voice Cloning, Section 7 and the separate Voice Consent also apply.

By using the Services, you acknowledge that you have read this policy. We obtain required consent separately in the app, including for sensitive information and Voice Cloning.

2. Information we collect

  • Account information. Name (optional), email address, password (stored only as a one-way cryptographic hash), sign-in method, and the account identifier that Apple or Google provides if you use Sign in with Apple or Google Sign-In. We collect it when you create an account or sign in.
  • Age. Your confirmation that you are in the 18-or-older age band, including for guest access. We do not retain your date of birth. We also use app-store age signals where available.
  • Prayer content. We use the words you speak or type (“Prayer Input”) to generate your prayer text and audio (“Generated Prayers”). Section 11 explains what is retained and for how long.
  • Personalization choices. How you would like to be addressed (for example, "brother," "sister," or "rather not say"), your chosen voice, text size and color, and your reminder times.
  • Voice Cloning data. Voice recordings you submit to create a copy of your voice, the short spoken consent statement you record, a name you give the voice, and the AI voice model and voice identifier created from your recordings. We collect it only if you are 18 or older, choose to use Voice Cloning, and give express consent. See Section 7.
  • Waitlist (website). Your first name and email address, and confirmation that you verified your email address.
  • Communications. Support requests, app feedback, privacy requests, and content reports. We will not publish your story or testimony, with or without your name, without your separate, express permission.
  • Purchases. If we offer subscriptions: the product you bought, the transaction identifier, subscription status, start, renewal, and expiry dates, and your country. Apple or Google handles payment. We never receive your card number or bank details.
  • Device and app information. Device model, operating system and version, app version, language, and time zone. We use your time zone to send reminders at the right local time.
  • Push notification token. A token from Apple or Google that lets us send the reminders you ask for.
  • Usage and diagnostic information. The screens you view, the features you use, when and how long you use them, performance data, and crash and error reports. We configure our analytics so that the text of your prayers does not go to our analytics provider.
  • Network and security information. IP address, user agent, and request timestamps. We use them to operate and secure the Services, to prevent abuse and, for Voice Cloning, as part of your consent record.
  • Website information. When you visit touchthehem.com, our website host and font provider receive your IP address, browser type, and the pages you request, as needed to deliver the site.
  • Guest session information. If you try The Hem without an account: a temporary session identifier and, where available, a device identifier used only to limit how many free prayers each device can generate.
  • Apple and Google sign-in. Your name (if you choose to share it), your email address (or an Apple private relay address), and a stable account identifier.
  • App stores. Confirmation of purchases, renewals, refunds, and cancellations.
  • Service providers. For example, delivery status from our email and push notification providers, and analysis results from our AI providers (such as the emotional tone of a request, or a safety flag).

We do not collect your precise location, contacts, photos, calendar, health app data, or advertising identifier. We do not track you across other companies' apps or websites, and The Hem does not include advertising software.

3. Sensitive personal information

Prayer Input and Generated Prayers may reveal sensitive information, including religious or philosophical beliefs, mental or physical health, relationships, family or intimacy life, and other personal matters. Voice Cloning involves biometric data (Section 7).

We treat all of this as "Sensitive Content" and apply these commitments to it:

  • We collect and use Sensitive Content only to provide the features you ask for, keep the Services safe, and meet our legal obligations.
  • We obtain your opt-in consent before we first process your Prayer Input, and separate, express written consent before any Voice Cloning.
  • We do not sell Sensitive Content, do not share it for cross-context behavioral advertising, and do not use it to build advertising profiles or to make decisions that produce legal or similarly significant effects about you.
  • We do not use Prayer Input, Generated Prayers, or Voice Data to train or improve AI models, whether ours or a third party's. The one exception: if you choose Voice Cloning, we use the voice samples you submit to create your personal voice model, which only you can use.
  • We disclose prayer content only as described in this policy, subject to the sharing limits in Section 11 of our Terms.
  • You can withdraw your consent at any time by deleting your data or your account (Section 13). Withdrawing consent does not affect processing that took place before you withdrew it, but you will no longer be able to use features that need that data.

4. How your prayer is made

The Hem has no memory function and does not use past prayers to personalize new ones. Here is how your current request is processed:

  • (a) You speak or type. The Hem accesses your microphone only when you start recording, while the recording indicator is displayed. Your device's speech recognition service (Apple on iOS, Google on Android) converts speech to text, on-device or on its servers under its privacy policy. If we stream audio for transcription, our speech provider processes it in real time without saving a recording.
  • (b) We do not keep spoken Prayer Input audio. We process your request as text and do not store the recording of you speaking it.
  • (c) Safety and tone check. An AI provider checks your text for emotional tone, crisis language, and prohibited requests (Section 8). Tone labels shape the current prayer; only aggregated, de-identified statistics are retained, without a link to your account or prayer.
  • (d) The prayer is written. We send your text, your first name (if you gave one), and how you prefer to be addressed to an AI provider, which writes your prayer. Scripture comes from passages we selected in advance. The AI does not write or alter Scripture.
  • (e) The prayer is read aloud. We send the prayer text to a text-to-speech provider to create the audio, using either a preset voice or your Cloned Voice. The provider creates timing data so the app can highlight the words as they are spoken.
  • (f) Delivery and retention. We send the prayer text and audio to your device and keep them only for as long as Section 11 describes.

5. How we use your information

We use your information to:

  • Provide the Services. Create your account, sign you in, generate and play prayers, and apply your preferences. Uses account information, prayer content, preferences, and device information.
  • Provide Voice Cloning. Create, store, and use your voice model, and keep a record of your consent. Uses Voice Cloning data and your consent record.
  • Keep people safe. Detect crisis language and show support resources, block prohibited requests, and prevent abuse and fraud. Uses Prayer Input and security information.
  • Apply age limits. Confirm users are 18 or older, including guests. If we learn a user is under 18, we close the account and delete its data.
  • Send reminders and service messages. Verification codes, password resets, prayer reminders you request, and important changes. Uses email, push token, time zone, and reminder settings.
  • Handle subscriptions and purchases, if offered. Uses purchase information.
  • Support you and communicate with you. Uses communications and account information.
  • Improve and fix the Services. Uses aggregated or de-identified usage and diagnostic data, never the text of your prayers.
  • Comply with law, enforce our Terms, and protect rights and safety. Uses any relevant information.

We do not use automated decision-making that produces legal or similarly significant effects about you. Our automated safety checks may show support resources or decline a request; they do not contact others for you.

We keep aggregated, de-identified statistics, including prayer counts and emotional-tone totals, indefinitely. These contain no prayer text or links to your account, device, or individual prayers. We do not re-identify them or allow recipients to do so.

6. Artificial intelligence and third-party AI providers

The Hem uses third-party AI services to process requests and generate prayer text and audio. We explain what information they receive and ask for your permission before first sending it. They include:

  • AI language providers. Write prayers and classify tone and safety.
  • AI speech providers. Convert speech to text where a real-time voice feature is used, and generate prayer audio.
  • Our voice provider. Generates prayer audio and creates and hosts Cloned Voices.

You may ask for the names of the providers we currently use by emailing legal@touchthehem.com.

We may add or replace AI providers. Before we process Sensitive Content to a new provider in a materially different way, we will update this policy and, where required, ask for your consent again.

What we require of AI providers. We use paid business APIs, review training, retention, and security terms, and use available privacy controls. Our provider agreements prohibit using your information to train or improve AI models, except to create your personal voice model when you choose Voice Cloning. Providers must follow this policy's limits on data use and deletion.

About AI-generated content. AI-generated prayers may be inaccurate, incomplete, theologically imperfect, or not what you intended. The voices you hear, including Cloned Voices, are generated using AI. See our Terms of Service.

7. Voice and Biometric Data Notice

This notice is our written policy on biometric identifiers and biometric information for the purposes of the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington law (RCW 19.375 and the My Health My Data Act), Colorado law, and other applicable laws. It applies only if you choose to use Voice Cloning.

  • The voice recordings you submit (a longer sample and a short reference clip).
  • A short recording of your spoken consent. Separately, a consent record with the wording version, date and time, app version, IP address, and device information.
  • The personal AI voice model and voice identifier created from your recordings. Together with the recordings described above, these are "Voice Data." Some laws may treat the model or identifier as a voiceprint or biometric identifier.

We use Voice Data only to create and host your personal voice model and generate your prayers. Only you can use that model. We keep a separate consent record. Voice Data is not used to identify you, authenticate your account, advertise, or train or improve other AI models.

Before collecting Voice Data, we explain what we collect, why, and how long we keep it in a separate Voice Consent. We obtain your express written consent and recorded spoken consent statement. Voice Cloning is optional, available only to adults 18 or older, and limited to recordings of your own voice.

We never sell, lease, trade, or otherwise profit from Voice Data. We disclose it only to our voice provider to create and host your Cloned Voice within this policy's limits, at your request or with your consent as our Terms permit, or as law or valid legal process requires.

We and our voice provider permanently delete Voice Data at the earliest of these deadlines, with backups removed as Section 11 describes:

  • within 30 days after you delete your Cloned Voice in Settings, delete your account, or withdraw your consent;
  • within 30 days after the purpose for collecting it ends, for example if we discontinue Voice Cloning or your access to it ends;
  • after 12 months in which you have not used your Cloned Voice; and
  • in any event, no later than 3 years after your last interaction with The Hem (or any shorter period the law requires).

These deadlines apply to provider copies. Backup retention does not extend any applicable legal maximum.

Your consent record (the version of the wording you agreed to, timestamps, and technical details) contains no voice recording or voiceprint. We keep it for 5 years after we delete your Voice Data so that we can show we obtained your consent. We delete your recorded spoken consent statement together with your other Voice Data.

We store, transmit, and protect Voice Data with a standard of care as protective as the one we use for our other confidential and sensitive information, and in line with reasonable industry standards. This includes encryption in transit, restricted access, and audit logging.

8. Safety and crisis support

Automated systems check Prayer Input for language suggesting self-harm, suicide, harm to others, or prohibited requests. When a possible risk is detected, The Hem may show crisis resources instead of generating a prayer.

If crisis detection blocks a prayer, we do not store the Prayer Input. We may keep a safety event record containing only the date, time, and category, with no prayer text, for up to 12 months to evaluate the safety system.

These checks may miss situations. The Hem is not an emergency, crisis, medical, or counseling service. No person listens to your prayers. We do not contact emergency services, family members, or anyone else for you. If anyone is in immediate danger, call 911 or your local emergency number.

9. How we disclose information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as California and other state laws define those terms. We have not done so in the preceding 12 months. We do not disclose your personal information to advertisers or data brokers for their advertising or data brokerage purposes. We disclose personal information only as follows.

Service providers that process information only to run The Hem, within this policy's limits:

  • Cloud hosting, storage, and network security providers. They run our servers and store data securely.
  • AI language, speech, and voice providers. See Sections 4, 6, and 7.
  • Device speech recognition. Apple; Google. They convert your spoken words to text on your device or through the operating system.
  • An analytics and crash-reporting provider. Helps us understand feature usage and fix errors, without prayer text.
  • Push notification providers, including Apple's and Google's notification services. They deliver reminders you request.
  • Email delivery providers. They send waitlist confirmations, launch news, verification codes, and service emails.
  • Website hosting and font providers. They host and display touchthehem.com.
  • Sign-in. Apple; Google.
  • App stores and payments. Apple App Store; Google Play.

Our current list of providers. You may ask for the names of the providers we currently use by emailing legal@touchthehem.com.

Legal demands. We disclose information only where we believe in good faith that the law, a court order, or other valid legal process requires it. We read each demand closely, challenge those that are overbroad, and hand over the minimum the law requires. Where the law allows, we notify you first.

Safety and protection. We may disclose information as needed to secure the Services and prevent fraud or abuse. This does not include contacting others on your behalf in response to prayer content.

Business transfers. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. Any acquirer must honor this policy for the information we transfer. We will notify you and, where the law requires it, ask for your consent before we transfer Sensitive Content or Voice Data.

With your consent or at your direction. We may disclose information at your request or with your consent, subject to our Terms. Prayer sharing is planned for a future release; Section 11 permits limited ministry playback.

10. Analytics, cookies, and advertising

In the app. The app uses an analytics provider to measure which screens and features people use and to capture crash and error reports. Each record links to an internal user identifier and basic account attributes, such as sign-in method and voice settings. We configure our analytics provider so that free text you enter, including your prayers, is not sent. We do not use session recording (screen replay) in the app.

No advertising software. The app contains no advertising software and no advertising trackers.

On the website. Our website may use strictly necessary cookies and, with your consent where required, analytics cookies. You can manage cookies through your browser settings or our cookie banner. We honor Global Privacy Control (GPC) signals as a valid request to opt out of sale or sharing. Because we do not sell or share personal information, this is already our default.

You can ask us to stop collecting analytics about you by contacting support@touchthehem.com.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, and then we delete or de-identify it. Our retention schedule is:

  • Spoken Prayer Input audio. Processed in real time; not stored.
  • Prayer Input and Generated Prayers (text and audio). Kept for up to 30 days after generation for delivery and replay, then deleted. You can request earlier deletion through Settings or support. Past prayers are not used to personalize new prayers.
  • Voice Data (recordings, personal voice model, and identifier). We and our voice provider delete it within 30 days of a deletion request, consent withdrawal, or the end of its purpose, subject to the earlier deadlines in Section 7.5.
  • Voice consent records (no voice data). 5 years after we delete the Voice Data, as proof of consent.
  • Crisis safety events. 12 months, date, time, and category only.
  • Waitlist name and email address. Until you unsubscribe or ask us to delete it, or 24 months after the app launches if you have not created an account.
  • Account information, 18-or-older age band, and preferences. Until you delete your account, then deleted within 30 days.
  • Guest sessions. Up to 30 days.
  • Email verification and password-reset codes. They expire after 10 minutes. We delete the records within 30 days.
  • Subscription and billing records. 7 years after the transaction, for tax and accounting.
  • Subscription and auto-renewal consent records. 3 years, or 1 year after cancellation if longer, under the California Automatic Renewal Law.
  • Device, usage, analytics, and crash data. 13 months.
  • De-identified statistics. Retained indefinitely, without prayer text or links to your account, device, or individual prayers.
  • Server and security logs. 90 days.
  • Support messages. 2 years after the conversation closes.
  • Backups. Deleted data is removed within a further 30 days, subject to any shorter legal deadline.

We may keep information longer only where the law requires it, to resolve a dispute, to enforce our agreements, or under a legal hold. In that case we keep only what is needed, restrict access to it, and delete it once the obligation ends. The biometric limits in Section 7.5 always apply.

12. Your choices and controls

  • Type instead of speak. You can type your prayer so that no audio is processed.
  • Microphone and speech recognition. You can turn off access at any time in your device settings.
  • Notifications. You can manage reminder times in Settings > Notifications, or turn notifications off in your device settings.
  • Your Cloned Voice. You can delete it at any time in Settings > Voice. Deletion starts immediately and finishes as Section 7.5 describes.
  • Personalization. You can change your name and form of address in Settings > Account, or choose "rather not say."
  • Emails. In the app we send only service emails, such as verification codes. If you joined the waitlist, we email you about The Hem's launch and updates. Every such email has an unsubscribe link, and we send marketing emails only to adults who asked for them.

13. Deleting your account and data

You can delete your account and associated personal information for The Hem app through Settings or support.

Choose either method:

  • In the app. Go to Settings > Account > Delete account, and confirm.
  • By email, without the app. Email support@touchthehem.com with the subject "Delete my account" and your account email address. If you use Apple's "Hide My Email," include the relay address shown in Apple ID settings. We may verify your identity before acting and acknowledge your request within 7 days.

Cancel any subscription separately to stop future charges (see below).

  • You are signed out, and we deactivate your account immediately.
  • Within 30 days, we and our providers delete your account information, preferences, Prayer Input, Generated Prayers, reminders, push tokens, and Voice Data, except for the limited records described below.
  • Backups are cleared within a further 30 days, subject to Section 7.5's legal limits.
  • We keep only what we must keep, as Section 11 sets out: billing records (7 years), auto-renewal consent records, voice consent records with no voice data (5 years), and any information subject to a legal hold. We keep these separately with restricted access.
  • Aggregated, de-identified statistics may remain indefinitely. They contain no prayer text or links to your account, device, or individual prayers.

Important: deleting your account does not cancel a subscription. Apple or Google bills subscriptions. To stop future charges, cancel in your device settings: on iPhone, Settings > [your name] > Subscriptions; on Android, Google Play > Profile > Payments and subscriptions.

Deleting specific data without deleting your account. Use the app's Settings or contact support@touchthehem.com. You can delete your Cloned Voice in Settings > Voice. Deletion follows the schedules in Sections 7.5 and 11.

14. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We extend these rights to all users of The Hem, wherever they live, subject to identity verification and lawful exceptions:

  • Know and access. Confirm whether we process your personal information and get a copy of it, including the categories of information, sources, purposes, and recipients.
  • Portability. Receive your information in a portable, commonly used format.
  • Correction. Correct inaccurate information.
  • Deletion. Delete your information (see Section 13).
  • Opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these.
  • Limit the use of sensitive personal information (California) or withdraw consent to processing it (other states). We already use Sensitive Content only for the purposes the law allows.
  • Non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised your rights.

Email support@touchthehem.com or use the in-app option in Section 13. We will verify your request, usually by confirming control of the email address on your account. You may use an authorized agent. We may ask the agent for proof of authorization and ask you to verify your identity directly. We respond within 45 days, and may extend this by up to a further 45 days where the law allows, in which case we will tell you why.

If we decline your request, you may appeal by replying to our decision or by emailing legal@touchthehem.com with the subject "Privacy Appeal." We will respond in writing within 60 days (or within the period your state's law sets) and explain our reasons. If you are not satisfied, you may contact your state Attorney General.

In the past 12 months we have collected the following categories of personal information, as the California Consumer Privacy Act defines them. We collected them from the sources in Section 2, used them for the purposes in Section 5, and disclosed them for business purposes to the recipients in Section 9. We do not sell or share any category, including the personal information of anyone under 16.

  • Identifiers. Name, email address, account ID, IP address, push token. Retention: see Section 11.
  • Customer records. Name, email address, purchase records. Retention: see Section 11.
  • Commercial information. Subscription history (if offered). Retention: 7 years.
  • Internet or other electronic network activity. App usage, crash data. Retention: 13 months.
  • Audio and electronic information. Voice recordings for Voice Cloning. We process spoken prayers in real time but do not store them. Retention: see Sections 7 and 11.
  • Biometric information. Voice model and voice identifier (Voice Cloning only). Retention: see Section 7.5.
  • Sensitive personal information. Account login credentials, religious beliefs, health information revealed in prayers, biometric information. Retention: see Section 11.
  • Inferences. Emotional tone is processed to shape the current prayer. Only aggregated, de-identified statistics are retained indefinitely, without links to your account or individual prayers.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

15. Where information is processed

The Hem is offered in the United States. We and our providers may process information in the United States and other countries, where privacy laws may differ.

16. How we protect information

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These include encryption in transit (TLS); encryption at rest for stored audio and voice files; one-way hashing of passwords and verification codes; access controls based on least privilege; audit logging; and supplier security reviews. No method of transmission or storage is completely secure. We maintain a security program designed to meet the New York SHIELD Act (N.Y. Gen. Bus. Law section 899-bb). If a data breach affects your personal information, we will notify you and the relevant authorities as the law requires.

You can help protect your account by using a strong, unique password, keeping your device locked, and signing out on shared devices.

17. Third-party services and links

The Services may link to third-party websites and services (for example, crisis resources, app stores, and Apple or Google sign-in). Their own policies govern their privacy practices, and we are not responsible for them.

18. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date. If we make material changes, we will notify you in the app or by email at least 30 days before they take effect. We will not use Sensitive Content or Voice Data in a materially different way from what this policy describes without first obtaining your consent.

19. Contact us

HemApp OpCo LLC (New York limited liability company)

45 Main Street, Suite 238, Brooklyn, NY 11201, United States

Questions, support and account deletion: support@touchthehem.com.

Legal notices: legal@touchthehem.com.

Appendix A Consumer Health Data Privacy Policy Washington and Nevada

This Consumer Health Data Privacy Policy applies to "consumer health data" about residents of Washington State and Nevada, as the Washington My Health My Data Act (RCW 19.373) and Nevada SB 370 define it. It supplements our Privacy Policy.

You choose what to include in your Prayer Input. If you share information about a health condition, treatment, or symptoms, applicable state law may classify that information as consumer health data. We handle it under the protections and retention periods described in this policy.

For information covered by this notice, sources are the words and recordings you submit and our automated processing of that content.

We use this information to generate your prayers and audio, provide optional Voice Cloning, show crisis resources, secure the Services, and create de-identified statistics. We do so with your consent or as necessary to provide the service you requested.

We disclose information covered by this notice to the AI, voice, and hosting providers described in Sections 6 and 9, only to provide The Hem within this policy’s limits. We do not sell it. Other disclosures require your separate consent unless required by law.

You may confirm whether we collect, share, or sell information covered by this notice; to access it, including a list of all third parties and affiliates with which we shared it and their contact information; to withdraw consent; and to have it deleted. Exercise these rights by emailing legal@touchthehem.com or by using the options in Section 13. We respond within 45 days. You may appeal a refusal under Section 14.2. We respond to appeals within 45 days. If your appeal is denied, we provide contact details and a complaint link for your state’s Attorney General.

We do not use geofences for any purpose.