Privacy Policy

1. Information We Collect

When you create an account or use the app, we collect the following categories of data:

• —Account information: full name, email address, phone number, and password (securely handled by Firebase Authentication — passwords are hashed and never stored in plaintext)
• —Profile information: profile photo (securely stored on Firebase Storage) and church affiliation (via Church Code)
• —Content you create: prayer requests, messages, comments, elder Q&A submissions, feedback, and event data
• —Authentication data: if you sign in with Google or Apple, we receive your name and email address from the OAuth provider
• —Device and technical data: push notification tokens (via Expo), device type, login status, and timestamps
• —Voice input: if you use the voice search feature, audio is temporarily processed for speech-to-text conversion and is not stored
• —Images: photos you upload are securely stored on Firebase Storage (Google Cloud). Images are automatically compressed and resized before upload. By uploading images, you accept full responsibility for the content you upload
• —Notification history: in-app notifications are stored in our database to provide you with a notification history
• —Accessibility preferences: display and text size settings are stored locally on your device
• —Language preferences: your selected language is stored both locally and in your user profile
• —Calendar data: if you add events to your device calendar, event details (title, description, location, dates) are sent to your device's calendar application

2. How We Use Your Information

We use your data to provide and improve the Church Bridge service:

• —Authenticate and manage your account
• —Allow you to submit, view, and respond to prayer requests and other content
• —Process and display user-generated content within your church community
• —Deliver push notifications about activity relevant to you and store notification history for your reference
• —Send transactional emails (e.g., membership approval notifications) to your registered email address
• —Facilitate communication within your church community
• —Enable church leaders to manage their communities
• —Facilitate giving and donations by linking to third-party payment processors configured by your church administrators

We do not use your data for advertising, behavioral tracking, or user profiling.

3. Third-Party Services & Data Sharing

To provide Church Bridge, we rely on the following third-party services that may process your data:

• —Firebase / Google Cloud: authentication, database storage, and hosting of all app data. Google's privacy policy: https://policies.google.com/privacy
• —Firebase Storage (Google Cloud): secure image hosting — uploaded images are stored on Google's servers and protected by Firebase security rules. Google's privacy policy: https://policies.google.com/privacy
• —Expo (Expo Application Services): push notification delivery. Expo's privacy policy: https://expo.dev/privacy
• —Google Sign-In: if you choose to sign in with Google, your name and email are shared with us via Google's OAuth service
• —Apple Sign-In: if you choose to sign in with Apple, your name and email (or a relay address) are shared with us via Apple's OAuth service
• —Google Cloud Speech API: if you use voice search, audio is processed by Google for speech-to-text conversion
• —Gmail (via Nodemailer): used to send transactional emails such as membership approval notifications. Only your email address and the message content are transmitted. Google's privacy policy: https://policies.google.com/privacy
• —Third-party payment processors: if your church configures giving/donations, payment links redirect you to external payment services. We do not process, store, or have access to any payment or financial information. All payment processing is handled entirely by the third-party provider selected by your church administrator

None of these third parties use your data for advertising through our app. We do not sell, rent, or trade your personal data to anyone. We are not responsible for the data practices, availability, security, or policies of any third-party service. You are encouraged to review each third-party service's privacy policy independently.

4. Image Uploads & Storage

When you upload images to Church Bridge, they are securely stored on Firebase Storage (Google Cloud), the same infrastructure that hosts the rest of the app's data. By uploading any image, you acknowledge and accept all of the following:

• —Images are automatically compressed and resized before upload to optimise storage and performance
• —EXIF and location metadata is stripped from images before upload on mobile devices
• —Images are stored securely on Firebase Storage with authentication-based access controls — only authenticated users can upload images
• —When you delete your account, your profile photo and associated request images are automatically removed from storage
• —When a request is deleted, all associated images (including comment images) are automatically removed from storage
• —You are solely responsible for the content of any images you upload. Do not upload sensitive, private, confidential, or identifying images
• —Church Bridge, its developer, and its operators assume no responsibility or liability for the content of images uploaded by users
• —Image storage is subject to Google Cloud's terms of service and privacy policy: https://policies.google.com/privacy

5. Data Storage & Security

We take reasonable measures to protect your data:

• —All app data is stored on Google Cloud infrastructure via Firebase
• —Passwords are handled by Firebase Authentication (hashed, never stored in plaintext)
• —Access to your data is restricted to authenticated users within your church community
• —All data is transmitted over encrypted connections (HTTPS/TLS)
• —No system is 100% secure — while we take reasonable precautions, we cannot guarantee absolute security of your data

6. Data Retention

We retain your data as follows:

• —Account data is retained as long as your account is active
• —Content you create (requests, messages, comments) is retained as long as the associated church community exists
• —Notification history is stored in our database indefinitely to provide you with a record of past notifications
• —Images stored on Firebase Storage are retained as long as the associated content exists. When content is deleted, images are automatically removed from storage
• —Push notification tokens are updated on each login; old tokens are removed on logout
• —Accessibility and language preferences stored on your device persist until you clear your browser or app data
• —You can request deletion of your data at any time (see Your Rights and Account Deletion sections below)

7. Your Rights

You have the following rights regarding your personal data:

• —Access: view your stored data in your profile within the app
• —Correction: update or correct your personal information at any time through your profile settings
• —Deletion: delete your account and associated data via the account deletion page or by contacting us
• —Data portability: request a copy of your personal data in a portable format by contacting us
• —Withdraw consent: opt out of push notifications at any time through your device settings
• —Restriction: request that we limit the processing of your data in certain circumstances

To exercise any of these rights, contact us at churchbridge.app@gmail.com.

8. Account Deletion

You can permanently delete your Church Bridge account at any time. Deletion can be initiated from the account deletion page on our website or by contacting us directly.

• —Deletion removes: your profile, all Firestore data, your Firebase Authentication account, requests you created, your notification history, ministry volunteer records, and your membership in all churches
• —Deletion does NOT remove: messages or comments in community threads (these are anonymized). Note: your profile photo and request images are automatically deleted from storage upon account deletion
• —Account deletion is permanent and irreversible

To delete your account, visit our account deletion page or email churchbridge.app@gmail.com.

9. Children's Privacy

Church Bridge is not directed at children under 13 years of age (or under 16 in the European Union). We do not knowingly collect personal information from children under these ages.

• —If a parent or guardian becomes aware that their child has provided us with personal data without their consent, they should contact us immediately at churchbridge.app@gmail.com
• —Upon verification, we will promptly delete the child's personal data from our systems
• —Church leaders and administrators are responsible for ensuring that minors use the app with appropriate parental awareness and consent

10. Push Notifications & Email Notifications

We use the Expo Push Notification Service to deliver push notifications and Gmail (via Nodemailer) to send transactional emails.

• —Push notification tokens are stored in our database to deliver notifications to your specific device. Multiple tokens are tracked if you use multiple devices
• —Notification history is stored in our database so you can view past notifications within the app
• —Transactional emails (e.g., membership approval/rejection notifications) are sent to your registered email address using Gmail's SMTP service
• —You can opt out of push notifications at any time through your device's notification settings
• —Opting out of push notifications does not affect email notifications or other app functionality
• —We are not responsible for email delivery failures, delays, or any issues caused by your email provider or Gmail's services

11. Speech Recognition

Church Bridge offers an optional voice-to-text input feature for searching within the app.

• —Audio is processed by Google Cloud Speech API for speech-to-text conversion and is not stored by us or by Google after processing
• —Microphone access requires your explicit permission and can be revoked at any time through your device settings
• —Voice input is entirely optional — all features are fully accessible via text input

12. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data under the following legal bases:

• —Consent: for push notifications, email notifications, microphone access, image uploads, calendar access, and optional sign-in methods (Google/Apple)
• —Contractual necessity: to provide the services you signed up for, including account management, church community membership, content features, and notification delivery
• —Legitimate interest: for community safety and integrity, such as muting or banning users who violate community standards

13. Calendar Integration

Church Bridge allows you to add events to your device's calendar application.

• —When you choose to add an event to your calendar, event details (title, description, location, start/end dates) are sent to your device's calendar app (Apple Calendar, Google Calendar, or other installed calendar)
• —Calendar access requires your explicit permission on iOS and can be revoked at any time through your device settings
• —We do not read, access, or modify any existing events in your calendar — we only create new entries when you explicitly request it
• —We are not responsible for how your calendar application or its associated cloud service handles the event data after it is added

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will update the effective date at the top of this policy and may notify you via in-app notification or email.

15. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us at:

• —Email: churchbridge.app@gmail.com

For warranties, limitations of liability, indemnification, and other legal terms governing your use of Church Bridge, please see our Terms of Service.