Why Your Prayers Deserve Encryption

Think about the last prayer you wrote down. Maybe it was about a health scare. A failing marriage. An addiction you haven't told anyone about. A confession that lives only between you and God.

Now imagine that prayer sitting in plaintext on a company's database. Accessible to engineers. Indexed for analytics. Potentially sold to data brokers.

This isn't hypothetical. In 2022, BuzzFeed's investigation "Nothing Sacred" revealed that popular prayer apps like Pray.com were doing exactly this — mining prayer content, matching user behavior with data purchased from brokers, and reserving the right to sell your spiritual data.

The problem isn't malice — it's architecture

Most prayer apps weren't built to be private. They were built like every other app: user writes data → data goes to server → server stores it in a database. The company can read everything because they have to — that's how the software works.

Even apps that promise "we don't look at your data" have a fundamental problem: they can. If a database is breached, if an employee goes rogue, if a government issues a subpoena — your prayers are readable.

There's a better way

Zero-knowledge encryption means the server never sees your plaintext. Here's how it works in The Praying App:

1. Your password is your key — your login password doubles as your encryption passphrase. One password, zero extra steps.
2. Key derivation happens on your device — your password goes through PBKDF2-SHA256 (600,000 iterations) to produce a Master Encryption Key. This never leaves your browser or phone.
3. Every entry is encrypted before sending — AES-256-GCM encryption happens in your browser. The ciphertext (scrambled data) is what gets sent to our server.
4. We store ciphertext — our database contains encrypted blobs. We don't have the key. We can't decrypt it. Even if someone breaks into our servers, they get gibberish.

What does this mean practically?

It means when you write "God, I'm terrified about this diagnosis" — that sentence is encrypted into something like U2FsdGVkX1+7x... before it ever reaches our servers. We literally see scrambled characters.

It means if we're hacked, your prayers are safe. If a government asks us for your data, we can only hand over ciphertext. If an employee tries to peek, they see nothing.

The tradeoff — and why it's worth it

There is one tradeoff: if you forget your password AND lose your Recovery Kit, your data is gone forever. We can't help you recover it because we never had the key.

We think that's the right tradeoff. Your prayers are sacred. The cost of true privacy is the responsibility of keeping your key safe. We give you a Recovery Kit during onboarding and strongly encourage you to print it.

Privacy isn't a premium feature

One more thing: our free tier gets the same encryption as our paid tier. AES-256-GCM for everyone. We will never paywall your safety. Privacy is a right, not an upsell.

Your prayers deserve better than plaintext on someone else's server. They deserve math.