Last updated October 23, 2026
Privacy · Ebenwell
If you are in crisis, call or text 988 in the US, or contact your local emergency services (911 in the US). Ebenwell is a spiritual support tool from Montgomery Appworks LLC. It is not medical or mental-health care. It does not treat, cure, or diagnose any condition.
This policy covers Ebenwell, a spiritual support tool from Montgomery Appworks LLC (Oklahoma). The bundle ID is com.montgomeryappworks.ebenwell.
Who this covers
The app is for people 17 and older. It does not ask you to create a company account. Support email: support@montgomeryappworks.com.
What stays on the device
These stay in local storage unless you export them or choose to share a short check-in through the system share sheet:
- Streak start date, check-ins, and a small integrity seal
- Quiz answers from onboarding (goals, how long, faith background, preferred time)
- Urge log (time, trigger, intensity, what helped)
- Journal entries
- Accountability names and phone numbers or emails
- Reading log and weekly reflection notes
- Settings, including PIN material and reminder choices
- The last Plus check: the product id, the expiration date, and the time of that check. It lets Plus stay available for up to 72 hours when the store cannot be reached. It holds no name, note, or contact. It is not part of an export. Delete all my data removes it, and so does a store read that shows no Plus.
The journal, urge log, partners, quiz, and reflections are encrypted with AES-GCM. The 32-byte key is stored in the device keystore with a this-device-only setting when the platform provides it. On web preview, the key falls back to local storage and the app says the keystore is a preview.
Streak facts are stored twice in app storage so a damaged primary copy can be repaired, plus a short seal. A missed day does not clear the streak. Only an explicit reset does.
Android backup is allowed so a streak can survive a device backup. The journal key is not in that backup, so restored journal ciphertext stays unreadable. Export is the readable copy.
What can leave the device
- A share you start yourself (check-in text, a hard-moment note, or a milestone card). The card does not include journal or urge text.
- An export file you choose to send.
- Store purchases, once real keys replace the placeholders. RevenueCat receives an anonymous app user id and purchase state. The connection is HTTPS, so RevenueCat also sees the device IP address. The app does not call log-in, does not set an email, and does not set subscriber attributes. It does not send your journal.
- A support email you choose to send to support@montgomeryappworks.com. Report a problem opens your mail app with a draft already filled in. You can read and edit every line before you send it. Nothing is sent until you send the message. The draft includes the app name, version, build, a device line, the OS version, and the platform. On Android the device line is the brand and model. On iPhone it is iPhone or iPad. The journal, streak, and notes are not included.
- On the web preview, Redeem code sends a SHA-256 hash of a code you type. It does not send the code, your journal, or your name. iPhone and Android redeem codes with Apple or Google.
The default analytics provider sends nothing. If a developer turns on the console logger, it prints the event name only, on that device. Event payloads cannot carry journal text, urge text, quiz answers, or partner contact details. There is no ad SDK and no third-party analytics SDK.
Notifications are local. Remote push is off in the Expo config (enableRemoteNotifications and enableBackgroundRemoteNotifications are false). The daily reminder is off until you enable it, at most one a day, and the lock-screen text does not name pornography. A trial reminder is scheduled only when a real trial is active and the reminder is still enabled. It fires 48 hours before the charge.
What we do not collect for ads
No advertising identifier is requested by this app. No ad network is linked.
Delete and export
Settings can export a JSON file or erase local data after you type DELETE. Erase removes the app storage keys, the journal key, the streak seal, and the last Plus check on that device. It does not cancel a store subscription. Cancel in the store. Subscription management is described in the app.
Erase does not remove RevenueCat's copy of the anonymous subscriber. The app does not log out or reset that id. Doing so would only create a new anonymous id and would leave the old record on RevenueCat's side. To ask for that record to be removed, email support@montgomeryappworks.com and say the request is about the Ebenwell purchase record. There is no account name to include.
Children
The app is not directed to children under 17. Do not install it for a child.
Stores and processors
Apple and Google process their own store payments under their policies. RevenueCat is the subscription processor for this app's own project, separate from any other app's project. When the SDK is configured, RevenueCat sees the anonymous app user id, purchase state, and the device IP address. Until live keys exist, the purchase buttons do not charge a card.
Changes
The published policy lives at https://montgomeryappworks.com/ebenwell/privacy. The in-app copy of the disclaimer stays in the binary until an update ships.
Contact
Montgomery Appworks LLC
9905 S Pennsylvania Ave Ste A, Oklahoma City, OK 73159