Privacy Policy

1. Apps covered by this policy

This Privacy Policy applies to the following mobile apps published by Astrid Technology Ltd on Google Play:

• Bible Crossword (package com.astridtechnology.biblecrossword)
• Little Lights Bible Quiz (package com.astridtechnology.littlelightsbiblequiz)
• Roll Dash 3D (package com.astridtechnology.rolldash)

It also applies to the Astrid Church App Generator (app.astridtechnology.site), including the church web apps it hosts at <church>.astridtechnology.site and the Android apps it generates for churches; see Section 5A. It also covers Astrid Health and Astrid School (our desktop software) and this website. As we publish new apps and games under the Astrid Technology developer account, this policy extends to them automatically unless we publish a separate policy for that app.

2. Who we are

Astrid Technology Ltd is a software company based in Kampala, Uganda, building church apps, mobile games, health and school management software, and payment infrastructure. For the purposes of Uganda's data protection law, Astrid Technology Ltd is the data controller for the personal data described in this policy.

3. Governing law

This policy is written to comply with the Data Protection and Privacy Act, 2019 (Act No. 9 of 2019) and the Data Protection and Privacy Regulations, 2021 of the Republic of Uganda, which govern how personal data is collected, processed, and stored. The National Information Technology Authority, Uganda (NITA-U), through its Personal Data Protection Office (PDPO), is the regulatory authority responsible for enforcing this law.

Because our apps are distributed globally through Google Play, we also follow Google Play's Developer Program Policies and design our children's apps to meet the additional protections expected under frameworks like the U.S. Children's Online Privacy Protection Act (COPPA), even though our primary legal obligations are to Ugandan law as our home jurisdiction.

4. Information we collect

We design our apps to collect as little personal data as possible. Depending on the app, we may process:

Information collected automatically

• Advertising identifiers (e.g. Google Advertising ID) and basic device information, collected by Google AdMob to serve and measure ads.
• Approximate, IP-based location and device data used by Google AdMob for ad delivery, where personalized ads apply.
• App usage and diagnostic data (crashes, performance), collected via Google Firebase Analytics in apps that use it.

Information you provide or that is generated by gameplay

• Anonymous leaderboard identifiers and scores — Roll Dash 3D creates an anonymous account (via Firebase Anonymous Authentication) to sync your leaderboard position. This identifier is not linked to your name, email, or any other personal identity.
• Locally saved game progress (e.g. crossword progress, quiz scores, save files) stored only on your device using a local database — this data never leaves your device unless an app description above says otherwise.

We do not require account creation, and we do not collect names, email addresses, phone numbers, or precise GPS location in any of the mobile apps and games listed in Section 1. The Church App Generator works differently because church administrators have accounts; it is described separately in Section 5A.

5. Per-app data summary

This table reflects the current published behavior of each app as of the effective date above. If a future update adds a new data collection feature (for example, rewarded ads), we will update this policy before that update is released.

5A. Church App Generator

The Astrid Church App Generator lets a church create its own branded app: a web app at <church>.astridtechnology.site and, on the Pro plan, an Android app. It shows the church's YouTube services, audio sermons, events, and announcements.

Who is responsible for what

For church administrator accounts and billing, Astrid Technology Ltd is the data controller. Each church decides what to publish in its own app, such as leader names, photos and biographies, ministries, events, and contact details. For that content the church is the controller and Astrid Technology processes it on the church's behalf. A church should only publish personal details of its members or leaders with their consent.

Church administrators

• Account details: name, email address and password. Passwords are stored only as salted bcrypt hashes; we never see or store the password itself.
• Sign-in cookie: a single secure, HTTP-only session cookie (astrid_session) that keeps you signed in for up to 30 days. It is not used for advertising or tracking.
• Church profile and content you add: church name, logo and cover images, address, phone, email, WhatsApp and social links, service times, giving details, sermons (audio files and notes), events, announcements, ministries, and leaders.
• Payment references: subscriptions are currently paid manually by MTN Mobile Money, Airtel Money or bank transfer. When you submit a payment we record the plan, amount, method, transaction reference and, if you provide them, the payer's name and phone number. We use these only to verify the payment. We never receive your mobile money PIN or bank login.
• Android app build data: for churches with an Android app, we generate and securely store the app's signing key so we can publish updates for the church.

Church members and visitors

Church apps are read-only for members: members do not create accounts, and the apps do not collect their names, contact details, or location. Viewing a church app involves only standard web server logs (IP address, browser type, and the pages requested), which we use for security and troubleshooting. Church apps contain no advertising and no third-party analytics.

YouTube content

Church apps use YouTube API Services to list a church's public live streams, videos and playlists, and play them with YouTube's privacy-enhanced embedded player (youtube-nocookie.com). When you play a video, YouTube processes data under its own terms. By using these features you agree to be bound by the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. We access only public channel information. We never ask for access to a church's YouTube account.

Use of the Church App Generator is also governed by our Terms of Service.

Deleting a church app

A church administrator can ask us to delete their church and account at any time using the contact details in Section 14. We then delete the church's content, uploaded files and administrator account. We keep payment records only as long as needed for accounting and legal obligations.

6. How we use information

• To deliver, measure, and limit the frequency of ads within our free apps.
• To operate features you use directly, such as Roll Dash 3D's leaderboard.
• To run the Church App Generator: hosting each church's app, syncing its public YouTube content, building its Android app, verifying subscription payments, and contacting administrators about their account.
• To understand crashes and app performance so we can fix bugs and improve the apps.
• To meet legal obligations, including responding to lawful requests from the PDPO or other Ugandan authorities.

We do not sell personal data, and we do not use any data collected in our apps for purposes unrelated to operating and improving those apps. We do not use Church App Generator data for advertising.

7. Third-party services

We use the following third-party services, each of which processes data under its own privacy policy:

• Google AdMob — ad serving and measurement. See Google's Privacy Policy.
• Google Firebase (Analytics, Firestore, Authentication) — used only in Roll Dash 3D, for anonymous leaderboard sync and crash/performance analytics. See Firebase's Privacy and Security policy.
• YouTube API Services — used by the Church App Generator to show churches' public videos and live streams. See the YouTube Terms of Service and Google's Privacy Policy.
• Web hosting — this website and the Church App Generator (including its database and uploaded files) are hosted with our web hosting provider, which stores the data on our behalf.

These providers may process data on servers located outside Uganda — see Section 10 below.

8. Children's privacy

Little Lights Bible Quiz is designed for children and is configured as child-directed: it requests non-personalized, child-appropriate advertising from Google AdMob (content rating "G", with Google's child-directed and under-age-of-consent ad settings enabled), and it does not collect any personal information from its users. We do not knowingly collect personal data from children through any of our apps.

Our other apps (Bible Crossword, Roll Dash 3D) are general-audience apps not specifically directed at children, though family members of any age may enjoy them. None of our apps ask a user's age or request account sign-up.

If you are a parent or guardian and believe your child has provided us with personal information through any Astrid Technology app, please contact us using the details in Section 14 and we will investigate and delete it as appropriate.

9. Data retention

Locally saved game data stays on your device until you uninstall the app or clear its data — we never receive a copy of it. Anonymous leaderboard data (Roll Dash 3D) and analytics data are retained only as long as necessary to provide the leaderboard feature and to understand app usage trends, and are periodically purged by our service providers according to their own retention schedules.

Church App Generator data (administrator accounts, church content and uploaded files) is kept while the church's account is active and deleted when the church asks us to close it (see Section 5A). Payment records are kept for as long as accounting and tax law requires. Web server logs are kept for a limited period for security purposes.

10. International data transfers

Google AdMob, Firebase and YouTube may process data on servers located outside Uganda, and our web hosting provider's servers (which store Church App Generator data) may also be located outside Uganda. Where this happens, we rely on Google's own compliance program and standard contractual safeguards to ensure data receives an adequate level of protection consistent with the Data Protection and Privacy Act, 2019's requirements for cross-border data transfers.

11. Data security

We rely on the security practices of Google Play, Google AdMob, and Google Firebase to protect any data processed through those platforms, and we design our apps to minimize what leaves your device in the first place. For the Church App Generator, all traffic is encrypted with HTTPS, passwords are stored only as bcrypt hashes, and administrator sessions use secure, HTTP-only cookies. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your rights under Ugandan law

Under the Data Protection and Privacy Act, 2019, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or outdated personal data.
• Object to processing and request that we stop processing your data in certain circumstances.
• Prevent processing likely to cause you unwarranted damage or distress.
• Prevent processing for direct marketing purposes.
• Request deletion of personal data we no longer have a lawful reason to keep.
• Lodge a complaint with the Personal Data Protection Office (PDPO) at NITA-U if you believe we have not handled your data lawfully.

Church administrators can view and correct most of their church and account details directly in the Church App Generator dashboard. If you are a member and your details appear in a church's app, contact that church first; we will also help if you contact us. Because our mobile apps and games generally do not collect data that identifies you personally, most other requests will relate to the anonymous leaderboard identifier in Roll Dash 3D or to advertising identifiers, which you can also reset or opt out of directly from your device's ad settings. To exercise any of these rights, contact us using the details in Section 14.

13. Changes to this policy

We may update this policy as our apps change or as Ugandan data protection law evolves. We will update the "Effective date" above when we do, and for material changes we will make reasonable efforts to make that clear at the point an updated app version is released.

14. Contact us

If you have questions about this policy or how we handle your data, contact:

Astrid Technology Ltd
Plot 156 Namugongo - Bulindo Road, Kampala, Uganda
Email: privacy@astridtechnology.site or ask@astridtechnology.site
Phone: +256 763 399 917 / +256 748 966 658