Privacy
Privacy policy
A plain-English account of what we collect, why, and your rights.
This policy explains what data we collect when you read The Bible Well, why we collect it, who we share it with, how long we keep it, and how you can ask us to delete it. We've written it in plain English. Where the law uses specific words, we've used those too.
1. Who we are
The Bible Well ("we", "us") is a free Bible-content website operated by an individual publisher in the United States. We do not run advertising, do not have user accounts, do not have a newsletter, and do not sell anything.
For all questions about your data, including any request to exercise the rights described below, write to [email protected]. We respond within 30 days.
We are the data controller for the data we collect about you on this site. Microsoft and Google (described below) act as separate data controllers for the analytics data they receive.
2. What we collect
We collect two kinds of data:
Server logs (always). When your browser requests a page, our host (Railway) records your IP address, the URL you requested, your browser type, and the time. These logs exist to keep the site online and detect abuse. They are deleted after 30 days.
Analytics (consent-based for EU/UK/EEA/Swiss visitors; on by default elsewhere unless you signal otherwise). We use two analytics tools:
- Google Analytics 4 — counts pageviews and shows us roughly which articles people read. It collects your IP address (truncated by Google), an anonymous client identifier, device and browser information, the pages you visit, and the order you visit them.
- Microsoft Clarity — records anonymized session replays and heatmaps so we can see where the writing or layout confuses people. It collects the same kinds of technical data as GA4, plus mouse movements, clicks, and scroll positions on each page. We have configured Clarity to mask all text and form inputs, so the content of anything you type is not recorded.
Neither tool is used for advertising, profiling for advertising, or building a cross-site identity of you. We do not enable Google Signals, ad personalization, or Microsoft Advertising integration.
3. Why we collect it — and the legal basis
We process this data only to understand which articles are useful and to improve the site. Specifically:
| Purpose | Tool | Legal basis (GDPR / UK-GDPR) |
|---|---|---|
| Keep the site online, detect abuse | Server logs | Legitimate interests, Art. 6(1)(f) |
| Count pageviews, see which articles are read | Google Analytics 4 | Your consent, Art. 6(1)(a) |
| Diagnose layout / readability issues | Microsoft Clarity | Your consent, Art. 6(1)(a) |
Where we rely on consent, you can withdraw it at any time — see Cookie settings in the footer — without affecting the lawfulness of processing before withdrawal.
4. Cookies and similar technologies
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4 | Distinguish unique visitors | up to 2 years |
_gid | Google Analytics 4 | Distinguish unique visitors | 24 hours |
_clck | Microsoft Clarity | Persistent Clarity user ID | 1 year |
_clsk | Microsoft Clarity | Group pageviews into one session | 24 hours |
CLID | Microsoft Clarity | Identify first-time visit | up to 1 year |
MUID | Microsoft (clarity.ms) | Microsoft cross-site identifier | up to 13 months |
ANONCHK, SM | Microsoft (clarity.ms) | Session management, sync | short |
cc_cookie | This site | Stores your consent choice | 6 months |
If you visit from the EU, EEA, UK, or Switzerland, none of the analytics or Microsoft cookies are set until you click "Accept" on the cookie banner. You can change your choice anytime via Cookie settings in the footer.
If you visit from elsewhere and your browser sends a Global Privacy Control signal (Sec-GPC: 1 or navigator.globalPrivacyControl), we honor it as a request not to load analytics, and no analytics cookies are set.
5. Who we share data with
Google. Pageview data is sent to Google Analytics 4. The contracting entity is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with Google LLC in the United States as a sub-processor. See Google's privacy notice.
Microsoft. Session and heatmap data is sent to Microsoft Clarity. The contracting entity is Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), with Microsoft Corporation in the United States. Microsoft acts as a separate data controller for the data it receives from Clarity. See the Microsoft privacy statement and the Clarity data privacy page.
Railway. Our host (Railway Corp.) processes server logs on our behalf as a data processor.
We do not share data with anyone else.
6. International data transfers
We are based in the United States. If you visit from the EU, EEA, UK, or Switzerland, your data is transferred to the United States when our host serves you a page, and again when Google or Microsoft processes the analytics data (if you've consented).
The legal basis for these transfers:
- Google LLC is certified under the EU-US Data Privacy Framework, the UK extension, and the Swiss-US framework. The European Commission's adequacy decision for the DPF (Implementing Decision (EU) 2023/1795) covers these transfers.
- Microsoft Corporation is similarly certified under the EU-US DPF, the UK extension, and the Swiss-US framework.
- Railway Corp. transfers occur under Standard Contractual Clauses.
To request a copy of the relevant safeguards, write to [email protected].
7. How long we keep your data
| Data | Retention |
|---|---|
| Server logs | 30 days, then deleted |
| Google Analytics 4 event data | 14 months from your last visit (the shortest configurable retention) |
| Microsoft Clarity recordings & metrics | Up to 13 months (Microsoft's default), then deleted |
Consent record (cc_cookie) | 6 months, after which we re-ask |
8. Your rights
Under the GDPR (EU/EEA), UK-GDPR, and the Swiss FADP, you have the right to:
- Access the data we hold about you (Art. 15)
- Correct it if it's wrong (Art. 16)
- Delete it (Art. 17)
- Restrict processing (Art. 18)
- Object to processing based on legitimate interests (Art. 21)
- Portability — receive your data in a machine-readable format (Art. 20)
- Withdraw consent at any time, where processing is based on consent
Because we don't have user accounts, the data tied to you is the anonymized analytics records described above. We will honor any honest request — write to [email protected]. We respond within 30 days. We may ask you to verify identity in a way appropriate to the sensitivity of the request.
You also have the right to lodge a complaint with a supervisory authority. In the UK, that is the Information Commissioner's Office. In the EU/EEA, you can complain to the data protection authority in the country where you live, work, or where you believe your rights were infringed.
We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects.
9. California (CCPA / CPRA) and other US state rights
We do not "sell" your personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. The third parties listed above (Google, Microsoft, Railway) act as service providers or contractors and are contractually restricted to processing data on our behalf.
Because we do not sell or share, we are not required to provide a "Do Not Sell or Share My Personal Information" link. We do, however, honor the Global Privacy Control signal as an opt-out for any future processing that might constitute sale or sharing.
California residents have the rights listed in Section 8 (Access, Deletion, Correction). To exercise them, write to [email protected]. We will respond within 45 days. You may also designate an authorized agent. Categories of personal information we have collected in the past 12 months: identifiers (IP address, online identifiers), internet/network activity (pageviews, clicks, scroll). Source: directly from your browser. Business purpose: site analytics and security.
Colorado, Connecticut, Virginia, Utah, and similar states. The same rights apply. You can opt out of any targeted advertising or sale of your data; we do neither, but we honor universal opt-out signals where required.
10. Whether you have to provide this data
You don't. Reading any article on the site does not require you to identify yourself. If you reject the cookie banner (EU/EEA/UK/CH) or send a GPC signal, you can still read everything; we just have less information to improve the site.
11. Children
This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data to us through a contact form or similar, write to [email protected] and we'll delete it.
12. Source of data not collected from you
We do not buy or obtain personal data from data brokers, marketing lists, or any other third party. The only data we have about you is what your browser sends when you visit the site.
13. Changes to this policy
If we add a new analytics or third-party service, we'll update this page and — for EU/EEA/UK/Swiss visitors — re-prompt the consent banner before turning it on. Material changes will be flagged at the top of this page for 30 days. The current version is dated at the top.
14. Contact
Anything on this page unclear, or any request about your data: