ChurchOn01
Two kinds of information
ChurchOn handles two different kinds of personal information.
- Account information for people who use the console (admins, pastors, staff) — we collect and manage this ourselves.
- Member information entered by a church — the church is responsible for it, and we store and process it only as the church directs.
02
What we collect
| Type | Information | When |
|---|---|---|
| Account | Email, name, password (stored encrypted by our sign-in provider), display language | When you first sign in |
| Google sign-in | Basic Google account info, such as email and name | When you sign in with Google |
| Profile (optional) | Phone number, profile photo | When you add them |
| Church | Church name, address, phone, contact email, senior pastor, denomination, year founded, logo, description, service times | When a church is registered or updated |
| Members (entered by the church) | Name, gender, birthday, phone, email, address, photo, family relationships, member type and title, baptism and ordination details, license plates, notes, change history | When a church enters them or a member updates them through a link |
| Collected automatically | Access logs (IP address, time, requested page, browser info) and activity history (who changed what, and when) | When you use the service |
03
How we use it
- Signing in and managing your account
- Providing church management features like member records, bulletins, and the library
- Sending sign-in codes, password resets, and church invitations
- Preventing abuse and fixing problems
- Answering your questions
04
Information that becomes public
When a church publishes a public bulletin, the names, giving lists, volunteer rosters, and other details the church adds can be seen by anyone with the bulletin link. Whether it appears in search engines is a separate setting the church controls.
- Member update links — the member who receives the link can view and edit their own information for 14 days.
- Library share links — anyone with the link (and password, if one is set) can view the file for the period the church chooses.
Photos and files are stored at long, hard-to-guess addresses that can't be browsed, but anyone who has the exact link can open them.
05
Service providers and international storage
ChurchOn relies on the providers below. Your information may be stored on or sent to servers outside your country, and every transfer is encrypted.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database, file storage | Finland (Helsinki) |
| Supabase, Inc. | Sign-in and account authentication | Japan (Tokyo) |
| Resend, Inc. | Sending sign-in codes and invitation emails | United States |
| Cloudflare, Inc. | Domain and photo/file delivery (CDN) — processes IP and browser info on each request | Global network |
| Google LLC | Google sign-in (if you choose it) | United States and other countries |
If we open paid plans, we'll add the payment processor to this policy and let you know first.
Fonts and icons load from jsDelivr, Iconify, and Google Fonts, which may receive your IP address and browser information.
06
How long we keep it
| Information | Retention |
|---|---|
| Account information | As long as your account exists. To delete your account, email us; we'll verify it's you and delete it within 30 days. |
| Church data and member information | As long as the church uses ChurchOn. When a church deletes a member, they disappear from the console and their photo is queued for deletion shortly after, but the rest of the record stays with the church's data. If a church asks us to delete all of its data, we will. |
| Library trash | Permanently deleted 30 days after being moved to the trash |
| Access logs | Web access logs: up to 90 days. Server activity logs: as long as needed for operations and security |
Deleted or replaced photos and files may stay visible for up to a day while cached copies on the delivery network (CDN) expire, and an old church logo may linger longer. Deleted data may also remain in disaster-recovery backups for a limited time.
07
What's stored in your browser
ChurchOn doesn't use advertising or tracking cookies. We only store what the service needs in your browser.
- Keeping you signed in
- Your display language (the lang cookie) and display settings, like light or dark mode
- A copy of the member list for faster screens — removed from your device when you sign out
- Copies of your profile and church info for display — may stay for up to 7 days
- Bible text — a public copy for finding verses quickly, not personal information
You can clear these anytime in your browser settings, though you may need to sign in again.
08
How we protect it
- All connections are encrypted with HTTPS.
- Each church's data is kept separate, so no church can see another's.
- What you can do depends on your role (admin or pastor/staff).
- We don't store passwords ourselves; our sign-in provider handles them securely.
- Public and share links are stored only as scrambled values (hashes), never in their original form.
09
Your rights
- You can view and edit your name, phone number, and photo anytime in your console profile.
- To access, correct, delete, or restrict your information, or to delete your account, email us at the address below. We'll verify it's you and let you know the outcome within 30 days.
- For member information, contact your church. If a request comes to us, we'll pass it on to the church.
10
Children's information
You must be at least 14 years old to create a console account. When a church adds information about children, it must get a parent's or guardian's consent where required.
11
When this policy changes
If we update this policy, we'll change the effective date at the top of this page and let you know in advance about any major changes.
12
Contact
Questions about these terms or your data? Email us and we'll get back to you quickly.
- Operated by
- X CODE ONE SDN. BHD. (202401041215 (1587061-U))
D-1-09, Plaza Arkadia, No. 3, Jalan Intisari Perdana, Desa ParkCity, 52200 Kuala Lumpur, Malaysia