Privacy policy

Who uses the app

Only invited people sign in: ministry staff, Over-Shepherds, and Life Group Shepherds. Group members do not have logins; they are records that ministry staff maintain on their behalf so the team can care for them. The app does not offer a public account or member-facing browsing.

What information we hold

We hold only what the ministry needs to care for its groups:

• Account & sign-in. For people who log in: name, email, optional phone, role, and status, plus the authentication credentials (a hashed password and session cookies) that keep you signed in.
• Member records. For group members (who do not log in): name, optional email and phone, household name, and a care-sensitivity flag.
• Group information. Group name, meeting day, time and location, capacity, lifecycle and health status, a free-text group type chosen from the ministry-managed list, and group notes, plus per-meeting attendance.
• Care information. Pastoral Care Notes and Prayer Requests, shepherd-care status and follow-ups, and group- and shepherd-health updates and grades.
• Interest Funnel. For people interested in joining a group: name, optional email and phone, the funnel state, the desired group and desired group type, and notes.
• Operational records. An audit trail of who did what (actions and metadata, not free-text bodies), which Over-Shepherd covers which Shepherd, and (only when the ministry turns it on) coarse usage signals (such as a sign-in or which area was viewed).
• Safety telemetry. Performance reports contain only an allowlisted metric and a fixed route template. Error reports contain an allowlisted error class, an optional opaque digest, and a fixed route template. Raw error messages, arbitrary path text, and IP addresses are not written to these application logs.

We do not ask for health, biometric, financial, precise-location, or advertising data. The only sensitive content is what a shepherd chooses to write into a free-text Care Note or Prayer Request, by intent.

How we use it

We use this information solely to run the ministry's care work: signing you in, organizing groups, tracking who needs care and what the next step is, and helping shepherds decide when to launch another group. We do not use it for advertising, and we do not track you across other apps or sites.

Who can see sensitive notes

Care Notes, Prayer Requests, and shepherd-care notes are fenced by database-level access rules and a visibility ladder (Super Admin ▸ Ministry Admin ▸ Over-Shepherd ▸ Shepherd). Two protections go further: a Care Note stays sealed to the person who wrote it until the Ministry Admin grants a per-person transparency setting, and the Ministry Admin's own Private Care Note is hidden even from the Super Admin.

Who processes data for us

We rely on a small number of service providers, each receiving only what it needs:

• Supabase: our database, authentication, and transactional email (invites and password resets).
• Vercel: application hosting and delivery of the bounded performance and error telemetry described above (no advertising and no cross-site tracking).
• Upstash: abuse and enumeration rate limiting for password reset, invite redemption, and public telemetry. It receives one-way identifiers rather than raw IP or email addresses.

Keeping and deleting data

The default way anything leaves a surface is a reversible archive (a soft delete), not a permanent erase. You can request deletion of your sign-in account at any time. The request signs you out and revokes access immediately; a Super Admin then completes the irreversible removal of your personal profile and linked sign-in identity. See the account deletion page for how it works and what is removed versus retained.

Profile deletion does not keep a recoverable copy of your profile: the remaining deletion record is structural and cannot be restored. Care Notes and Prayer Requests you wrote remain as part of the ministry's ongoing care history, but their authorship is anonymized. The completed request's free-text reason and your name or email as historical audit attribution are also removed.

Questions

For any privacy question, or to ask about the data we hold about you, reach the ministry team from the support page.