Doxa Cookie & Tracking Policy
Effective Date: 23 January 2026 | Last updated: 18 August 2026
We believe in transparency and minimal tracking. This policy explains what technologies we use, why we use them, and how you can control them.
This Cookie & Tracking Policy forms part of our Privacy & Data Protection Policy and should be read alongside our Terms of Service.
1. Our Approach: Minimal Tracking
We use only essential cookies and technologies required to operate the Service. We do NOT use:
- Advertising or marketing cookies
- Cross-site tracking
- Third-party analytics for behavioral profiling
- Selling your data to data brokers or advertising networks
Doxa carries no advertising and shows you no ads. The one advertising-related identifier we do use is the device advertising identifier in the mobile app, which is shared with Meta only to measure how well Doxa's own advertising works. See Advertising Measurement (Mobile App) in Section 2 below.
2. Technologies We Use
Essential Cookies & Storage
Required for the Service to function. Without these, you cannot log in or use core features.
| Technology | Provider | Purpose | Duration |
|---|---|---|---|
| Auth Session | Supabase | Keeps you logged in | Until logout/expiry |
| Secure Token | Supabase | API authentication | Session |
| Local Storage | Browser/App | App preferences, cached data | Until cleared |
Analytics Technologies
Used to understand how the Service is used and improve the experience.
| Technology | Provider | Purpose | Duration |
|---|---|---|---|
| Google Analytics | Page views, traffic sources | 2 years | |
| PostHog Analytics | PostHog (EU) | Anonymised product analytics, funnel tracking, masked session replay (all text/images hidden) | Session-based |
Google Analytics is used on our website (doxa.app) to understand page views and traffic sources. We use IP anonymisation and do not enable advertising features.
PostHogprovides anonymised product analytics (feature usage, funnel analysis) and session replay with all text inputs, images, and personal content masked at source before any data leaves your device. We cannot see what you type, read, or view — only anonymised interaction patterns (e.g. which buttons are tapped, where users drop off). Data is hosted on PostHog's EU infrastructure (Frankfurt) and routed through our reverse proxy at insight.doxa.app. PostHog does not set cookies on mobile — on web, it uses a session cookie to group page views into sessions.
Advertising Measurement (Mobile App)
Used to measure how well Doxa's own advertising works. This applies to the mobile app only, not the website, and uses no cookies.
| Technology | Provider | Purpose | Duration |
|---|---|---|---|
| Meta SDK (device advertising identifier) | Meta Platforms, Inc. | Attribute app installs and allowlisted milestones to Doxa's own ads | Per Meta's retention policy |
The Doxa mobile app uses the Meta (Facebook) SDK to attribute app installs and a short, fixed list of in-app milestones (such as signup and subscription) to ads a person previously saw. The reports include your device advertising identifier, which is the Android Advertising ID on Android and the Identifier for Advertisers (IDFA) on iOS. They never include your prophecies, testimonies, prayers, notes, images, voice, or anything you type or say in Doxa Engage. On iOS the identifier is used only if you grant permission at Apple's App Tracking Transparency prompt. On Android you can reset, limit, or delete your advertising ID in device settings, and Doxa honours that. Full detail and controls are in the Advertising Measurement section of our Privacy & Data Protection Policy.
Push Notification Tokens
Used to deliver push notifications to your device (if enabled).
| Technology | Provider | Purpose | Duration |
|---|---|---|---|
| Expo Push Token | Expo (650 Industries) | Push notification delivery | Until app uninstall |
| APNs Token | Apple Inc. | iOS push delivery | Until app uninstall |
| FCM Token | Google LLC | Android push delivery | Until app uninstall |
Error Monitoring (Optional)
Used to identify and fix bugs. You can opt out of this.
| Technology | Provider | Purpose | Duration |
|---|---|---|---|
| Error Reports | Sentry (Functional Software) | Crash and error tracking | 90 days |
Website Hosting
Technologies used when you visit our website (doxa.app).
| Technology | Provider | Purpose | Duration |
|---|---|---|---|
| CDN/Edge | Vercel Inc. | Website hosting and delivery | Session |
| Access Logs | Vercel Inc. | Security and performance | 30 days |
3. AI Processing
When you use AI-powered features, your content is processed by our AI partners:
| Feature | Provider | Data Processed | Retention |
|---|---|---|---|
| Audio Transcription | AssemblyAI | Audio files | Deleted after processing |
| Title Generation | OpenAI | Text content | Not stored by OpenAI |
| Content Moderation | OpenAI | Text content | Not stored by OpenAI |
| Scripture Recommendations | OpenAI | Text content | Not stored by OpenAI |
| Voice Chat (Engage) | OpenAI Realtime API | Voice audio (streamed) | Real-time only, not stored |
| AI-Generated Images | AI Image Generation | Text prompts (testimony content) | Prompts not stored by provider |
These are optional features. Your content is processed transiently and is not used to train AI models per our agreements with these providers.
Voice Chat (Engage) — How It Works
When you use the Engage voice chat feature, here's exactly what happens with your data:
- Voice audio: Streamed in real-time directly to OpenAI's Realtime API—not recorded or stored by Doxa
- Session metadata: Duration, voice preference, and topics are stored in your account to improve future sessions
- Conversation context: Your prophecies and testimonies may be referenced to provide personalized encouragement (this data already exists in your account)
- No audio recordings: Neither Doxa nor OpenAI retains audio after your session ends
You can use text-only mode if you prefer not to use voice features.
4. Your Choices & Control
You have control over how we use tracking technologies. Here are your options:
Push Notifications
You can disable push notifications at any time through your device settings (Settings → Notifications → Doxa). Disabling notifications does not affect other app functionality.
Error Reporting
Sentry error reporting helps us fix bugs and improve reliability. You can:
- Request deletion of your error data at privacy@doxa.app
- Error data is automatically deleted after 90 days
- We do not use error data for any purpose other than fixing bugs
Browser Cookies
When using our website, you can manage cookies through your browser settings:
- Block all cookies: Note that this will prevent login and essential functionality
- Delete cookies: Clear your browser cookies to remove session data
- Private/Incognito mode: Browse without persistent cookies
We do not use cookie consent banners because we only use essential cookies that are strictly necessary for the Service to function. Under UK GDPR/PECR, consent is not required for such cookies.
AI Features
AI features (transcription, title generation, voice chat, recommendations) are optional enhancements. You can use the core app without these features if you prefer not to have your content processed by AI. Opting out of AI features does not affect your ability to record and store content.
Do Not Track
We honour "Do Not Track" browser signals on our website. Our website does not track you for advertising, so this setting makes no practical difference to your web browsing. Advertising measurement happens only in the mobile app, through the device advertising identifier described in Section 2, and you control it in your device settings (iOS App Tracking Transparency, or the Android advertising ID controls).
5. Third-Party Privacy Policies
For more information about how our partners handle data:
- Supabase: Privacy Policy
- Stripe: Privacy Policy
- Expo: Privacy Policy
- Sentry: Privacy Policy
- Vercel: Privacy Policy
- OpenAI: Privacy Policy
- AssemblyAI: Privacy Policy
- Apple: Privacy Policy
- Google: Privacy Policy
- PostHog: Privacy Policy
6. Data Retention Summary
- Authentication data: Until you log out or session expires
- Push tokens: Until you uninstall the app or disable notifications
- Error logs: 90 days, then automatically deleted
- Website access logs: 30 days
- Analytics data: Google Analytics: 2 years; PostHog: session-based
- Advertising measurement data (mobile app): Device advertising identifier and install/milestone events held by Meta under its own retention policy; not stored in Doxa's database; resetting the identifier in device settings breaks the link
- AI processing data: Transient (deleted immediately after processing)
- Voice chat audio: Real-time streaming only, never stored
- Voice chat session metadata: Retained with your account until you delete it
- Payment/subscription data: Retained by Stripe; subscription records retained for legal/accounting purposes
7. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the app or this page. The "Last updated" date at the top indicates when this policy was revised.
8. Legal Basis for Cookies
Under UK GDPR, ePrivacy Directive, and PECR, we rely on the following legal bases:
- Strictly necessary cookies: No consent required—these are essential for the Service to function
- Analytics/performance cookies: Legitimate interest (product improvement, no profiling)
- Advertising/marketing cookies: We do not use these on the website or in the app
- Advertising measurement (mobile app): Consent on iOS, given at Apple's App Tracking Transparency prompt; legitimate interest on Android, where you can reset or limit the advertising identifier in device settings
- Optional AI features: Consent (provided when you choose to use these features)
9. Disclaimer
While we take measures to limit tracking and protect your privacy, you acknowledge that:
- Third-party providers (Apple, Google, Supabase) may collect data according to their own privacy policies
- Your device and browser may transmit data that we cannot control
- We are not liable for tracking conducted by third parties outside our control
- You are responsible for managing your own device and browser settings
10. Contact Us
For questions about cookies or tracking technologies:
Email: privacy@doxa.app
Address: The Doxa Way Ltd, 108 Kings Road, New Haw, Addlestone, KT15 3BH, United Kingdom
See also our Privacy & Data Protection Policy and Terms of Service.
Our Commitment to Your Privacy
No advertising cookies. No ads in Doxa. We never sell your data. We measure our own ads with the device advertising identifier, and you control it. Your privacy matters.