Privacy Policy

Rohi for iPhone and Android, and Rohi for Chrome and Edge · Cornerstone Global LLC · Effective October 19, 2026 · Updated November 10, 2026

Prefer plain words? Your privacy explains who sees what in one page.

Rohi is a web browser made by Cornerstone Global LLC ("we"). This page lists what Rohi keeps on your device, what it sends, who receives it, how long it's kept, and how to delete it. You can delete your Rohi account at any time.

Rohi for iPhone, version 1.0

Version 1.0 of the iPhone app has no sign-in and no accounts. To remove everything it keeps, tap You, then Settings, then Delete account. The sections below about accounts, prayer requests, groups, teams and chat cover features that aren't in this version.

• Kept on your iPhone: history for 90 days, bookmarks, open tabs, downloads, settings, your home church and tradition, your first name if you add one, and Family mode's PIN as a one-way hash. You → Settings → Delete account removes all of it and starts Rohi again at the welcome screens; deleting the app removes it too.
• You search or open a page: your search or the page address goes to the search engine you chose or to that website, as with any browser.
• You search for your church: the church name you type goes to What's Up Church.
• You have a home church: your church's id goes to What's Up Church and rohibrowser.com to get its public events and announcements. The Events view also sends the church's city and state to rohibrowser.com. These requests carry no name, account or device id.
• You tap "Blocked by mistake?": your email app opens a message to us with the site name. It's sent only if you send it, and we then receive your email address and what you wrote.

Our servers use these requests to answer them. As with any website, the servers that handle them may briefly log technical details such as your IP address.

Your Rohi account

You sign in to Rohi with Sign in with Apple or Sign in with Google. Sign-in runs through Firebase Authentication, a service of Google LLC, which holds the account for us. Your account is used for church features, such as asking to join a small group or a serving team, so your church's leaders can answer you.

• What Firebase keeps for your account: a user ID made by Firebase, which service you signed in with (Apple or Google), and your name.
• Google sign-in: Firebase also keeps the email address of your Google account.
• Sign in with Apple: Rohi asks Apple for your name only, not your email. If Apple shares an email anyway, it may be a private relay address that Apple forwards to you.
• rohibrowser.com checks that your sign-in is genuine each time the app asks for church features. It receives your user ID, name and sign-in service with each request, and stores your user ID only with your join requests, your group or team memberships, a group or team you lead, and a list of which churches those are in, so deleting your account can find them all (below). It doesn't keep a profile of you.

Firebase handles this data for us under Google's terms for Firebase. Google's own privacy policy applies to your Google account.

Notifications and the VPN on your phone (version 1.1)

• Notifications (off unless you turn them on): each kind has its own switch in Settings → Notifications. When one is on, your phone's notification token is stored on rohibrowser.com with the group, prayer friendship, serving team, request or church it belongs to. Notifications are delivered through Expo, a notification service, and through Apple or Google. Group chat and group prayer notifications say only that something happened, because those words are locked on members' phones. Turning a switch off stops that kind.
• Whole-phone VPN (off unless you turn it on): the filter runs on your phone as a local VPN, and your internet traffic is not routed through Rohi's servers. To check for adult sites, the names of the sites your phone looks up are sent to Cloudflare for Families, which answers them under its own privacy policy. Rohi does not receive those site names.
• Accountability partner and VPN lock on your phone (off unless you turn them on, adults only): if you choose a partner, your phone sends rohibrowser.com how many pages were blocked, when it last checked in, and a notice if the VPN lock is turned off. Your partner receives those counts and notices in Rohi and, if they turn it on, as a notification. Site names and screenshots are not sent. Either of you can stop at any time.

Kept on your device

• History of the pages you visit, for 90 days, unless you clear it sooner.
• Bookmarks, open tabs, downloads and settings, until you delete them.
• Your first name, if you add one for the greeting.
• Your home church and church tradition, if you choose them.
• Family mode's parent PIN, stored only as a one-way hash.

Your browsing history and searches are not sent to us and are never tied to your account. Deleting the app deletes all of the above. Settings → Privacy & data clears history, cookies and site data.

What the app sends, and to whom

Church features you choose to use send more; they're listed in the next section. Websites you visit, search engines, What's Up Church and the organizations you give to have their own privacy policies.

Church features: what rohibrowser.com stores

These are used only if you choose them. Each item says what is stored, who receives it and how long it's kept.

• Prayer requests to your church: the request, the choice of "My church" or "Pastor only", and your first name if you add it (a request for the pastor always carries your first name, so the pastor can reach out). It isn't stored with your account: your phone keeps a private code so you can check on it, mark it answered or remove it. Requests to the church go to the church's prayer team, which decides what goes on the church prayer list. Requests for the pastor, and requests that mention harm, abuse or crisis, go to the person the church chose to read private requests (the pastor unless the church chose someone else, with an optional backup); the pastor can share one with the church's elders. The church can send you private replies, which are kept with the request. Each request, with its replies, is removed after 30 days; you can remove it sooner. The church sees how many people prayed, not who.
• Asking to join a small group or serving team (you need to be signed in): your first name, a phone number or email only if you add one, an optional message, your account's user ID, and the leader's answer. The group's or team's leader and the church's staff for groups or teams receive your first name, message and contact (if you added one); they don't receive your account details. If the leader doesn't use Rohi, they're sent a text or email saying your first name asked to join. If your church has connected Planning Center, your first name and contact may also be passed to your church's Planning Center account. Your request and membership are kept while you're in the group or team; leaving it, or deleting your account, deletes them. A church's group list is deleted after 400 days without any change.
• Small groups in the app (group prayers, the leader's note and meeting details, members' names and group chat): these are locked (AES-GCM encryption) on members' phones with the group's key before they're sent. The key travels in the group's link after the "#", which browsers don't send to servers, so rohibrowser.com stores the locked text and the group's members hold the key. The server also keeps a member number for each person who joined, when each request was shared and ends (30 days), and which member numbers prayed on which day. Group chat keeps the latest messages for 60 days. If the leader chooses the church the group belongs to, the group's name, meeting day, time and place, the leader's name as they give it and the number of members are stored unlocked for that church's staff. You can leave at any time and your requests are deleted; the leader can remove a request or a member, or end the group, which deletes everything for the group.
• Serving teams: the name you choose to share, your teams, and your answers ("I'll be there" or "Need a sub"), stored with a code your phone keeps, not your account. Church staff and your team's leaders receive your name and schedule. Leaving a team removes you; a church's serving data is deleted after 400 days without any change, and past Sundays after a year.
• Reports: when you report a chat message, a prayer request or a group, the report holds the reason you pick, the words you saw (up to 600 characters), the first name shown with them and where they were posted. It goes to your church's moderators (the pastor, elders and prayer director). It doesn't include your name or account. A report of "Concern for safety" also goes to the person the church chose for safety concerns. Reports are kept 90 days.
• Care follow-ups: a pastor or elder can note a life event for someone in the church (for example a hospital stay or a new baby) with a first name and a short note, so they remember to follow up. It's kept until 30 days after the last follow-up and isn't shown to members.
• Prayers with friends (in Rohi for Chrome and Edge): described in the extension section below.

What churches' leaders receive

• Pastor: prayer requests to the church, private requests, reports and safety concerns, and a weekly count of private requests.
• The person chosen to read private requests (and their backup): private requests and requests for the pastor. A request no one opens in a day moves to the backup, then the pastor.
• Prayer director: requests to the church (not pastor-only or crisis requests), and reports.
• Elders: private requests the pastor shares with them, and reports.
• Group and team leaders, and staff for groups or teams: join requests (first name, message, and a phone or email only if you added one) and the names on their teams' schedules.
• Numbers churches see are counted by Rohi from what people do (for example how many prayed or how many volunteers said they'll be there). Church staff can't type in or change them, and they don't show who.

Churches' leaders don't receive your browsing, searches, history, or your account's email.

Churches and church staff

• Church sign-up: when a pastor or staff member asks to bring a church to Rohi, we keep the church's name, city, state and website, and the person's name, role and church email, only to check the request. It is deleted 30 days after we approve or decline it (60 days if it's never decided).
• Change log: every change church staff make to their church's Rohi (for example a notice, the church's look or a prayer decision) is recorded with the day, time and how they signed in, so the church can see what changed. No one at the church can edit or delete it; it's kept 400 days. It doesn't include members' requests.

What Rohi does not do

• No advertising, and no advertising trackers or third-party analytics in the app.
• No tracking: we don't link your data with other companies' data for advertising, and we don't share it with data brokers.
• We don't sell your personal information.
• No device location, contacts or photos are collected.
• Your church tradition is never sent anywhere.

Protection

Blocking happens on your device. Blocked pages are not sent to Rohi. If you report a mistake, the report holds the site name only.

Rate limiting

To stop abuse, rohibrowser.com counts requests using a salted hash of your internet address. The hash is kept for a few minutes at most; addresses aren't stored.

Rohi for Chrome and Edge (browser extension)

The extension gives Chrome and Edge a Rohi new tab and the same protection. It has no analytics, and it doesn't read the pages you visit: the browser applies its blocking rules. You can sign in to the extension with the same Rohi account (Settings → Account), as described above.

• Kept on your computer, in the browser's storage for the extension: your language, first name if you add one, home church, church tradition, card order and settings, and your sign-in if you sign in. Removing the extension deletes them; Settings → Privacy & data → Clear Rohi data clears Rohi's data.
• Sent to What's Up Church: the church name you type when you search for your church, and your home church's id to get its public events. No name, account, cookies or device id.
• Your church's announcements: with a home church from What's Up Church's directory, Rohi asks rohibrowser.com for that church's public announcement, Sunday details and verses for the week, by the church's id only (no name, account, cookies or device id), at most every 30 minutes.
• Christian news (you can turn it off in Customize): Rohi asks rohibrowser.com for the latest headlines, at most every 30 minutes, with no name, account, cookies or device id. Your church tradition isn't sent; your computer picks which stories to show. Story photos load directly from each publisher's website, so that publisher receives your IP address, as with any website you visit. Opening a story takes you to the publisher's site.
• "Blocked by mistake?" opens your own email with the site's name filled in. If you send it, we receive that email, including your address and anything you add.
• Searches and pages go to the search engine you chose or the website, as in any browser. Explicit searches are stopped before they are sent.
• Sync with your Google account (off unless you turn it on): if you choose "Sync my Rohi settings with my Google account", your language, first name, home church, church tradition, card order and settings are stored with your Chrome sync data so they follow you to your other computers. Google holds them under its own privacy policy. Your background photo is never synced. Turning sync off removes Rohi's settings from your Google account.
• Accountability partner (off unless you turn it on, adults only): if you choose a partner, once a day your Rohi sends Cornerstone Global LLC how many pages it blocked each day for the last 8 weeks (by type only if you choose), whether it runs in private windows, and, if Rohi is removed, a notice of that. Your partner receives these counts in their Rohi. Never sent: which sites or searches, page addresses, history, times of day, or your names (they stay on each computer). The server keeps a pair's counts for 8 weeks; either of you can stop at any time, which deletes everything for the pair.
• Prayers with friends (off unless you add a friend): you add a friend only by sending them a link, and they accept in their own Rohi. Each friendship has its own key, made on your computer and carried only in that link after the "#", which browsers don't send to servers. The requests you share and the name you give are locked (AES-GCM encryption) with that key on your computer before they're sent; Cornerstone Global LLC stores the locked text, and the two friends hold the key. The server also keeps when each request was shared, when it ends (30 days), and how many times your friend prayed for it, under a random friendship number with no account, email or contact list. "Just me" requests stay on your computer. Either friend can remove the other at any time, which deletes the friendship and its requests; unaccepted invites are deleted after 14 days.
• Small group sharing: works as described in "Small groups in the app" above. Members can also block a member, which hides that member's requests on their own computer.
• "Let my church know" works as described above, and is off unless you turn it on.
• Your church tradition is never sent anywhere by Rohi, except into your own Google account if you turn on sync.

An extension can be turned off or removed, and protects only the browser it's installed in. For children, the full Rohi browser or your device's parental controls protect more.

How long we keep data

• Your account at Firebase: until you delete it.
• Prayer requests to your church and their replies: 30 days.
• Group prayer requests: 30 days. Group chat: 60 days. A group's other data: until the group ends, or 400 days without use.
• Join requests and memberships: until you leave the group or team or delete your account, or 400 days after the church's group list last changed.
• Serving teams: until you leave, or 400 days without any change; past Sundays after a year.
• Reports: 90 days.
• Accountability counts: 8 weeks. Prayers with friends: 30 days per request.

Deleting your account and data

• In the phone app: You → Delete account (at the bottom, when you're signed in).
• In Rohi for Chrome and Edge: Settings → Account → Delete account.
• Without the app: email us from the address on your account, as explained on Delete your Rohi account.

Deleting your account removes it from Firebase, and first deletes everything rohibrowser.com stores with it: your join requests (first name, the phone or email you added, your message and the leader's answer), waitlist spots, group and team memberships, texts or emails about your requests still waiting to go out, and any link between your account and a group or team you lead. Prayer requests, group prayer requests and chat, serving teams and reports aren't stored with your account; they're removed on the schedule above. The delete account page explains what remains, for how long, and how to ask us to remove it now.

Children and families

Rohi is designed to be safe for families, and Family mode lets a parent lock settings with a PIN. A teen in Family mode can ask to join a youth group only after a parent says yes on the phone. Rohi is not directed to children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, write to us and we'll delete it.

Your choices and rights

You can use Rohi's browser without church features, remove your requests, leave groups and teams, and delete your account at any time. Depending on where you live, you may have the right to ask what personal information we hold about you, to correct it, or to delete it. Write to us at the address below.

Changes

If this policy changes, the new version will be posted here with its date, and significant changes will be shown in the app.

Contact

Cornerstone Global LLC
522 W Riverside Ave, Suite #10702
Spokane, WA 99201
admin@cornerstoneglobalteam.com