Transparency

Privacy Policy

Last updated: October 18, 2026

Primitivo Cristão (primitivocristao.com.br) is a personal evangelism site maintained by Herbert Carvalho, who is responsible (controller) for the personal data processed here, under the Brazilian General Data Protection Law (LGPD — Law 13.709/2018). This policy explains, in plain language, what data we collect, why, with whom we share it and what your rights are.

1. Data we collect

While browsing, even without an account

• Email notifications (optional): if you ask to receive new studies, we store only your email and the date. It's used only for that notice — never sold or shared. The subscription only takes effect after you confirm via the link we send, and every email includes the "I don't want to receive these anymore" link, which deletes your address right away.
• Usage statistics via Google Analytics: pages visited, approximate time, device type and approximate region. They help us know what edifies readers most; they don't identify you by name. They use Google cookies.
• The site's own metrics: the pages you open, how long you stay and how far you scroll; where you click (for the heatmap); what you type in the site's search boxes; whether you press play and how far you watch videos; the chapters and words of the Bible you look up; device type, browser, language and time zone (which gives an approximate region); where you came from (Google, Instagram, direct link...); errors and page speed. If you're logged in, the visit is linked to your account. We don't store your IP and we never record what you type in other fields. It stays on our own server, only to improve the site, and you can turn off this measurement in section 8.
• Ad measurement via Google Ads: when we promote the site in ads, the same Google tag records whether the visit came from an ad and whether the person read a study. It's only to know whether it's worth continuing to promote; we don't identify you by name.
• Technical server logs: IP address, date and time, requested address and browser. Used only for security and to block abuse, and automatically deleted after 14 days.
• Preferences on your device (browser storage): reading theme and font size and a copy of the content so the site opens faster. They stay only in your browser. In the Android app, the Bible, the studies and the cards you opened (for offline reading) and comments written offline until they're published are also stored on the device; they disappear when you uninstall the app.
• Videos: they're shown via YouTube (Google). When you watch, YouTube may record data according to Google's privacy policy.

When using the contact form

Name, email, phone (if you provide it), subject and message — so we can reply. The message is stored in our database and sent by email to the person responsible for the site.

When creating an account in the study area

• First name, last name, email, phone (optional) and profile photo (optional).
• Signing in with Google: Google sends us your name, your email, your photo and an identifier for your Google account. We do not receive your password or any access to your Gmail, contacts, files or other data.
• Signing in by code: we send a 6-digit code to your email that's valid for 15 minutes. We store only an encrypted version (hash) of it.
• Session: an access code keeps you connected for up to 30 days on that device. It stays in your browser; on the server we only store the encrypted version.
• What you post and do: studies, topics and replies in discussions, likes, authors you follow, notices (notifications) and your choice to receive emails or not.
• AI questions: the questions you ask in a study's "Ask AI" and the answers, saved for you to check later and to manage the monthly question limit.
• Study groups: the groups you create or join, your role (owner, moderator or member), the messages and reactions in the chat, and the notes, links and files (images, PDFs, documents) you share. Photos taken on your phone are shrunk on your own device before sending, and the hidden data in them (like where the photo was taken) is erased at that moment.
• Email invites: when someone invites you to a group, we store your email, who invited you and the invite status, so the invite works. We send a single email with the invite; if you don't have an account, we do nothing else with your address.

When playing Faith Heroes TCG (jogo.primitivocristao.com.br and the Android app)

To play, you sign in with your Primitivo Cristão account. The game receives only your account identifier and your name from the website; it does not receive your email.

• On the game server we keep your collection (cards, boosters and Talents), your number of matches and wins, and reward milestones. These are used to make the game work.
• On the website server we keep a history of what happens in the game, linked to your account: when you accessed the game (through the website or the Android app, and your device's operating system, such as Android or Windows); the matches you played (opponent, decks, result, duration and, in ranked matches, the rating); and the boosters and cards you earned, opened or exchanged for Talents. It is used by the person responsible for the game to follow how it is being used and to improve it. This history is not shown to other players.
• During matches, your name is shown to your opponent. There is no chat.
• On your device we keep the game session (up to 30 days), the decks you built and your sound preference. They are removed when you sign out or uninstall the app.
• The game has no ads or purchases and, apart from the history above, does not use any other usage metrics.
• The IP address is used only to limit abuse (for example, many rooms open at the same time) and is not stored, either by the game or in the history.
• When you request deletion of your account, your game collection and history are also deleted. In matches you played against other people, your name will appear as “Deleted account”.

2. What we use your data for

• Keep your account and let you post, comment, like and follow authors — it's the service you asked for (LGPD, art. 7, V).
• Send emails: access codes and notices (replies to your questions, comments on your studies, new studies from authors you follow and the result of your study review). Notices can be turned off at any time in My profile.
• Reply to messages sent through the contact form.
• Answer your AI questions about the studies.
• Improve the site and the game with usage statistics and protect them against abuse, spam and attacks — our legitimate interest (LGPD, art. 7, IX).

We don't use your data for advertising and we don't sell it to anyone.

3. What is public

Visible to any visitor: your name, your profile photo, your author page, the studies you've published (after review), your topics and replies in discussions and your follower count.

Never shown publicly: your email, your phone number and the list of authors you follow (only you see that).

Study groups are not public. The group name and description appear to those who receive the invite link; the chat, library, files and member list only appear to those who take part. Files are delivered through links that last a few hours.

Site administration has access to all groups for moderation: it can read the chat, study comments, library and files, see the member list, delete messages, comments and files, remove members, change roles, suspend or delete a group. This access is used to keep the site safe and within the rules of the Terms of Use, and not for other purposes — group content is not sold, published or shared with third parties. So don't write anything in groups that you don't want the administration to be able to read.

4. Who we share with

Only with the services needed for the site to work, which process data on our behalf:

• Google — site hosting (Firebase), email sending (Gmail), statistics (Google Analytics), Google login and videos (YouTube). Google Policy.
• Oracle Cloud — server where the system, database and uploaded images are kept, in São Paulo (Brazil).
• DeepSeek — generates the "Ask AI" answers. It receives only your question and the study text; never your name, email or other account data. DeepSeek is in China. So don't write sensitive personal data (health, family, documents) in questions.
• Mercado Pago — processes the purchase of AI credits (Pix or card). You enter payment data directly on the Mercado Pago page; the site only receives the payment confirmation (amount, payment method and transaction number), which we store along with the credit statement for the period required by law.
• Google Play — in the Android app, processes the purchase of credits. Payment is made on the Google screen; the app only receives the purchase confirmation (product, order number and status), checked by the server directly with Google. Along with the purchase goes your account identifier on the site (a code, not your name or email), so the credits go to the right account.
• Authorities, only when required by law or court order.

Some of these services process data outside Brazil (such as Google and DeepSeek), always with the guarantees set out in the LGPD.

5. How long we keep it

• Account and posts: as long as the account exists. If you request deletion, we delete within 15 days.
• Access codes: valid for 15 minutes. Sessions: up to 30 days, or until you log out.
• Server logs: 14 days.
• Database backups: 14 days — deleted data also leaves the backups within that period.
• Contact messages: for the time needed to reply and follow up the conversation.
• AI questions: as long as the account exists.
• Faith Heroes TCG game: the collection and the history (game access, matches, boosters and cards) are kept for as long as the account exists and are deleted along with it; in other people's matches, your name becomes “Deleted account”.
• Study groups: as long as the group exists. A deleted message takes the attached file with it; when the owner deletes the group, the chat, library and files are deleted right away (and leave the database backups within 14 days). Email invites are valid for 14 days.
• Site metrics: clicks for 90 days; visits, page views and events for about 13 months.

6. How we protect it

Connection always encrypted (HTTPS); there's no password to leak; codes and sessions stored only in encrypted form; database with no direct access from the internet; daily backups with restricted access; and automatic limits against abuse. No system is fully immune to failures: if there's an incident that puts you at risk, we'll notify you and the competent authority, as the law requires.

7. Your rights

Under the LGPD (art. 18), you can, at any time:

• confirm whether we process your data and access it;
• correct incomplete or wrong data (you can change your name, phone and photo yourself in My profile);
• request deletion of your account and your data;
• request a copy of your data (portability);
• know who we share your data with;
• withdraw consents and turn off notice emails;
• complain to the National Data Protection Authority (ANPD).

How to ask: through the Contact page, giving the same email as your account. We reply within 15 days.

8. Cookies and browser storage

• Google Analytics uses cookies for statistics. You can block them in your browser settings or with extensions — the site keeps working normally.
• Login uses browser storage, not tracking cookies.
• The Google login button and YouTube videos may use Google's own cookies.
• Site metrics use browser storage for a random browser and visit code (it's not a cookie and doesn't identify you by name).

9. Children and teenagers

Reading is open to everyone. To create an account, those under 18 must have the knowledge and permission of a parent or guardian. We don't create accounts for children under 12; if we identify one, it will be deleted.

10. Changes to this policy

We may update this policy when the site changes. The date at the top shows the current version; important changes will be announced on the site.

11. Contact

Data controller: Herbert Carvalho. Questions or requests about your data: Contact page. See also the Terms of Use.