1. Introduction
Welcome to Delegate Church ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App").
2. Information We Collect
2.1 Information You Provide
We collect information that you voluntarily provide when using our App, including:
- Account registration information (name, email address, phone number)
- Profile information (photo, bio, ministry interests)
- User-generated content (posts, comments, prayer requests)
- Communication data (messages, video chat participation)
- Event RSVPs and attendance records
- Volunteer activity and service tracking
2.2 Automatically Collected Information
When you use our App, we automatically collect:
- Device information (device type, operating system, unique device identifiers)
- Usage data (features used, time spent, interaction patterns)
- Log data (IP address, access times, app crashes)
- Location data (with your permission, for location-based features)
- IP addresses: We collect and store your IP address when you interact with our services, including when you open emails, click links, visit pages, and submit forms. IP addresses are retained for up to 90 days for security and analytics purposes, then automatically purged.
- Device fingerprints: We may collect technical attributes of your browser and device (such as browser type, screen resolution, installed plugins, and timezone) to create a device fingerprint. This is used for security purposes (fraud detection, bot prevention) and to improve your experience. Device fingerprints are retained for up to 180 days.
- User agent strings: We collect browser and device identification strings sent with each request for compatibility and security analysis.
2.3 Tracking Technologies
We use the following tracking technologies:
- Tracking pixels and beacons: Small transparent images in emails and on pages that allow us to record whether content was viewed or links were clicked.
- Campaign tracking links: Custom URLs that help us measure the effectiveness of our communications.
- Session identifiers: Temporary tokens that maintain your authenticated session.
Your Control: You can manage tracking preferences through your notification settings in the App. You may also opt out of email tracking by disabling image loading in your email client.
3. How We Use Your Information
We use the collected information to:
- Provide and maintain the App's functionality
- Enable communication between church members
- Facilitate event management and volunteer coordination
- Track engagement through our points system
- Send notifications about church activities and updates
- Improve and personalize your app experience
- Ensure security and prevent fraud
- Comply with legal obligations
4. Information Sharing and Disclosure
We do not sell your personal information. We may share your information:
- Within Your Church Community: Your profile, posts, and activity may be visible to other church members based on your privacy settings
- Service Providers: We use third-party services (Supabase for database, AWS for storage) that may access your data to provide services
- Legal Requirements: We may disclose information if required by law or to protect rights and safety
- With Your Consent: We may share information for other purposes with your explicit consent
5. Third-Party Services
Our App integrates with third-party services:
- Supabase: Database, authentication, and serverless functions
- Amazon Web Services (AWS): File storage (S3), email delivery (SES)
- Firebase (Google): Push notifications via Firebase Cloud Messaging
- Agora: Video conferencing and live streaming
- Stripe: Payment processing for donations and subscriptions via Stripe Connect (we do not store full credit card numbers; payment credentials are held by Stripe)
- Telnyx: SMS and voice communications
- OpenAI / Anthropic: AI-powered features (content suggestions, analysis). Your data processed by AI services is governed by their respective data processing agreements.
- Sentry: Error tracking and application monitoring (crash reports may include device model, OS version, and stack traces but no personal content)
- Cloudflare R2: Media and file storage
These services have their own privacy policies. We encourage you to review them. We maintain Data Processing Agreements (DPAs) with our critical vendors and review their security certifications annually.
6. Data Security
We implement industry-standard security measures to protect your information:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of sensitive data at rest
- Secure authentication mechanisms
- Regular security audits and updates
- Access controls and monitoring
However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
7. Your Privacy Rights
You have the right to:
- Access: Request a copy of your personal data
- Correction: Update inaccurate or incomplete information
- Deletion: Request deletion of your account and data
- Opt-Out: Unsubscribe from marketing communications
- Data Portability: Receive your data in a portable format
To exercise these rights, you can:
- Submit a Data Subject Access Request (DSAR) through the App's account settings
- Email us at privacy@delegate.church
We will respond to all DSAR requests within 30 days. Data export requests will provide your information in a portable JSON format. Account deletion requests will be processed within 30 days, with personal data either deleted or anonymized across all our systems.
8. Children's Privacy
Our App is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
9. Push Notifications
We may send push notifications for:
- Church announcements and updates
- Event reminders
- New messages and mentions
- Prayer request responses
To deliver push notifications, we store a device push token (provided by Apple Push Notification service or Firebase Cloud Messaging) on our servers. This token does not contain personal information but is linked to your account. You can disable push notifications in your device settings at any time, and your push token will no longer be used.
10. Microphone Permission (RECORD_AUDIO)
Our App requests microphone access to enable the following optional features:
- Speech-to-text input: Convert your voice to text for messages, tasks, notes, and other text fields
- Voice commands: Use voice to navigate the app hands-free
Important Privacy Notice:
- We do NOT record, store, or transmit your audio data
- All voice processing happens locally on your device using built-in speech recognition APIs
- No audio ever leaves your device or reaches our servers
- This feature is entirely optional - you can use the app without granting microphone access
- You can revoke microphone permission at any time in your device settings
11. Data Retention
We retain your information:
- For as long as your account is active
- As necessary to provide services
- To comply with legal obligations
- To resolve disputes and enforce agreements
When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law. Specifically:
- IP addresses in analytics logs are automatically purged after 90 days
- Device fingerprints are automatically purged after 180 days
- Expired authentication tokens are purged immediately
- Message content is anonymized (attribution removed) to preserve conversation integrity for other participants
- Donation records are anonymized (donor identity removed) to preserve financial records for the organization
12. International Data Transfers
Your information may be transferred to and maintained on servers located outside your country. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of changes by:
- Posting the new Privacy Policy in the App
- Updating the "Effective Date" at the top
- Sending a notification for material changes
14. Contact Us
If you have questions about this Privacy Policy, please contact us:
- 📧 Email: privacy@delegate.church
- 🌐 Website: delegate.church
15. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how we use it, and the right to request deletion of your personal information.
16. European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data.