Privacy statement
This English text is a translation. Only the German version is authoritative.
1. Controller
The controller responsible for the processing of personal data on this website is:
Joel Rabi Frank
Eichendorffstraße 2b 51702 Bergneustadt Deutschland
kontakt@bible-verse-project.org
2. Data protection officer
An external data protection officer will be appointed; their contact details will be published here once the appointment has been made. Until then, please contact the controller directly.
3. What this website is about
The Bible Verse Project is a non-commercial research project. It measures how people use the Bible – in sermons, devotionals, lectionaries, publications and other sources – and publishes statistics on it. The website is under construction.
The website uses no tracking or advertising cookies, no analytics services and no third-party content (no external fonts, scripts, maps or videos). There is no automated decision-making and no profiling.
4. Visiting the website (server logs)
Whenever a page is requested, the server processes technically necessary data:
- Web server access log: time, requested address without query parameters, method, status code, amount of data, processing time and a shortened IP address (for IPv4 only the first two of four blocks, for IPv6 only the first 32 bits). Browser identification, referrer and cookies are not logged. The log file is rotated once it reaches 50 MB; rotated files are deleted after 14 days.
- Application log: error messages and slow requests with a random request ID, the kind of page requested (without the specific address) and the duration or the type of error, without IP address and without form contents. Deleted after at most 90 days; technical error events in the database after at most 365 days.
- Protection against abuse: to limit excessive requests from one connection, a non-reversible value is derived from the IP address (for IPv6, from the /64 prefix) using a secret key; the IP address itself is not stored for this. The counters are deleted after one day.
Purpose: secure and error-free operation, defence against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
5. Cookies
The website sets only cookies that are strictly necessary for the functions you use (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent is needed for them. All cookies apply to this website only, cannot be read by scripts and are sent over HTTPS only.
| Cookie | Purpose | Storage period |
|---|---|---|
__Host-bvp_pre | protects forms against forgery by other websites (CSRF protection) | until the browser is closed |
__Host-bvp_lang | remembers the language, only if you choose one yourself | 1 year |
__Host-bvp_session | keeps signed-in people signed in | until the browser is closed; with “stay signed in” 30 days |
__Host-bvp_mfa | intermediate step of signing in with a second factor | 5 minutes |
Legal basis for the related processing: Art. 6(1)(f) GDPR.
6. Accounts (currently for the project team only)
There is no public registration yet. For accounts of the project team the following is processed: e-mail address, display name, the password only as a hash (argon2id; the password itself is never stored), where set up an encrypted second factor, sign-in sessions and security events (e.g. sign-ins, password changes). Changes to the e-mail address and display name are logged in encrypted form; when the account is erased, the key is destroyed so that these details can no longer be read.
Sessions end after 12 hours or after 2 hours without activity; with “stay signed in” after 30 days. Session data is deleted 30 days after the session ends, security events 90 days after they occur.
Legal basis: Art. 6(1)(b) GDPR (use of the account) and (f) (security).
7. E-mails from the website
For resetting a password and for security notices the website sends e-mails via Scaleway SAS, Paris, France (data centre in the EU, Paris region), as a processor under Art. 28 GDPR. The recipient address and the content of the e-mail are processed. Links for resetting a password are valid for one hour and work only once.
Legal basis: Art. 6(1)(b) and (f) GDPR.
8. Hosting and backups
- Server: netcup GmbH, Karlsruhe; data centre in Nuremberg, Germany (processor under Art. 28 GDPR).
- Backups: encrypted backup copies at Hetzner Online GmbH, Gunzenhausen; storage location Germany (processor under Art. 28 GDPR). The last five weekly full backups are kept, that is about 35 days; only then have deleted data disappeared from the backups as well. So that an erasure is carried out again after a restore, a list of executed erasures and objections is also kept there; it contains pseudonymous values only (no names, no e-mail addresses).
All connections are encrypted with HTTPS.
9. Contact
If you contact us by e-mail or telephone, we process your details to deal with your request. E-mails are stored at Proton AG, Plan-les-Ouates (Geneva), Switzerland (processor under Art. 28 GDPR). The European Commission has found that Switzerland ensures an adequate level of data protection (adequacy decision, Art. 45 GDPR). We delete your details once your request has been dealt with and no statutory retention obligations apply.
Legal basis: Art. 6(1)(f) GDPR; for enquiries about an account, (b).
10. Research database: details about persons from published sources
The database records which Bible passages are used in sources, together with details of the source, such as the author, preacher, organisation, place and date. These details come from published sources (e.g. sermon archives, devotional books, lectionaries, works of historical authors); the sources are listed in the project records and cited for every entry. Sermon texts are not stored. The database stores Bible texts only as follows: public-domain, openly licensed or expressly permitted Bible editions that may be shown on the website; copyrighted editions only in an access-restricted internal store that serves the automatic recognition of Bible quotations, is not publicly accessible and is not included in public exports or data releases (it is part of the encrypted backups, section 8); quoted Bible texts from uploaded files without documented permission only as a check value (hash). Of uploaded files, the original is deleted as soon as the import has finished; only a non-public copy is kept, in which protected Bible texts are replaced by their check value. It is not part of the backups.
Because details about the use of the Bible can relate to religious beliefs, strict rules apply to living persons: their details are not publicly visible by default; they are shown publicly only for public figures whose statements they have published themselves, and only with a documented legal basis. In public statistics small groups are suppressed so that nobody can be identified. Details about deceased persons are not covered by the GDPR.
Purpose: scientific research and statistics on the use of the Bible, also over long periods. Legal bases (provisional): Art. 6(1)(f) GDPR; for special categories Art. 9(2)(e) GDPR (manifestly made public by the person) and Art. 9(2)(j) GDPR in conjunction with Section 27 of the German Federal Data Protection Act (BDSG; research and statistics), with safeguards under Art. 89 GDPR (pseudonymisation, access restriction, suppression of small groups).
Storage period: the data are stored permanently for the research purpose and are not deleted automatically (Art. 5(1)(e), Art. 89 GDPR). You can object at any time (section 11); an erasure normally takes effect within one month of your request (Art. 12(3) GDPR) and has also disappeared from the backups about 35 days later.
Storage locations: on the server in Germany (section 8). Working copies of individual source files are also kept in a private code repository at GitHub, Inc. (USA); the transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).
Duty to inform: notifying every individual person named in a published source would be impossible or would involve a disproportionate effort (Art. 14(5)(b) GDPR). This statement therefore makes the processing publicly known.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). To exercise them, please contact the controller (section 1).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority responsible for the controller, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, www.ldi.nrw.de).
12. Changes
This statement will be updated when new functions are added (e.g. public registration, a personal reading tracker, data donations). Such functions will only be switched on once the related privacy notices and consent texts are in place.
Last updated: 17 October 2026