Privacy
Lamplighter privacy
Updated October 28, 2026. Lamplighter is provided by Niche-Knack Apps LLC, Ohio, United States.
Reading on your device
You do not need a Niche-Knack account to use Lamplighter. Bundled books, searches, reading position, highlights, notes and saved studies work on your device. Lamplighter does not upload this local library to Niche-Knack automatically. The free app does not require beta diagnostic reports and contains no advertising service.
Settings, downloaded editions and saved work remain until you remove them or clear the app's data. Uninstalling can remove your saved work. Export anything you want to keep first. Device backups and files you export are controlled by you and your operating system.
What encryption covers
After you set up protection, Lamplighter encrypts the libraries and personal study data held in its protected vault on your device. Ordinary native app storage is not automatically protected. Public website installers, including the APK used to get started, and browser-app resource URLs remain public and may contain readable bundled Bibles. Protection setup does not encrypt those public files or every file on your device.
On Android, full installer blobs prepared or received and retained inside Lamplighter are encrypted on the device. Secure Wi-Fi installer transfer between installed Android copies uses HTTPS, with the connection verified against the sender's QR code scanned inside Lamplighter. Android still asks you to approve installation.
The small Android phone-to-phone handoff carries the reader without a second embedded copy of the selected library. Bibles and commentaries arrive separately through an encrypted connection between verified contacts. Each resource is checked before it enters the recipient's encrypted library, and identical installed content is reused. Transfers pause when the reader locks; copies already sent to another device cannot be recalled.
To install an app, Android needs an installable APK. A received APK in Downloads or Files is outside Lamplighter's whole-file encryption, and website APKs are public files. Remove the downloaded APK after installation; this does not uninstall Lamplighter. Deletion does not promise that operating-system records or other copies are gone.
Local JSON import verifies the encrypted copy before attempting to remove the exact selected source. Native imports keep a source that changed or cannot safely be removed and report that it remains. Browser imports cannot delete original files: remove those copies in your file manager after checking the imported library. Keep a separate master copy when preparing new translations or commentaries.
Reading and editing require temporary decrypted content in memory. Locking closes protected reader access, but encryption does not guarantee that every JavaScript string, operating-system memory copy, or screenshot has been erased.
Encryption and a game appearance cannot guarantee safety, privacy, anonymity, or that the app will escape discovery. Exports, backups, browser history, notifications, and operating-system records can have different protections. Review what you save or share.
Encrypted storage does not hide operating-system screenshots or recent-app previews. On Android's Chrome browser app, pressing Home can leave a Bible image in Recents even after reader access has closed. Use the reader's explicit lock control and wait for the game screen before leaving. Check the preview behavior on your device; automatic screenshot concealment is not assured, and physical native-app and iPhone behavior still need qualification.
An accessibility service or debugging tool with permission to read the screen may also read what you type, including passwords. Our Android test tooling could read password-field content. We did not separately test every accessibility service. Screenshot blocking does not protect against these permissions, and encryption cannot protect a password from a compromised device while you enter it.
Offline iPhone installation
For 1.11.95, the complete first save and backup migration on an actual iPhone remain unverified. An earlier iPhone installation needed a second attempt; the revised saving process has passed software checks, but that is not proof of a successful full installation on this phone. The security review separates completed tests from these remaining checks.
The default local route uses three QR codes: Wi-Fi, a temporary certificate, and the HTTPS installation. A protected Android sender creates the connection without an online certificate authority, public website, or DNS lookup. No certificate enrollment request or library is sent to Niche-Knack for this route. Android sends the app and selected library after both owners compare and approve the transfer code. The iPhone saves its library with its own protected-storage encryption. The iPhone PWA cannot pass the app on to another device.
Android creates fresh, nonexportable hardware keys for each transfer. It deletes the issuing key after signing the one connection certificate and before serving begins. The connection key is limited to the short session and removed when it closes or expires; startup also cleans up keys left by an interrupted process. These safeguards do not make a compromised device trustworthy or promise forensic erasure.
The initial local HTTP guide and certificate are public and unauthenticated. This is the exception to encrypted transfer: neither the app nor library is sent over HTTP. Before installing the certificate, inspect the actual iPhone Settings details: exactly one Certificate, no other payload, and all 32 SHA-256 bytes matching the Android screen. A matching name or a fingerprint printed by the downloaded guide is not verification. Only then install it and enable full certificate trust. That trust applies across the iPhone, not only to this app. The offline installation guide gives the complete checks.
The iPhone uses a manually entered proxy setting for this temporary Wi-Fi network only. There is no device-management enrollment or global proxy. The proxy accepts only the intended local HTTPS endpoint, requires approval before private resources, and does not forward requests to the internet. After the Home Screen app says Available offline, remove this temporary certificate/profile, forget the network, and check a cold offline launch. Remove the setup after cancellation or expiry too: expiry does not remove a trusted profile automatically. The operating system can still attempt its own network traffic; this is not a device-wide guarantee of silence.
Apple Lockdown Mode blocks new configuration profiles, so this local-certificate route is unavailable while it is enabled. Lamplighter does not ask you to disable that protection. Managed-device rules may also prevent installation.
Optional online certificate preparation and updates
The advanced Use an internet-prepared certificate instead route avoids installing a certificate on the iPhone. New online certificate setup is not open in this testing release; consumer preparation and renewal still need device verification. The default local route does not depend on this service. Preparing or renewing an online certificate requires a request that you start explicitly. The service receives the sender’s public key, random hostname, certificate request and ordinary connection information. Its private key stays on the Android device. The random sender identity and public-key binding are retained to protect ownership and support renewal. As new enrollments are processed, completed requests older than 30 days and keyed network-limit records older than seven days are removed. Uncertain issuance or cleanup records remain until resolved. These records do not contain your Bible library or personal work.
For that optional route, the certificate authority publishes certificates in Certificate Transparency logs, including the random hostname and public key. This does not publish the library or its encryption keys. The sender’s short-lived certificate lasts 160 hours (just under seven days); prepare or renew while online before offline use. Expiry stops new installations through that route, not reading a copy already saved on the iPhone. This online preparation is separate from the default local-certificate route.
Checking for a protected Android update is also an explicit online action. The download service sees ordinary connection and file-request information. The app verifies the signed release description, installer identity and content before preparing installation, and retains its received installer encrypted. It does not upload your library, journal, contacts or messages to check for an update.
Online books and sources
Online sources receive requests when the app loads their catalogs or when you read or download their editions. This can reveal your IP address, the requested edition and passage, and ordinary connection information to that provider. HelloAO is enabled initially; you can turn off online access or individual sources in Settings. Bundled editions remain available offline.
Direct-download versions include an optional API.Bible connection that requires a key you supply. This connection is not included in the initial store versions. When enabled in a direct-download version, that service receives your key and requests for its books and chapters. Reading a chapter also sends its usage-report token, a random identifier saved by Lamplighter, and a temporary session identifier to API.Bible's reporting service. That identifier is not your phone's serial number or advertising ID. Turning off the source stops future requests; it does not delete records the provider already holds.
If you add an edition registry, its server receives the catalog and download requests and any credentials needed to authorize them. Source keys and registry settings are saved on your device. The provider's own privacy and retention terms apply. Opening an outside link, such as Bible Gateway, takes you to that site's service.
Reading together and sharing
Church mode shares the session name, selected passage, and the leader's shared highlights and notes with people who join. Participants can save a study on their devices. Share invitations only with intended participants. Leaving a session does not erase copies others already received.
In the installed Android and desktop apps, Lamplighter encrypts and authenticates Church study messages before sending them over local Wi-Fi or Bluetooth. Browser Church pairing, including connections between a browser and an installed app, uses encrypted WebRTC data channels. Compare the connection codes on both devices before continuing.
Private Bitchat messages and supported library transfers between verified Lamplighter contacts are end-to-end encrypted. Public chats are public. This protection is separate from the HTTPS protection used for Android installer transfers. A resource offer requires the recipient's acceptance; it does not silently install a new library.
The optional LoRa prototype uses a local authenticated WebRTC connection to a computer gateway and an external Meshtastic USB radio at each end. Private, group, courier, and explicitly enabled resource-transfer content remains encrypted inside the radio framing. Discovery names, public keys, radio identifiers, packet sizes, and timing remain metadata; a radio channel key is not a substitute for verifying a contact. Locking the reader stops its gateway connection, but packets already handed to radio hardware and the radio firmware's own traffic cannot be recalled.
Nearby tests verified private messages and authenticated receipts over a Samsung A14 Bluetooth connection, a Linux Chromium relay, and two H1 radios. The mixed route used Android 1.11.90 and PWA 1.11.91 with experimental Web Bluetooth on Linux. Separate radio tests verified a group invitation requiring acceptance, a private courier message retained through a process restart and 30 actual minutes locked, and a 426-byte library resource resumed from an encrypted checkpoint. A fresh offer of the same resource required acceptance again and left one stored copy.
These nearby tests do not establish field range, multiweek retention, stock Bitchat compatibility, Windows or Mac helper operation, direct phone radio accessories, or iPhone radio behavior. Groups do not have store-and-forward delivery, and physical resource-courier carriage remains unqualified. Whole Bibles can take days or months over radio, and installers do not use this route. Encryption does not guarantee safety, privacy, radio silence, or delivery. The gateway guide explains the prototype's limits.
The new export workflow has passed software checks; its full file-picker and transfer journey on a physical Android phone remains unverified for 1.11.95.
New study, version, and commentary exports offer readable JSON or an encrypted file. The creating installation keeps each encrypted export’s key inside protected storage; another installation needs that file’s matching decryption QR. Browser keys belong to the saved browser installation, without hardware-backed physical-device identity. Supported backups exclude these keys. Anyone holding a file and its QR can open it, and access already shared cannot be recalled.
New browser backups are password encrypted and include saved resources, study work, contacts, and conversation history. Restoring a backup keeps the new app’s verified program files and creates a fresh messaging identity. Contacts need verification again; groups become read-only archives until recreated or rejoined. Active messaging keys, queued courier deliveries, and per-export QR keys do not migrate. Older backups restore only the data they contained.
Exports and handoffs contain the material you choose and go to the destination you select. Lamplighter does not retrieve copies after you share them. A game appearance changes what the app shows; the protected-storage setup determines what is encrypted on your device.
Android's optional Extra lock uses the list of apps you can open and recent app activity to check whether the apps you selected were just open. You grant usage access in Android Settings. This check happens on your device; Lamplighter does not send the app list or activity history to Niche-Knack or an online source. You can turn off the Extra lock before removing usage access.
Optional listening connections
Hosted narration is in private preview. If you connect a listening service, it receives your access token, the edition and passage requested, and your voice selection to provide audio. The token is kept in memory until the app closes. Local notes are not part of a narration request. No listening request is sent merely by opening the app.
Support and your choices
Local debug logs can be downloaded or cleared in Settings. They are not automatically sent to Niche-Knack. If you contact support, we receive the message, reply address and attachments you choose to send. Review attachments first and leave out credentials or private material that is unnecessary for the request. Our support privacy terms explain how those requests are handled.
To ask about this policy or request deletion of information held by Niche-Knack, contact support or email support@nk.tools. We may verify your reply address before acting. Information needed to meet legal obligations, prevent abuse or resolve a dispute may be retained for those purposes. For data held by a connected provider or another participant, contact them separately.