This Privacy Policy explains how Troott Technologies ("Troott", "we", "us") collects, uses, shares, and protects personal data when you use the Troott mobile app and listener account services at troott.com.

Troott is the data controller for listener personal data described here. Contact: hello@troott.com.

This policy applies to personal data we process when you:

• Download, install, or use the Troott listener mobile app;
• Create or manage a listener account;
• Stream sermons, build playlists, or use in-app features tied to your account.

It does not apply to ministers who publish content through Troott Studio — see Minister Privacy Policy. If you subscribe to our marketing newsletter on troott.com, MailerLite processes that data under separate consent as described in our Cookie Policy.

Account and profile: name, email address, phone number (if provided), date of birth, gender, country, profile photo, and account preferences.

Listening activity: sermons played, listening history, likes, playlists, library saves, followed ministers, topic interests selected during onboarding, and recent searches.

Device and technical data: device identifiers, operating system, app version, crash logs, and playback session metadata (device type, network type) to deliver and improve the service.

Payment data: when you subscribe, payment tokens and limited card metadata are processed by Paystack. We do not store full card numbers on our servers.

Communications: support messages and notification preferences, including push notification tokens if you opt in.

We do not collect precise location data from the listener app.

We collect personal data from:

• You directly — when you register, complete onboarding, update your profile, contact support, or subscribe.
• Sign-in providers — when you choose Google or Apple OAuth, we receive profile information permitted by those services.
• Automatic collection — when you use the app, including playback events, crash reports, and session metadata.
• Ministers (indirectly) — sermon metadata and public minister profiles you interact with; ministers do not receive your private library details.

We use personal data to:

• Provide streaming, library sync, playlists, search, and account features you request.
• Personalise recommendations based on ministers you follow, interests, and listening history.
• Process subscriptions, billing, and fraud prevention through Paystack.
• Send service messages, security alerts, and (with consent where required) marketing communications.
• Monitor crashes and usage to improve reliability, performance, and product experience.
• Enforce our Terms of Use, protect users, and comply with legal obligations.

Where UK or EEA data protection law applies, we rely on:

• Contract — to provide your account and listener features.
• Legitimate interests — to secure our services, prevent abuse, and improve recommendations, balanced against your rights.
• Consent — for optional marketing emails and push notifications where required.
• Legal obligation — where we must retain or disclose data by law.

See GDPR information for more detail.

We share personal data with service providers who help us operate Troott, including:

• AWS — media storage and content delivery.
• MongoDB / Redis — application data and caching.
• Paystack — payment processing.
• Bugsnag — crash reporting (may include user id and email when logged in).
• PostHog — product analytics when enabled.
• Google / Apple — OAuth sign-in, where you choose those options.
• Email providers — transactional messages.

We do not sell your personal data. Ministers may see aggregated analytics about listens to their own content, not your private library details.

We use listening history, followed ministers, and stated interests to rank and recommend sermons. This is product personalisation, not a decision with legal or similarly significant effects on you.

We do not make solely automated decisions that produce legal effects concerning you without human involvement.

We retain personal data while your account is active and for a reasonable period afterward to comply with law, resolve disputes, and maintain security logs.

When you deactivate your account, we mark your account as inactive (isDeactivated) and limit processing. Some data may remain in backups or as required by law. We do not currently offer a guaranteed immediate hard-delete timeline for all data categories.

See our GDPR page to request erasure where applicable.

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and secure token storage on your device (iOS Keychain / Android Keystore).

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

We use infrastructure and subprocessors that may process data outside your country, including in the United States (for example AWS, analytics, and crash reporting).

Where required by law, we rely on appropriate safeguards such as standard contractual clauses.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure in certain circumstances.
• Restrict or object to certain processing.
• Receive a portable copy of your data.
• Withdraw consent where processing is consent-based.

Self-serve data export is not yet available in the app. Email hello@troott.com to exercise your rights. See GDPR information for UK/EEA residents.

Troott is not directed at children under 13 . We do not knowingly collect personal data from children below that age. If you believe a child has provided us data, contact hello@troott.com and we will take appropriate steps.

We may update this Privacy Policy from time to time. Material changes will be communicated via the app, email, or this page with an updated "Last updated" date. Continued use after changes take effect means you accept the updated policy.

Privacy questions or requests: hello@troott.com.

Troott Technologies — troott.com

UK/EEA supervisory authority complaints are described on our GDPR page.