Privacy policy

• Your account: the email address you sign up with, and a password stored only as a salted scrypt hash, never in readable form. An organisation name is optional.
• What you add: sermon recordings you upload, links you paste (for example YouTube videos), and a linked YouTube channel's public video list.
• What we make from it: audio working copies, transcripts, summaries and study materials, captions, clips and podcast audio.
• Connections you choose: if you connect Google Drive we store an access token, encrypted at rest (AES-256-GCM), limited to files ChurchPod itself creates in your Drive (Google's drive.file permission). Facebook and Instagram are described below.
• Your congregation email list: if your church uses ChurchPod email, we hold the names and email addresses your church imports or that people submit on your sign-up page, each person's subscription status, and delivery records for each email (delivered, opened, clicked, bounced, unsubscribed). Your church controls this list; we use it only to send the emails your church chooses to send. Every email carries an unsubscribe link.
• Images you create: the text and any photos you add when designing a social post, and the images made from them.
• Operational records: sign-in sessions, usage counts (for example minutes of audio transcribed), and short-lived security records used to rate-limit sign-in attempts. Our web server logs IP address, page requested and browser type. Sign-in links are removed from those logs.

We use only the cookies needed to keep you signed in and to protect sign-in links. There are no analytics, advertising or tracking cookies.

We use these providers to run ChurchPod. Each receives only what its job needs:

• DigitalOcean hosts the app, database and file storage (United States).
• Deepgram turns sermon audio into a transcript.
• Anthropic writes summaries, study materials, social posts and clip suggestions from the transcript.
• ElevenLabs and Google (Gemini) generate spoken podcast intros and outros when you use that feature. Google (Gemini) also designs social post images from the text and photos you provide.
• Resend delivers our emails, such as sign-in links, and the congregation emails your church sends; it reports deliveries, opens, clicks, bounces and spam complaints back to us.
• Your church's own texting provider (for example Telnyx), which your church chooses and pays for, receives the texts your church sends and the replies people send back, when your church uses texting.
• Google (Drive and YouTube), only when you connect Drive or link a YouTube video or channel.
• Meta Platforms (Facebook and Instagram), only when you connect your church's Facebook Page.
• Stripe will process payments when paid plans launch. We never see or store full card numbers.

If you connect your church's Facebook Page, we store the Page's access token (encrypted at rest, AES-256-GCM), the Page name and ID, and the linked Instagram account's username and ID. We use them only to publish the images you choose when you press Post or Schedule. We never post on our own, and we don't read your messages, followers or personal profile.

To publish to Instagram, we give Instagram a temporary private link to the image, which stops working within a day. Disconnecting Facebook in Social deletes the stored token and cancels any scheduled posts. You can also remove ChurchPod in Facebook under Settings → Business Integrations. See how to delete your data.

If your church uses ChurchPod to text its congregation, we store each person's phone number, their name if given, a record of their consent (the wording they agreed to and when, or the church's written-permission attestation) and the time they opted out. For consent given on a church's sign-up page we keep only a one-way hash of the device's network address. We do not store the text of messages people send in reply.

Texts go through the texting-provider account your church connects (for example Telnyx); your church holds that account, pays the provider directly and registers its own number with the carriers. We store your church's provider API key encrypted, only to receive replies and, once sending is switched on, to send your texts. People can reply STOP at any time to stop texts and HELP for help; we honour a STOP immediately. Consent to receive texts is not a condition of anything, and message and data rates may apply. We never sell or share phone numbers, and each church can see and export only its own list.

Nothing is public unless you share it. When you share a clip or study pack, anyone with that link can see it. Those pages ask search engines not to index them, and you can turn a link off at any time. A published podcast feed is public by design, because podcast apps have to be able to read it.

• Original sermon videos and their video previews are deleted automatically 30 days after they are processed.
• Audio working copies, transcripts, generated text, clips and podcast episodes stay until you delete them or close your account. You can delete clips in the app. To delete a sermon or your whole account, email us.
• Sign-in security records are deleted within hours. Sessions end when they expire or you sign out.
• Database backups are kept for 30 days, then deleted.
• After an account is closed we delete its content within [NUMBER] days, except where the law requires us to keep something.

All traffic is encrypted in transit. Stored files are private and only reachable through short-lived signed links. Passwords are hashed, connection tokens are encrypted, and each church's data is kept separate from every other church's. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

You can ask us for a copy of your data, to correct it, or to delete it, by emailing admin@churchpod.co. Depending on where you live you may have further rights under local law, and we will honour them.

ChurchPod is a tool for organisations and is not directed at children under 13. Please don't create an account for a child.

If we change this policy in a way that matters, we will email the account address before the change takes effect. Questions: admin@churchpod.co, [POSTAL ADDRESS].