Privacy

The Pastor App stores pastoral care information you choose to capture. This can include sensitive information about people in your ministry, so we limit processing to what is needed to provide, secure, support, and bill for the service.

What we collect

• Account email, pastor and church profile details, preferences, and consent choices.
• People, contact details, family links, notes, prayers, tasks, milestones, and other records you enter or confirm.
• Text transcripts and questions you explicitly submit for AI processing. We do not upload microphone audio.
• Stripe customer, subscription, and payment status identifiers. We do not receive or store your full card number.
• Name, email, church, phone, and message details you choose to submit through marketing or contact forms.
• Security, diagnostic, and basic request logs needed to operate and protect the service.

How we use it

We use this information to authenticate you, sync your workspace, build your deterministic care queue, generate AI drafts you must confirm, answer questions from the records you authorize, provide support, prevent abuse, and administer billing. We do not sell pastoral records or use them for advertising.

Service providers and disclosures

• Supabase provides authentication, the hosted database, and server-side functions.
• OpenAI processes transcript or workspace context only after you give the in-app AI-processing consent and initiate an AI feature. OpenAI states that API inputs and outputs are not used to train its models by default.
• Stripe processes checkout, payment details, subscriptions, invoices, and billing management on the web.
• Customer.io receives information submitted through the site’s launch-update and contact forms so we can send the requested communication.
• Vercel hosts the product and marketing websites and may process basic request, security, and diagnostic information needed to deliver and protect those sites. Vercel Analytics is not enabled for version 1.0.1.
• Apple supplies iPhone platform services. The app requests on-device speech recognition; when it is unavailable, voice capture stops and you can type instead.
• PostHog is not active in version 1.0.1. If optional product analytics is enabled in a later release, it will remain off until you choose it and can be disabled in Settings.

We may also disclose information when legally required, to protect the service or others, or as part of a business transaction subject to appropriate safeguards.

AI processing and confidential notes

AI processing is off until you make an explicit choice. You can type instead of using AI extraction and can withdraw AI consent in Settings. AI never writes directly to a person’s record: it proposes a draft, and you decide whether to edit, confirm, or discard it. Counseling notes are always confidential. Other confidential notes are excluded from AI retrieval unless you explicitly include them for that conversation.

Device permissions and offline data

Microphone, speech-recognition, contacts, and notification permissions are requested only when the related feature needs them. Contacts are added only when you choose them. Notification previews use generic wording. Pending offline transcripts are encrypted for the signed-in account on that device and are removed after upload, deletion, sign-out, or an account change.

Retention and deletion

Workspace records are retained while your account remains open, including while an expired account is read-only. Pending AI drafts remain until you confirm or discard them. Marketing form information is retained while needed for the requested messages or support and until you unsubscribe or request deletion. Operational, billing, and provider logs may be retained for limited security, tax, dispute, backup, or legal periods. OpenAI may retain API abuse-monitoring logs for up to 30 days under its published API data policy unless a longer period is legally required.

Your controls

• Export your workspace from Settings, including after a trial expires.
• Withdraw AI processing consent, decline notifications, and change available privacy preferences in Settings.
• Delete your account from Settings. The authenticated deletion workflow cancels the Stripe subscription, deletes church-scoped records, and removes the login identity.
• Unsubscribe from marketing email using the message link or contact us.
• Ask to access, correct, export, or delete information where applicable by emailing hello@thepastorapp.com.

Your responsibilities

Pastors decide what information to enter about people in their care. You are responsible for having an appropriate purpose, giving notices, and obtaining consent where required by your church policy or applicable law, especially for sensitive pastoral information.

Security, children, and changes

We use access controls, tenant-scoped database policies, encryption in transit, and other safeguards, but no system can guarantee absolute security. The service is for adult pastors and is not directed to children. We will update the date above when this policy materially changes and provide additional notice when appropriate.

Contact

Privacy questions and requests: hello@thepastorapp.com.