Holdfast and Steadfast
Privacy policy
This is the privacy policy for both Android apps published by Holdfast LLC: Holdfast and Steadfast. It is written so it can be the Google Play privacy-policy URL for either app. It describes what those apps and their pairing service do with information.
Effective date: November 10, 2026.
Holdfast LLC
30 N Gould St Ste 67031, Sheridan, WY 82801
holdfast.helpdesk@gmail.com
Who we are
Holdfast LLC provides Holdfast and Steadfast. The mailing address is 30 N Gould St Ste 67031, Sheridan, WY 82801. The contact for privacy questions and deletion requests is holdfast.helpdesk@gmail.com.
How to read this page
Some features run only on the phone. Some send a specific payload to a service so pairing, a chapter, speech, or a screen check can work. The sections below name those cases.
Information that stays on the phone
Unless a later section says it is sent, the apps keep the following on the device:
- Holdfast filter switches, allowlist, and the count of blocked DNS lookups. Blocked domain names are answered on the phone and are not saved as a browsing history.
- Holdfast's local yes-or-no that you confirmed you are 18 or older. A date of birth is not collected.
- Steadfast reading progress, translation choice, and devotional progress. The in-app deletion text says reading progress stays on the phone after the account is deleted.
- A Steadfast PIN, stored only as a hash, used as local friction.
- Bible text that ships inside the app (King James, American Standard, World English, and Berean Standard in Steadfast).
- Crash text, until you choose to email it. Holdfast does not upload crashes by itself.
Holdfast
Local VPN and DNS
Holdfast creates a local VPN so it can answer DNS. Lookups for blocked names are answered on the device. Lookups that are allowed are sent with DNS over HTTPS. Cloudflare Family is the default resolver. Google DNS is the other choice in the app. The resolver you select sees the domain names it is asked to resolve. Holdfast does not receive a copy of that browsing history, and it does not decrypt the sites you open.
Accessibility
When you turn on the Holdfast Accessibility service, Android delivers window events from the apps in front of you. Holdfast uses that to see which app is open and, in a fixed set of social apps and browsers, to notice an explicit on-screen label or an explicit search. Settings screens are not inspected. Image pixels are not read by this service. A block can be shared with your partner as the app or site label and the time. The words of the page, the search text, messages, and passwords are not the payload that is stored for the partner.
Usage access, overlay, and device admin
Usage access lets Holdfast tell which app is in the foreground, including when it needs to know that a system settings screen is open. Display over other apps lets it show a cover when protection should stay on. Device admin, if you turn it on, asks Android to refuse uninstall until a partner allows it. The admin role does not lock the screen, change your PIN, or wipe the phone.
Optional screen check
If you turn on the cloud image check, Holdfast captures a small JPEG of the screen about every 20 seconds while protection is on, the screen is on, Holdfast is not the foreground app, and an unlock is not running. The phone sends the pairing id, a hash of the image, and a poll secret. If that hash was judged in the last hour, the service returns the earlier allow-or-block result and the image is not sent again. Otherwise the phone sends the JPEG. The worker is written not to store the JPEG. It stores only allow or block for that hash for one hour. Your partner is not sent the image.
Partner reports
On a schedule you can set (daily or weekly, for a Holdfast Plus entitlement), the phone builds a report and posts it to the pairing record. The report can include a display name taken from the account email, whether protection is on, time protected, time off, time unlocked, up to 40 requests (unlock, pause, uninstall, partner change, unpair) with the outcome, and interruptions when VPN, Accessibility, or device admin was turned off. When history sharing is on, it can also include a count of content blocks and up to 12 app or site labels with times. It does not include page text or a full URL. The worker keeps the latest reports on that pairing record, up to eight, until the phone's pairing record is deleted. It can notify the partner's browser. The worker does not send the report by email.
Steadfast
Bible text and read-aloud
Opening a New Living Translation, New King James, or Christian Standard chapter sends that chapter request to API.Bible at rest.api.bible, with the app's API key. The request identifies the translation and the chapter. It does not include your account email.
Berean Standard narration can be streamed from openbible.com as an audio file for the chapter. Other listening uses the Android text-to-speech engine on the phone, or audio files shipped in the app. When a neural voice is needed, the chapter text is sent to Microsoft's Edge read-aloud service at speech.platform.bing.com, which returns audio. That call is the chapter wording, not your account.
App limits
For the apps you choose to guard, Steadfast uses usage access to measure time in those apps. A cover is drawn over a blocked app when focus time is gone. The Accessibility service is limited to the Instagram and Facebook packages. Its in-app description says it recognizes Instagram DMs, Facebook Messaging, and Facebook Marketplace, reads short labels, does not read what you type, and is used only while one of those unlocks is on.
Weekly summary for a partner
Steadfast can build a week summary with verses read, chapters read, reading streak, minutes in each guarded app (the app name), approved changes, and permissions that were turned off. When a partner is linked, the app posts that summary to the pairing service. If the post is not accepted, the phone offers the system share sheet instead, so you choose where it goes.
Check-in, including the microphone
The partner week summary above is one kind of check-in. A separate check-in screen lets you type a short note or dictate one. The microphone permission is requested when you tap the microphone, not at install. The app uses Android's speech recognizer to turn speech into text. It then posts the text, up to 1,000 characters, with a device id and, if you are signed in, the account id. The device id is the Android ID when one is available, otherwise a random id stored on the phone for this purpose.
The pairing service is written to send that text to a Cloudflare Workers AI model (Llama 3.1 8B) and to return a short note and Bible references. Verse wording is loaded on the phone. The code stores a daily rate-limit counter for the device id and the account id for about 48 hours. It instructs the worker not to log the check-in text. The text itself is not written to that counter.
Groups
If you create or join a reading group, the pairing service stores the group name, an invite code, your member id, a hash of your member token, the display name the app sends (the Groups screen stores the account email in that name), comments, prayers, notes, shared verses, days marked read, and chapter finishes. Other members of the group can see the posts that the group is built to show.
Accounts
Both apps sign in with email and password through Firebase Authentication over HTTPS. The Android apps call that API directly. They do not ship the Firebase Android SDK. Firebase receives the email, password, and session tokens, and returns an account id. The phone stores the session so it can stay signed in. Holdfast encrypts the refresh token in app storage. There is no separate analytics SDK and no advertising SDK in either app.
The same account can be the person using the phone and the partner for someone else's phone. An account cannot approve a request from its own phone.
The pairing service
A Cloudflare Worker stores the link between a phone and the partners that phone chose. A pairing record can hold the pair id, the phone user's account id and email, partner account ids and emails, grant-signing material so a partner can approve a pause, a poll secret the phone uses to fetch one-time grants, the latest grant, a status token, web-push subscription data for a partner's browser, the latest content-sharing digest, and the latest partner reports. One-time unlock and lock codes are short-lived. An invite used to pair is also short-lived. A replaced pair id can leave a forward pointer for 30 days so an old link still finds the current record.
The phone polls about every 20 seconds for a grant. The poll sends the poll secret, not the browsing history.
Why we use this information
- To run the filter, the app limits, Bible reading, and read-aloud that you turned on.
- To create and keep the partner link you asked for, and to deliver the approvals and summaries that link is for.
- To tell a screen check or an explicit-content watch whether to block, without giving the partner the image or the page text.
- To sell and restore an optional Plus subscription through Google Play.
- To answer a support email you send, including a crash report you choose to send. A Holdfast crash email can include the app version, Android version, device manufacturer and model, thread name, and a stack trace. Tokens that look like keys are scrubbed before the draft is opened. Your mail app sends it.
Who receives it
Holdfast LLC does not sell personal information. The apps do not include an ad network.
People and services that can receive information, depending on what you turn on:
- Partners you choose. They can see the link, approval requests, and the reports or digests described above. They do not receive DNS history, page text, or screen-check images.
- Reading-group members you join. They can see the group posts described above.
- Google Firebase Authentication. Email, password, and session tokens for sign-in.
- Google Play. Purchase and subscription status for Plus. Card numbers are handled by Google, not by these apps.
- The DNS resolver you select in Holdfast. Cloudflare Family by default, or Google DNS. It sees allowed domain lookups.
- API.Bible. Chapter requests for NLT, NKJV, and CSB.
- openbible.com. Berean Standard chapter audio when that narration is played.
- Microsoft's Edge read-aloud service. Chapter text when a neural voice is synthesized.
- The phone's speech recognizer, if you dictate a Steadfast check-in. See the review note in the check-in section.
- Cloudflare, which hosts the pairing worker, and Cloudflare Workers AI if a check-in note is submitted to that route.
- Google Cloud Vision, only if the screen-check provider is set to Google. See the review note in the screen-check section.
- Holdfast LLC support, when you email holdfast.helpdesk@gmail.com or send a crash report there.
How long it is kept
- On the phone: until you clear the app's storage, uninstall the app, or delete the account data that the delete path actually removes. See the deletion section. Steadfast reading progress is documented as remaining on the phone after account deletion.
- Pairing records, reports on those records, and content-sharing digests: until the phone user's account deletion removes the record, or until a partner is unlinked. Unlinking a partner removes that partner from the record and leaves the phone's record in place. The latest Holdfast-style reports kept on a record are capped at eight.
- One-time grants are built to expire in about five minutes and work once. Pairing invites expire in about ten minutes. A forward pointer from an old pair id is kept for 30 days. A screen-check verdict is cached for one hour and the JPEG is not written to storage.
- A check-in rate-limit counter, when that route is deployed, is kept for about 48 hours. The check-in text is not stored in that counter.
- Group posts you wrote are deleted when your account is erased. If you are the last member, the group is deleted. If you own the group and other members remain, ownership moves to the earliest remaining member and their posts stay.
- Support email is kept so we can reply and finish a deletion request you made.
Deletion
You can delete the account inside either app, or ask by email if you cannot. The steps, what is deleted, and what is kept are on this page and on the delete-account page.
In Holdfast: open the app, go to Settings, choose Delete account, and confirm. You need to be signed in. The app first asks the worker to erase the pairing data for that Firebase account, then deletes the Firebase user, then clears the local sign-in, pairing keys, and remembered partner emails. The dialog states that this does not uninstall the app. The delete function does not remove device admin. While device admin is on, Android can still block uninstall until a partner allows it.
In Steadfast: open the app, go to Settings, choose Delete account, and confirm. The app deletes the server account (pairing data and group memberships it can match), then the Firebase user, then the local partner and group account. The confirmation text says reading progress stays on the phone. A failed server response leaves the phone account in place.
Server erasure, for the signed-in account, deletes pairing records that account owns, removes that account as a partner from other phones, deletes the account's lookup pointers, and erases matching Steadfast group rows. The worker route itself does not delete the Firebase user. Each app does that as the next step when deletion succeeds. If you only email us, we delete both the worker data we can match to that account and the Firebase user.
Deleting a partner-only account does not delete the other person's phone record or that phone's digest. Deleting the phone user's account removes that phone's digest with the record.
If you cannot open the app, email holdfast.helpdesk@gmail.com from the account email if you still can, name the app, and ask Holdfast LLC to delete the account and the data stored for it. There is no separate account on this website.
Children
Holdfast is for adults and asks for a local confirmation that you are 18 or older. These apps are not directed at children under 13, and Holdfast LLC does not knowingly collect personal information from children under 13. If you believe a child has created an account, email holdfast.helpdesk@gmail.com and ask us to delete it.
Security
Sign-in and pairing use HTTPS. Partner approvals are signed for the linked account. A copied old pairing code is rejected. App backup of Holdfast and Steadfast data is turned off in the manifests so the link keys are not copied by Android backup. No method of storage is perfect. Use a device passcode, and do not forward one-time pairing invites.
Changes
When this policy changes, the new text will replace this page and the effective date will change. Continued use of the apps after the new date means the new page is the one that applies to that use.
Contact
Holdfast LLC
30 N Gould St Ste 67031, Sheridan, WY 82801
holdfast.helpdesk@gmail.com