Privacy Policy

Planning.Church (“we”, “us”) provides software that churches use to organize people, services, teams, events, giving records, and worship material. Each church that signs up is the owner of the information it puts into the platform. We process that information on the church's behalf and under its direction.

If you are a member or volunteer at a church that uses Planning.Church, your church decides what is recorded about you and who can see it. Direct questions about your own record to your church's administrator first — they can correct or remove it themselves.

We store only what the platform needs in order to work:

• Account details. Your email address and a password that is stored only as a salted scrypt hash — we never hold the password itself and cannot recover it.
• People records. Name, and where your church chooses to record them, email, phone, postal address, birthday, membership status, and administrator notes.
• Church activity. Teams and serving assignments, schedules and blockout dates, events and RSVPs, check-ins, groups, announcements, posts, and in-app messages and their attachments.
• Giving records. Amounts, dates, funds, and an optional note or provider reference. Payments themselves are taken by your church's own payment provider — card numbers and bank details never reach Planning.Church.
• Financial records your church uploads. A treasurer may import a statement exported from the church's bank or payment provider — for example PayPal, Cash App, or Venmo. We store the transaction rows in that file: date, amount, and the description the provider supplied, which often includes a payer's name. Account and card numbers are not imported. Your church also records its own expenses, including the team or department a cost belongs to, and who approved it.
• Worship material. Songs, arrangements, setlists, and the audio tracks and stems your worship team uploads.
• Security records. Session records and sign-in attempts, kept so we can spot and stop account abuse.

We do not use advertising trackers, third-party analytics, or behavioural profiling anywhere in the product.

We use this information to operate the platform for your church: signing you in, showing you the right records for your role, delivering schedules and notifications, storing and playing worship audio, and keeping the service secure and available.

We do not sell personal information. We do not share it with advertisers. We do not use your church's content to train machine learning models.

If an administrator connects a Google Drive account so the church can store its own worship audio there, we ask for the drive.file scope together with your basic profile and email address.

• drive.file is limited by design: it grants access only to files and folders this app itself creates. We cannot see, read, or touch anything else in your Drive.
• We use it to create a Planning.Church folder, write the track files your team uploads, read them back so they can be played in the app, and delete them when someone deletes them here.
• Your profile name and email are used only to show which account is connected on the storage settings page.
• We store the refresh token that keeps the connection alive, encrypted at rest. An administrator can disconnect at any time from the storage settings page, and you can revoke access from your Google account permissions.

Planning.Church's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to others except as necessary to provide the storage feature, do not use it for advertising, and do not allow humans to read it except with your explicit permission, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized.

The same commitments apply to the optional Microsoft OneDrive and Dropbox connections: we use them solely to store and retrieve your worship audio, encrypt the stored refresh token, and stop using the connection the moment it is disconnected or revoked.

One difference is worth stating plainly. Microsoft's app-folder permission works only on personal Microsoft accounts, not on OneDrive for Business, so connecting OneDrive grants the broader Files.ReadWrite permission. Technically that permission would let the app reach your other OneDrive files; in practice it only ever reads and writes inside the Planning.Church folder it creates, and we do not list, open, or index anything else. If you would rather grant the narrowest possible access, use Google Drive, where drive.file limits us at the permission level to files this app created.

Dropbox connections are confined by the provider to a private app folder inside your Dropbox Apps directory.

Within your church, access is governed by the roles and permissions your administrators configure. Across churches, records are isolated — one church cannot see another's.

We rely on a small number of infrastructure providers who process data on our behalf:

• Vercel — application hosting.
• Supabase — the PostgreSQL database.
• Cloudflare R2 — file and audio storage.
• Google, Microsoft, or Dropbox — only where your church has connected its own account for worship audio.

We may also disclose information where we are legally required to, or where it is necessary to protect the safety of people using the service.

We keep your church's records for as long as its account is active. Administrators can delete individual records at any time, and deleting them removes them from the live database. When a church closes its account we delete its data within 90 days, except where we are required to retain something by law. Sign-in attempt logs are kept only as long as they are useful for security.

Traffic is encrypted in transit with HTTPS and HSTS. Passwords are stored only as salted hashes. Storage refresh tokens and other secrets are encrypted at rest with a key held outside the database. The application sets a strict Content Security Policy and restrictive permissions headers, and every request is scoped to the signed-in person's church and role.

No system is perfectly secure. If we ever discover a breach affecting your information, we will notify affected churches promptly.

Backstage stores your session in the device keychain and keeps downloaded audio and setlists on your device for offline playback. Ambient pads work without an account and do not upload audio. Planning.Church for iOS uses a persistent signed-in web session. Neither app tracks you across other companies' apps or websites.

Delete your account in Planning.Church at Profile → Delete account, or in Backstage from the console menu → Delete account. After password confirmation, we delete your credentials, profile, memberships and personal messages across your churches and revoke all sessions. Shared church records remain without your account association. Downloaded files on other devices and protected backup copies may persist until removed or expired; they are not used to restore a deleted account to the active service.

You can ask for a copy of your personal information, ask us to correct it, or ask us to delete it. Because your church controls its own records, start with your church administrator — they can act immediately. If that is not possible, email us and we will respond within 30 days.

Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA, including the right to object to processing or to lodge a complaint with your local supervisory authority. We honour these requests regardless of where you live.

Churches often record children in family and check-in records, and that information is entered by a parent, guardian, or church staff member — not by the child. We do not knowingly let children under 13 create their own accounts. Check-in security codes exist specifically so that a child is only released to the right adult.

If we change this policy in a way that materially affects how we handle your information, we will update the date above and notify church administrators before the change takes effect.