Privacy Policy

Last updated: 12 October 2026 (v14)

Who We Are

Breaking of Bread is operated by Francesco Galassi, based in Leeds, United Kingdom. Francesco Galassi is the data controller for the personal data described in this policy. You can contact him at [email protected].

What Data We Collect and Why

Account data (email address, display name)

Collected when you register. Used to provide the service and identify your account. Legal basis: performance of a contract.

Testimony content

Text and other content you submit as a testimony. When you delete your account you choose what happens to testimonies you have already published: they are kept, which is what happens if you do not choose, or they are deleted along with the rest of your account. A testimony that is kept has your name and the link to your account removed, but the content itself is not changed — your words, and any place and date you gave, stay published exactly as you wrote them. We do not describe that as anonymised, because it is not: a testimony can still be recognisable as yours. You can ask us to take one down at any time. Legal basis: performance of a contract; legitimate interest (preserving the archive).

Location data (city, country, coordinates)

Optional. Provided by you when submitting a testimony. The city and country you choose are shown publicly on the testimony itself — including when you publish it anonymously, as anonymity hides your name but not the location you add — and are also used to place testimonies on the public map feature. Coordinates are used only for the map and are never shown as text. If you do not want a location shown, leave the field empty when you submit. Legal basis: legitimate interest.

Comments, votes, favourites, amens, and collections

Activity you perform on the platform, including comments, up/down votes, favourites, "Amen" reactions, and the named collections in which you save testimonies. Used to power interactive features. Legal basis: performance of a contract.

Reading activity (Faith Passport)

When you are signed in, we record which testimonies you read so we can show your Faith Passport (the nations, themes and sections you have visited) and improve recommendations. On a faith platform this reading activity can reveal religious interest, so we treat it as special category data (see "Special Category Data" below). Legal basis: your explicit consent, given when you use signed-in engagement features; you can withdraw it at any time by deleting your account, which erases this history.

Aggregate readership (approximate country)

When a testimony is viewed, we derive an approximate country from request metadata and store it to show authors how far their story has reached. This record is not linked to your account and is kept only at country level. Specific countries are shown to an author only once a testimony has enough readers to keep individual readers unidentifiable. Legal basis: legitimate interest.

Profile picture

An optional avatar you may upload. We re-encode the image and strip embedded metadata (including any camera or location data) before storing it, and it is shown publicly only after moderator approval. Legal basis: consent (recorded when you upload it); removed when you delete the picture or your account.

Account security logs

Records of changes you make to your account credentials and settings: email, password (the event only, never the value), language, profile fields, and notification preferences. We also record when you ask to change your email address, and when you have us send the confirmation links again. Those records include the old and the new address, so that a change somebody attempted on your account but never confirmed can still be looked into. They never include a password, an IP address or a device. Used to protect your account and detect unauthorised changes. Retained for up to 24 months, then deleted. Legal basis: legitimate interest (account security).

Diagnostic records of failed actions

When something you do here fails — a testimony we cannot accept, a sign-in that does not work, or an unexpected error — we keep a short technical record of it, so we can answer you if you write to us about it. The record holds what kind of failure it was, the action you were taking, the field it concerned, the numbers involved (for example 312 characters where 400 were needed), the page address, your language, and the time. For an unexpected error it also holds an internal error code and the short reference shown on your screen, such as BOB-7F3K2M, so you can quote it to us. We never record the text of your testimony, your password, or the error message itself. If you were signed in, the record is linked to your account; if you were not — a failed sign-in, for instance — it holds the email address you typed, because otherwise we could not connect your report to what actually went wrong. Only administrators can read these records. We delete them automatically after 90 days, and any record linked to your account or holding your email address is deleted when you delete your account. Legal basis: legitimate interest (helping you when something fails, and keeping the service secure and working).

Crash and error reports

Separately from the record above, when something in our own software breaks we send ourselves a short technical description of the fault: what kind of fault it was, the lines of our own code involved, and where it happened — this website, the phone app, or one of the background jobs that process submissions. The description carries no name, email address, account number, device identifier or IP address, and it is not linked to you even when the diagnostic record above is. It never contains anything you wrote, read or searched for: the text of an error message is discarded rather than sent, because error messages routinely quote content. These reports reach a system we run ourselves, on the same United Kingdom server as the rest of the platform — no third party receives them — and nothing is stored on your device to make this work. We delete them after 90 days. In the phone app you can switch them off at any time under "Privacy and data", and the app behaves exactly the same without them. (On this website there is no switch, because nothing is kept on your device to remember one; you can still object at any time — see "Your Rights Under UK GDPR" below.) Crashes that stop the phone app before any of our code can run are not included: those are reported to Apple or Google by the operating system itself, and we see them only as counts in the app stores' own dashboards. Legal basis: legitimate interest (finding and fixing faults).

App feedback

Feedback you submit through the platform. Used to improve the service. Legal basis: legitimate interest.

Semantic embeddings and keywords

Derived automatically from submitted testimony content to power search and discovery features. These are not directly personal data but are generated from content you provide. Legal basis: legitimate interest.

Moderation records and notes

Records of moderation actions taken on the platform, and short notes moderators may write about an account or a testimony. Used to maintain platform integrity and accountability. A note about you, or about one of your testimonies, is kept for up to 24 months, deleted if you delete your account, and included, without the name of the staff member who wrote it, when you download your data. Legal basis: legal obligation; legitimate interest.

Retention

Account data: retained for the lifetime of your account. Email addresses are hashed upon account deletion.
Testimony content: published testimonies are kept in the archive after you delete your account, with your name and the link to your account removed and the content itself unchanged, unless you choose at the point of deletion to have them deleted too. Testimonies that are kept are not anonymous and you can ask us to remove one at any time. Anything you had not published is deleted with the account.
App feedback: retained for up to 2 years.
Reading activity, amens and collections: retained for the lifetime of your account and erased when you delete it.
Aggregate readership: the approximate-country view records are not linked to your account; they are retained at country level to power authors' reach statistics.
Profile picture: retained until you remove it or delete your account.
Diagnostic records of failed actions: retained for 90 days and then deleted automatically; also deleted when you delete your account.
Crash and error reports: retained for 90 days and then deleted automatically. They are not linked to your account, so there is nothing in them to remove when you delete it.
IP addresses: our server's request logs record IP addresses. They are kept in log files with a fixed size limit, and the oldest lines are deleted automatically as new ones are written. This is a limit on size, not on time, so on a quiet day a line can be kept for longer than 30 days. Error reports drawn from those logs have IP and email addresses removed and are deleted after 30 days. We never store your IP address in our database. To stop abuse, we count requests against a keyed hash of your IP address, never the address itself, and each count expires within a day. The consent record described below keeps only a one-way hash of your IP address, retained until you delete your account.

Third-Party Data Processors

We use the following third-party services to operate the platform. Each acts as a data processor on our behalf, unless its entry says otherwise.

Supabase (open-source software that we run ourselves): sign-in and the database run as Supabase software on our own server in the United Kingdom. Nothing is sent to Supabase Inc., the company that publishes the software.
Ionos (1&1 IONOS SE, Germany): primary server hosting, United Kingdom data centre.
OpenAI (OpenAI LLC, USA): semantic embeddings and keyword extraction, including the words you type into search. A search query is sent to OpenAI to be turned into a vector, so we can find testimonies that mean something similar. Search queries are never logged, never stored, and never linked to your account.
Anthropic (Anthropic PBC, USA): keyword extraction.
Resend (Resend Inc., USA): transactional email.
Cloudflare (Cloudflare Inc., USA): every request to this website passes through Cloudflare's network, so Cloudflare handles your IP address, the address of the page you ask for and your browser's request headers, in order to deliver the page and protect the site from attack. Cloudflare also stores our database backups (R2). They are encrypted on our server before they are sent, Cloudflare does not hold the key, and each one is deleted after 30 days.
OpenStreetMap (OpenStreetMap Foundation, United Kingdom): when a testimony includes a city and country, our server sends that place name to OpenStreetMap to find it on the map, and our server fetches the map images for the world map. Your browser never contacts OpenStreetMap, so it never receives your IP address. The Foundation handles these requests as a controller in its own right.
Open Library (Internet Archive, USA): when you search for a book to attach to a testimony, our server sends the words you typed to Open Library to find matching books, and fetches their cover images. Only the search words are sent: no account details, and not your IP address, because your browser never contacts Open Library. The Internet Archive handles these requests as a controller in its own right.
Ko-fi (Ko-fi Labs Ltd): if you support us through Ko-fi, Ko-fi tells us the email address you used, the kind of support and when you gave it, so that we can mark a matching account as a supporter. Ko-fi is a separate controller for the payment itself, under its own privacy policy. If no account matches the address, we keep nothing about the donation.

International Transfers

OpenAI, Anthropic, Resend, Cloudflare and the Internet Archive (Open Library) are based in the United States. Transfers to OpenAI, Anthropic, Resend and Cloudflare are made under the UK Extension to the EU-US Data Privacy Framework. Requests to Open Library are made by our server and carry only the words of a book search. Posts on our Instagram account and Facebook Page are held in the United States by Meta Platforms, Inc., which is responsible for them under its own terms. The primary database is hosted in the United Kingdom via the Ionos VPS UK data centre, so testimony content and account data at rest remain in the UK. The only copy that leaves the UK is the encrypted backup described above, which Cloudflare cannot read.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object

To exercise any of these rights, email [email protected] or use the account settings page.

Marketing Use of Testimonies

We may feature published testimonies to promote the platform, but only those whose authors have said yes. A testimony is never used in marketing unless you say yes to it: when you submit it, you are asked Yes or No, with no answer chosen for you, and you can change your answer later from its edit page at any time with one click. Saying no later, or deleting your account, stops any new use straight away, and any post already published that uses it is taken down within seven days. These posts appear on our Instagram account and Facebook Page, which run on Meta's platforms: Meta Platforms, Inc., in the United States, holds them under its own terms and privacy policy. Meta also gives us statistics about visits to our Facebook Page, which Meta and we are jointly responsible for under Meta's Page Insights terms. Marketing use shows a testimony without your name and without a precise location, and a testimony you published anonymously carries no name in the first place. Removing those two things does not change the words of the testimony, so it may still be recognisable as yours. Separately, emails about the platform itself are sent only to people who have turned them on in their account settings, and every one carries a link to stop them. You can also contact us at [email protected].

AI Retellings

With your separate permission we may retell a testimony with AI in one of three forms: a short video narrated by an AI voice, a single post, or a carousel of images, each with AI-generated people. This is a different purpose from marketing and has its own Yes or No question, with no answer chosen for you; it can only be given while the testimony may also be shared beyond the site, because a retelling is shared there. To protect your privacy, the voice and the people shown are chosen at random and are not you, so they may not share your gender, and the words are a retelling rather than a reading of what you wrote: details may be changed or left out so that you are harder to recognise. Every retelling is labelled as made with AI. We post each one on our social accounts, such as Instagram, and email you when we do; it appears on Breaking of Bread after seven days unless you hide it, or straight away if you choose to show it. If you said yes before 10 October 2026, we ask you to approve each one instead, as we told you then. You can withdraw this permission at any time from the testimony's edit page or in the app, with one click; we then stop making new retellings, stop showing any on Breaking of Bread at once, and take down any already published on our social accounts within seven days. Each time you give or withdraw this permission we record when, and which version of this wording you saw. The legal basis is your explicit consent (UK and EU GDPR Articles 6(1)(a) and 9(2)(a)). When a reader opens a retelling on Breaking of Bread it is loaded from Instagram, so Meta Platforms receives that reader's IP address; nothing is loaded until the reader chooses to open it or has allowed Social media embeds. For testimonies shared before 6 October 2026, before this question was asked, we may have made a video if you allowed sharing beyond the site: we tell you by email, and it appears on your testimony page only after seven days unless you choose otherwise. Whichever applies, you can keep it off your testimony page while it stays on Instagram, or ask us to remove it everywhere.

Consent Records

When you submit a testimony we record that you accepted these terms: the version, the time, and a one-way hash of your IP address (never the address itself). We keep the same kind of record, without the address hash when you change it from the app or an email link, when you turn on emails from us, and we note the date if you turn them off again. These records are deleted when you delete your account.

Special Category Data

Testimonies reveal religious belief and may reveal health information. We rely on your explicit consent (UK GDPR Article 9) to publish this as part of your testimony.

Because this is a faith platform, your signed-in engagement activity — which testimonies you read, save to a collection, or say "Amen" to — can also reveal religious belief. We treat this activity as special category data and rely on your explicit consent (Article 9) to process it for features such as your Faith Passport. You can withdraw this consent at any time by deleting your account, which erases this activity.

Personalized Feed

When you are signed in, we order your home feed around the topics you engage with. The signals we use are your reading activity, the testimonies you say "Amen" to, your favourites, and the testimonies you add to collections. From these we infer which kinds of testimony interest you and show closer matches first. This inference relies on the same explicit consent (UK GDPR Article 9) described under "Special Category Data" above. Withdrawing that consent — by deleting your account, which erases the underlying reading and engagement activity — stops personalization entirely; and you can switch it off at any time without deleting your account (see below), which halts it immediately.

Personalization is on by default and you can turn it off in one tap from your account settings. With it off, your feed is shown newest-first with no targeting. If you are logged out, the feed order is randomized per visit with no profiling or targeting at all.

This ordering is not an automated decision that produces legal or similarly significant effects (UK GDPR Article 22) — it only changes the order in which public testimonies are shown to you. We log only your on/off changes (and an Article 9 consent record when you turn it on); we never log which testimonies you were shown, and the taste profile is computed on the fly and never stored.

Cookies

We use strictly necessary cookies to run the site, including one that remembers your privacy choices. Everything else is off until you turn it on, and each choice governs exactly one thing. Analytics counts a read of a story as a country and an hour, never linked to you. Marketing tells us whether a leaflet or a link brought you here. Social media embeds shows narrated videos and posts from Instagram: Meta Platforms then receives your IP address and details of your device and sets its own cookies under its own policy, and we never tell Meta which page you are on. If you are signed in, we record each choice and when you made it, and the Analytics choice is the same as "Count my reads" in your account. If your browser sends Global Privacy Control, we respect it. You can change any choice at any time via "Cookie preferences" in the footer.

Audience Measurement

When you arrive through a link we have tagged — such as the QR code on a printed leaflet — we add one to a counter so we can tell how well that leaflet or post is working. We store only totals: the campaign, which side of the leaflet, the date, the country and whether the device was a phone, tablet or computer. No cookie is set, and nothing is stored that identifies you or links these visits together. Your IP address is used only to work out the country and is then discarded.

How to Complain

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.