Privacy Policy

Last updated 23 August 2026

A church is trusting us with its congregation's names, addresses and giving. This page says exactly what we do with that, in the order you would ask.

The short version. We never sell church or congregant data. We never share it with advertisers. Card numbers never touch our servers. A church’s data is visible only to the people that church invites, and to us only when we are fixing something.

Two different roles

For the church staff who hold an account, we are the controller — we decide what to collect to run the service.

For a congregation’s own records — members, giving, prayer requests — we are a processor acting on the church’s instructions. The church decides what to keep and for how long. If a member asks to be removed, ask their church; we will help the church do it.

What we collect

From church staff

Name, email address, and a password hash — or a Google account identifier if you sign in that way.
Which church you belong to and your role in it.
Sign-in times, and a record of significant actions taken in the admin.

From a congregation

Whatever the church enters or a visitor submits: names, contact details, form responses, prayer requests, attendance, giving records.
Push notification subscriptions, if someone opts in.

What we never collect

Card numbers. Payment details go straight to Stripe and never reach our servers.
Location beyond the town a church chooses to publish.
Anything from a visitor’s device beyond ordinary web analytics.

Analytics and cookies

We set one cookie: your sign-in session. It is httpOnly and SameSite=Lax, and it is not used for tracking.

On our marketing site we use Google Analytics with IP anonymisation on and both advertising signals turned off — we do not build advertising audiences from people who read about us. A church may connect its own analytics to its own site; that is between the church and that provider.

Who else touches the data

Google Cloud — hosting and database, United States.
Stripe — payments. Card data goes to them directly.
Resend — sending email on a church’s behalf.
Anthropic — the AI features. Content sent for a task is not used to train models.

That is the whole list. We do not sell to or share with anyone else.

Children

Churches record children for check-in and safety. That data is entered by the church, is visible only to the people the church authorises, and is never used for anything other than the feature it was entered for. We do not knowingly let children create accounts.

How long we keep things

While the account is open, for as long as the church wants it.
After an account closes: 30 days, then deletion.
Backups roll off within 14 days.
Financial records may be kept longer where the law requires it.

Your rights

Ask us for a copy of your data, a correction, or deletion. Church administrators can export everything themselves from the admin at any time, without asking.

Contact

info@holdfast.church — 4724 Woodland Dr, Lawrence, KS.