The Black Breviary
Privacy Policy

Of What Is Kept

Effective October 12, 2026

In brief

The Black Breviary knows you by a soul number and asks for no email or phone number. Your Testament is encrypted on your device with a key made from your seal, and we hold it only in a form we cannot read. What we hold about you is used to run the app. We sell none of it, and the app carries no advertising or third-party trackers. You may withdraw at any time, and withdrawal deletes your account.

Who we are

The Black Breviary is published by Dylan Allman, Austin, Texas (“we”, “us”). We are the controller of the personal data described here. Write to us at blackbreviary@pm.me, the address shown in the app under Self.

What we hold, and why

What Why we hold it
Your soul number, six digits, assigned when you sign and never reused. It is your account.
Your name as signed on the pact, and a chosen display name if you set one. To address you, and to show you in the Record the way you choose.
Your date of birth. To confirm you are 18 or over, and to keep your birthday feast.
The faith you left, or the fact that you were raised without one. To give you the rites written for it, and to count it in the Record’s totals. This is information about religious belief, which many laws treat as sensitive. We hold it because you give it to us at signing for this purpose, and you can change it in Self.
Your signature as drawn strokes, and each later signature when you sign again. It seals the pact and appears in your app. It appears on your public profile only if you allow it.
Your time zone. So that the day turns, and the devotion arrives, at 03:33 where you are.
Which days you kept or refused, the degree of each rite you performed, the feasts you kept, and the hour you opened each devotion. To confer orders and distinctions and to build your Gallery.
Testament entries in encrypted form, each with its date, its kind (day, free page or refusal), its word count and the time it was last changed. To store and sync your Testament. We cannot read the text. Word counts are kept in the clear because orders and distinctions depend on them.
The profile fields you fill in, which are a line about yourself, the year you left, your city, and whether to show your faith and your signature. To build your public profile, if you turn it on.
The souls you hide from your own view of the Record. To keep them out of your view. Nobody else sees the list.
Reports you file, with the soul reported, the reason you chose and, if you were signed in, your soul number. To review the report and act on it under the Terms.
Reports filed about you, with their reasons and times, and any restriction we place on your account in response (a Record row kept anonymous, or a public profile kept off). To review reports and enforce the Terms.
Your passkey’s public key. To let you sign in. The private half stays on your device.
A hash of a secret derived from your seal. To let you sign in on a new device with your soul number and seal. The hash cannot be reversed into the seal.
Session tokens, stored hashed. To keep you signed in for up to 180 days.
A push subscription, if you turn notifications on, and whether you want the day’s title shown. To deliver the devotion at 03:33.
Your settings for how you appear in the Record and for Sober. To run the app the way you set it.

When you save a chosen name, a profile line or a city, or choose to appear under your signed name, the server checks the text against a list of words barred from the Record. Text that fails the check is refused and is not stored.

We do not collect your email, phone number, contacts, photos, precise or approximate device location, advertising identifiers, or payment details. The app takes no payments. the app contains no analytics or crash-reporting library, and server logs do not retain IP addresses. Your IP address is used in memory to limit repeated sign-in attempts and is not stored.

What stays on your device

The key that opens your Testament is derived from your seal and kept on your device in a form that cannot be exported. Your device also generates the Book of each year, reads devotions aloud with its own speech engine, and keeps the lock setting and your text size for itself.

Your seal, and the limit of encryption

When you sign, the app shows your seal once, as twenty-four characters in six groups of four. From it your device derives two things, the key that encrypts your Testament and a secret that lets you sign in elsewhere. We never receive the seal.

If you lose your seal and lose access to every device where your Testament is unlocked, nobody can open your Testament again, including us. We cannot reset the seal or recover it, and we cannot decrypt your entries on request, for you or for anyone who asks us. Write the seal down and keep it somewhere you control. Download your Testament from time to time; the download is decrypted on your device.

Encryption covers the text of what you write. The server still sees that you have an account, when you signed, which faith you left and how many words you have written, because it needs those to run the app.

What is public

Every pact is entered in the Record, which other readers can see. Your row shows your soul number, the name you chose to appear under (anonymous, a chosen name, or your signed name), your order, the time you signed and your Days Unredeemed. Your faith is counted in the Record’s totals and does not appear on your row.

Your public profile is off unless you turn it on. When it is on, anyone with the link blackbreviary.app/s/<soul number> can see your name as you set it, your soul number, order, distinctions, Days Unredeemed, Gallery count, years kept and the line about yourself, and, only if you allow each one, your signature, the faith you left and your city. Turning the profile off removes the page at once. Copies others have already made are beyond our reach.

Other readers can report your row or your profile, and can hide you from their own view of the Record. Hiding is private to the reader who does it.

Anything you publish can be read by people you do not know, in places where leaving a faith is dangerous or punished. Choose what you show with that in mind.

Notifications

If you turn notifications on, the app sends one notification a night, at 03:33 in your time zone, marked silent so that it waits on the lock screen without sounding. It reads “Your devotion is ready.” and adds the day’s title only if you ask for it. Notifications travel through the push service of your device’s maker (Apple, Google, or your browser’s vendor), which sees that a notification was sent to your device and nothing of your Testament. You can turn notifications off in Self or in your device settings at any time.

Who else touches your data

We sell no data and share none for advertising. We use a small number of service providers, who process data only on our instructions:

We will disclose data to authorities only when the law compels it, and we will tell you through the app unless the law forbids it. What we could disclose is limited to what is listed above, which leaves out the text of your Testament, since we cannot read it.

How long we keep it

We keep your data while your account exists. When you withdraw, it is deleted as described below. Reports are kept after they are resolved, as the record of what was done; when a reader who filed one withdraws, their soul number is removed from it. Daily backups of the database are kept for at most 7 days and then overwritten, so deleted data leaves the backups within that time. Server logs record the method and path of each request and no IP addresses, and the hosting provider keeps them only briefly.

Withdrawal: deleting your account

In the app: open Self, then Withdraw from the Record. The app first offers you your Testament as a file, decrypted on your device, and the Book if one exists. Then choose Withdraw.

Without the app: open the web app at blackbreviary.app, choose Return, sign in with your passkey or with your soul number and seal, and withdraw from Self in the same way.

Withdrawal deletes your Testament entries, your record of days, your profile, your name, date of birth, signature, settings, passkeys, sessions, push subscriptions and the list of souls you hid, and removes your soul number from any report you filed. Your row in the Record stays, reduced to the soul number and the time of signing, marked Withdrawn and struck through, because the Record is a ledger and its numbers are never reused. Your faith remains only as one unit within the Record’s totals and cannot be traced back to your row.

If you can no longer sign in, because you have lost both your passkey and your seal, write to blackbreviary@pm.me with your soul number. We hold no email or phone that could prove the account is yours, so we cannot delete it on a message alone. On request we will turn off its public profile and make its Record row anonymous.

Age

The Black Breviary is for adults. You must be 18 or over to sign, and the app refuses anyone who gives a younger date of birth. If we learn that an account belongs to someone under 18, we withdraw it.

Your rights

Depending on where you live (including the European Union and United Kingdom under the GDPR, California under the CCPA, and Texas and other states with consumer privacy laws), you have the right to know what we hold about you, to receive a copy, to correct it, to delete it, to object to or restrict how we use it, and to withdraw consent for the parts that rest on consent, such as the faith you left and your public profile. Most of this you can do yourself in the app, where Self shows and edits what we hold, the Testament downloads in full, and withdrawal deletes the account. For anything else, write to blackbreviary@pm.me with your soul number, and we will answer within 30 days. We may ask you to prove the account is yours by signing in.

Where the GDPR applies, running your account and the app rests on the performance of our agreement with you. The faith you left, which is data about religious belief, and anything you publish on a public profile rest on your explicit consent. Rate-limiting, the word filter and the handling of reports rest on our legitimate interest in keeping the service secure and the Record free of abuse. You may complain to your data protection authority.

We do not sell or share personal data as California law defines those words, and we do not use it for targeted advertising or profiling.

Transfers

Our servers are in the United States. If you use the app from elsewhere, your data travels there. Where the law requires safeguards for such transfers, we rely on your consent and on the contractual safeguards of our hosting provider.

Security

Every connection uses HTTPS. You sign in with a passkey or with a secret derived from your seal, so there is no password to steal, and sessions are stored hashed. The Testament is end-to-end encrypted. If a breach affects your data, we will tell you through the app and through any channel the law requires, within the time the law allows.

Changes

If we change this policy, we will post the new version here with a new effective date and announce material changes in the app before they take effect.

Contact

Dylan Allman
Austin, Texas
blackbreviary@pm.me