Who this policy covers
This policy covers the FaithForm apps for iPhone and Android (“the apps”) and FaithForm's public web pages, such as a church's online giving page. “FaithForm,” “we” and “us” mean the company that operates them.
FaithForm is also used by churches to run their ministry. When a church uses FaithForm to keep its own records about the people in its community — its member directory, attendance, or giving records, for example — the church decides what it records and why, and FaithForm handles that information on the church's behalf. The church's own privacy practices apply to those records, and questions about them are best directed to the church. See Information your church holds.
Information we collect
Your account
- Your email address and password. Your password is stored in hashed form, so no one at FaithForm can read it.
- Your name, if you choose to give one.
- An account ID we assign to you.
- Which version of our Terms of Service and this Privacy Policy you accepted, and when.
Your churches
- The churches you follow, ask to join, or join, invitations you accept, and when each of those changed.
- Which church you have selected in the app.
- If a church connects your account to its own record of you (for example, when you accept its invitation), the link between the two.
Location
The apps use your device's location for two features, and only when you allow it.
- Finding churches near you. When you ask the app to show nearby churches, it sends your device's current location to our servers once, to find churches within a set distance. That location is used for that one search and then discarded: we don't store it, log it, or connect it to your account. You can always search for a church by name instead.
- Automatic check-in. If your church offers automatic check-in and you turn it on, the app explains what it does and asks for your permission first, and then your device asks for location access, including access while the app is closed, so you can be checked in when you arrive. See Automatic check-in below for exactly what it uses, sends and keeps.
Automatic check-in
Automatic check-in is optional. It is off unless you turn it on, the app works fully without it, and you can still check in by scanning or typing your church's check-in code, or be marked present by church staff, wherever your church offers those.
- What your phone watches for. Only your arrival at the locations your church has set up for check-in, such as the circle around its building. Your phone's operating system does the watching; the app doesn't follow your movements or record where you go.
- When anything is sent. Only when you arrive during a service's check-in window, which your church sets around its service times. Arriving at any other time, or being anywhere else, sends no location to us.
- What is sent. When you arrive during a check-in window, the app sends your location at that moment, how accurate it is, the time, which service and which of your church's locations it is for, and, on Android, whether your phone reported the location as simulated. It can send this more than once during one arrival: a few minutes later to confirm you stayed, or again if a reading wasn't precise enough.
- What is kept. We use your location to work out whether you were at church and then discard it. We never store your coordinates. We keep the result: whether you were inside or near the check-in area, how accurate the reading was, how long you had been there, and whether you were checked in, as part of your church's attendance records. So that we can confirm you stayed, we also keep a short record that you arrived at that church location and when; it stops being usable after two hours and is deleted automatically within about a day.
- Who sees it. Your church sees that you attended a service and that you were checked in automatically. Your church never sees your location, and no one else does either.
- Turning it off. Turn automatic check-in off in the app at any time, or remove the app's location access in your device settings. When you turn it off in the app, it stops watching for your arrival and we delete any arrival that was still waiting to be confirmed. Check-ins that were already counted stay part of your church's attendance records.
Camera
The apps use your camera only to read a check-in code your church shows on screen. The code is read on your device and only its contents are sent to us. The apps never take or save a photo with your camera, and they never read your photo library on their own. You can type the check-in code instead of scanning it.
Photos you choose
You can upload a profile photo, and a group's leaders can upload a photo for their group. If your church turns on group messages, you can also attach photos, videos, and files to a message. In every case you pick the file yourself, and only the file you pick is uploaded. Your profile photo is shown to the churches you are connected with and to people in groups you belong to.
Group messages
- Where a church turns them on, you can send messages in a group and directly to other members of that church. We store the messages you send, anything you attach to them, and who read them, so the conversation is there when you come back to it.
- Messages are delivered through Stream, a messaging provider that stores them for us. Your name, profile photo, and account identifier are shared with Stream so your messages can be shown with your name on them.
- If you report a message or a person, we keep your report, the reason you chose, anything you wrote, and the message you reported, and we make it available to that church's moderators and to us, so it can be acted on. If you block someone, we keep a record of that too.
- Your church can see the messages sent in its groups, and its moderators can remove content and remove people from a group.
Attendance and check-in
When you check in — by scanning a code, typing one, or automatically — we record the church, the service, the time, how you checked in, and whether the check-in was counted.
Giving
- When you give, we record the church, the fund, the amount, the time, and the status of the payment, so we can show you your giving history and receipts.
- Gifts are paid to the church, through the church's own account with our payment processor, Stripe. Your card or bank details, or your Apple Pay or Google Pay payment, go directly to Stripe. FaithForm never receives or stores your full card number. Stripe tells us whether the payment succeeded and gives us reference numbers for it.
- If you give on a church's giving web page, we also collect the name and email address you enter, so a receipt can be sent to you.
Notifications and preferences
- If you allow notifications, a notification token for your device, along with your device platform, app version, operating system version, and language, so we can deliver notifications to the right device.
- Your notification settings for each church (for example, announcements and events) and your communication preferences.
Technical information
When the apps or website connect to our servers, our hosting providers receive standard technical information such as your IP address, the type of device or browser, the app version, and the time of the request. We use it to run the service, keep it secure, prevent abuse, and fix problems.
The apps contain no advertising or third-party analytics software, don't use your device's advertising identifier, and don't track you across other companies' apps or websites.
How we use information
- To provide the apps: your account, your church connections, church announcements, sermons and video, check-in, giving, receipts, and notifications.
- To let the churches you connect with do what you've asked of them, such as approving a request to join, counting your attendance, or receiving your gift.
- To keep FaithForm and the people using it safe: securing accounts, preventing fraud and abuse, and limiting repeated requests.
- To contact you about your account, such as confirmation and password-reset emails, giving receipts, and replies to messages you send us.
- To comply with the law and enforce our Terms of Service.
We don't sell your personal information, share it for advertising, or use it to build advertising profiles.
How information is shared
With your churches
A church you follow or join can see your name as you entered it, whether you are following, have asked to join, or are a member, and when that changed. If a church has connected your account to its own record of you, your check-ins and gifts at that church become part of that church's records. A church receiving your gift can also see the payment details Stripe shows to the recipient of a payment, such as your card brand and the last four digits of your card. Churches never see your location or your password.
With service providers
We use a small number of companies to run FaithForm. They may use your information only to provide their services to us:
- Supabase — database, sign-in, and file storage.
- Vercel — hosting for our website and servers.
- Stripe — payment processing for gifts. Stripe also uses payment information for its own purposes, such as preventing fraud, under the Stripe Privacy Policy.
- Stream — delivery and storage of group and direct messages, where a church turns messaging on.
- Resend — delivery of emails such as giving receipts.
- Apple and Google — delivery of notifications to your device through Apple Push Notification service and Firebase Cloud Messaging, if you allow notifications.
For legal reasons and business changes
We may share information when we believe the law requires it, to protect the safety, rights, or property of the people who use FaithForm, of churches, of FaithForm, or of the public, or as part of a merger, acquisition, or sale of our business, in which case this policy will continue to apply to your information.
Information your church holds
Churches that use FaithForm may keep their own records about the people in their community — a member directory, household and children's check-in information entered by church staff, attendance, and giving records, for example. The church controls those records and decides how long to keep them. FaithForm stores and processes them on the church's behalf and doesn't use them for its own purposes. If you ask us about information a church holds, we'll refer you to that church or work with it to respond.
How long we keep information
- We keep your account information for as long as your account is open. When you delete your account, we delete it as described on our account deletion page.
- Location sent for a nearby search or an automatic check-in is not kept at all; only the check-in result described above is stored. The short record of an arrival waiting to be confirmed is deleted within about a day, or straight away if you turn automatic check-in off.
- Check-in and giving records are part of your church's records. They are kept for as long as the church needs them, including to meet its financial record-keeping obligations, and Stripe keeps payment records as the law requires.
- Technical logs are kept by our hosting providers for a limited period, and copies of deleted information can remain in encrypted backups until those backups expire.
Your choices and rights
- Location. Automatic check-in and nearby search are both optional. Turn automatic check-in off in the app, or change location permission in your device settings; you can still check in with your church's code or be marked present by staff.
- Camera. Deny camera access and type check-in codes instead.
- Notifications. Change them in the app or turn them off in your device settings.
- Your profile. Update your name and preferences in the app.
- Deleting your account. Delete it in the app, or follow the steps on our account deletion page.
Depending on where you live — for example, in the European Economic Area, the United Kingdom, or certain U.S. states such as California — you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict some uses of it, and not to be treated differently for exercising these rights. To make a request, email support@faithform.io from the email address on your account, so we can confirm the request is yours. We'll respond within the time the law requires. If you're in the EEA or UK, you can also complain to your local data protection authority.
Children
The apps are not directed to children under 13, and you must be at least 13 — or older where the law of your country requires — to create an account. If we learn that a child under 13 has created an account, we'll delete it. Information a church records about children in its care, such as children's check-in, is entered by church staff and held for the church, as described above.
Security
We protect information with encryption in transit, access controls that limit each account and each church to its own information, and secure storage for sign-in credentials on your device (the iPhone Keychain and Android's encrypted storage). No system is perfectly secure, so we can't guarantee that information will never be accessed without permission, but we work to prevent it and will notify you where the law requires.
Where information is processed
FaithForm and its service providers may process your information in the United States and in other countries, which may have different data protection laws than where you live. Where the law requires, we use appropriate safeguards for those transfers.
Changes to this policy
When we update this policy, we'll change the effective date at the top of this page. If a change is significant, the apps will ask you to review and accept the updated policy before you continue.
Contact us
Questions or requests about your privacy? Email support@faithform.io.