Privacy Policy

This is an English translation of the ChurchLog Privacy Policy. If it differs from the Korean original, the Korean original prevails.

Under Article 58(4) of the Korean Personal Information Protection Act, this service processes the minimum personal information needed to run a church, on behalf of the religious organization (church) that entrusts it.
The information collected belongs to the church each user belongs to.

1. Personal information we collect
[Required]
• Name, mobile phone number
• (Collected automatically) Device token for push notifications (FCM/APNs), device identification token for automatic attendance
[Optional — church membership records]
• Date of birth (solar/lunar), gender, address, family relationships, church office, profile photo
• Faith information such as dates of baptism, catechism, confirmation and infant baptism
[Family members outside the church] When the church records a family member who is not a member in a household (family card)
• That family member's name, gender, year of birth, relationship to the head of household, faith (the name of their church if they attend another one) and a memo — no phone number or address is collected, and this information is not used by other features such as the member list, attendance or text messages
[Religious activity information]
• Worship attendance records, offering records (amount, offering type, date), prayer requests, pastoral visit records, devotion (QT) records
• Posts, comments and photos written on a department's open board (if your department has turned the board on)
• Church messages (received news): the record that you received news sent by the church, a department, a district or a small group, when you opened it, and comments you wrote on it
• Reactions (🙏·❤️·👍) left on announcements and received news
[Location information] Processed only if you turn on automatic attendance (Section 4 below).
[Church text messages] Processed only if your church has connected a text-message service account
• Recipients of texts sent by the church (name, mobile phone number), message content (including photos), delivery results, and a mark that the recipient opted out of texts
[One-time, not stored]
• SMS verification code: discarded right after verification
• Verification of US and Canadian mobile numbers: the verification text is sent by Google (Firebase Authentication), and your mobile number, the IP address you connect from, and app/device check information (anti-abuse checks and app integrity checks; on the web, browser information checked by reCAPTCHA) are passed to Google. We delete the verification record created on Google's side immediately when verification ends (whether it succeeds or fails), and records left by an interrupted attempt, such as closing the app, within 1 hour (Sections 10 and 11 below)
• Human check: only when many verification texts, logins or join requests arrive at once from the same internet address (such as a church's Wi-Fi), Cloudflare (Turnstile) checks once that you are a person, using the IP address you connect from and browser/device check information (anti-abuse checks). ChurchLog receives only the result (passed or not) to make a pass that is used for 10 minutes, and does not store the check information (Sections 10 and 11 below)
[Overseas address search] Processed only when an admin of a US or Canadian church presses [주소 찾기] (Search address) in an address field
• The address text typed into the address field (it may be the address of the church, a member or a household) — no other information such as names or contact details is sent, and the search text is not kept in the ChurchLog server's access logs either (Sections 10 and 11 below)
[Admin app unlock — only if registered] Processed only if you register a way to unlock the automatically locked admin app screen without SMS verification (Section 13 below)
• Passkey: the passkey's public key and identifier, the name of the registered device (a name made from browser information, e.g. "Mac · Safari"), whether the passkey syncs with other devices, and when it was registered and last used
• PIN: an irreversibly transformed value (hash) and the number of wrong attempts — the number you enter is not stored
• Biometric information such as fingerprints and faces is checked only on your device and is never sent to or stored by the service
[Optional — donation receipts]
• Resident registration number and address: processed only if you request a donation receipt or choose to save them for the next receipt (Section 6 below)
[Collected automatically — app error and performance records] Processed only in the mobile apps (Section 11 below)
• Error records when the app crashes or hits an error (the code location of the error, app version, device model, operating system version)
• Time taken to start the app, display screens and make server requests, the server request addresses (which may include member or post numbers), and the connection type (Wi-Fi or mobile data), carrier and country at that time
• An identifier created for each app installation — it does not include names, contact details or content you wrote
[Error reports and inquiries to ChurchLog] Processed only when you report an error in the app or contact the service operator (ChurchLog)
• What you type, and screenshots you attach
• (Collected automatically) App type and version, device model and operating system version (browser information on the web), app screen width and text size setting, and the names of recently viewed app screens — shown to you on screen before sending
• Files attached to a move request — only when a church hands over data to move from another program: what the files contain (the church's member list, contact details, offerings, ledger and so on), file names and sizes, and the admin who uploaded them
[Inquiries and applications — non-members]
• Information received through service applications and adoption inquiries, and deposit information for individual donations, is processed separately from member information (Section 8 below)

2. Purposes of use
• Sign-up and identity verification (SMS verification — for US and Canadian numbers, texts are sent through Google Firebase Authentication)
• Overseas address search: to help US and Canadian churches enter addresses accurately, we search for address candidates using the address text you type
• Admin app unlock: after verifying you with a registered passkey or PIN, we reopen the admin app screen that locked after a period of inactivity
• Announcements, schedules and service notifications
• Church text messages: if your church has connected a text-message service account it signed up for directly, church admins send church notices about worship, events, gatherings and so on by text. If you no longer want to receive texts, tell your church — once an admin marks you as opted out, you are left out of later sends.
• Church operations such as attendance, small groups/departments, offerings, reservations, pastoral visits and prayer requests
• Church messages: news sent by admins of the church, a department, a district or a small group, and by small-group leaders, is delivered as an app notification. For news the church chooses to also send by text, a church text is sent to people who cannot receive app notifications (for example, people who don't use the app or who turned off "Church messages" notifications in the app) and to people who received the app notification but did not open it within the set time. When we cannot tell whether an app notification arrived, such as during a temporary outage of the notification service, we may not send a text instead. For this we record when news was opened, and the sender and admins within that scope can see who received it and who opened it.
• Preventing misuse of the service and operating it safely
• Improving app stability and speed: we use app error and performance records to fix errors and find slow spots
• Handling error reports and inquiries to ChurchLog: error reports that members send to their church are reviewed by the church's top admin, who may forward them to the service operator (ChurchLog). In that case the report and the device information the app attached are passed on, but the member's name and contact details are not. Inquiries sent to ChurchLog from a church's admin app are reviewed and answered directly by the service operator. The operator's reply goes to the church admin, and the church decides what to tell members.
• Moving from another program (move request): when a church's top admin attaches files to a move request, the service operator views those files and the church's records, arranges them in ChurchLog's format, loads them into a test copy to match the totals, and returns the cleaned files to the church. The church admin reviews them and does the actual registration. The files are not kept at any address anyone can open; they are kept only in the database, and only admins who can see that church's inquiries and the service operator can download them. They are not used for anything other than the move.
• Managing and viewing member information for church operations: admins of your church (senior pastor, department and small-group leaders and others with permissions) can view and manage members' registered information (name, contact details, affiliation, attendance, membership records, etc.) within the scope of the permissions they were given.
• Improving the admin app's AI assistant: questions typed into the AI assistant in a church's admin app are stored on the server up to the first 300 characters and, together with which answer the assistant chose and whether it helped, are reviewed by the service operator (ChurchLog) to improve the assistant. If a question contains a member's name or similar, it is stored as typed. Stored questions are deleted automatically after 90 days and are not used for any other purpose.
• Coordinating facility reservations: a member designated by the church as the person in charge of a reservable resource (space, vehicle, equipment) may check the names and contact details of applicants and use them to coordinate reservations (by phone or text), limited to reservations for that resource that are pending approval or confirmed and have not yet ended. The person in charge may be a member who is not an admin.

3. Who can see religious activity information
• Prayer requests, pastoral visit records and similar items can be sensitive faith information, and are visible only according to the visibility the author chose (small group / department / leaders only) and to people with the matching permissions.
• Prayer requests can be posted anonymously.
• Posts, comments and photos on a department's open board are visible, with the author's name, to members of the same department and to church admins (the top admin and that department's department admins). They are not visible to members of other departments or outside the church.
• Reactions left on announcements and received news are visible, with the person's name, to the members and admins who can receive that post. People who did not react are not shown anywhere. Likes on announcements from before the reaction feature are shown to members only as a count without names, and, as before, the names of the people who liked are shown to department admins and above who manage announcements.
• Comments on received news are visible, with the author's name, to the members who received that news, the sender and admins within that scope. The sender and the top admin can hide comments.
• Offering records can be viewed only by the member and by admins with the relevant permission.

4. Location information (automatic attendance)
• Only if you turn on "automatic attendance", we use your device's location to detect when you enter the church area. Accurate detection needs the "Allow all the time" (background) location permission.
• Location coordinates (latitude and longitude) are never sent to or stored on the server; they are used only on your device to judge the distance to the church (geofencing).
• So that the church can help when automatic attendance doesn't work well, we process the automatic attendance setup status (whether location permission, battery settings and automatic removal of app permissions are set up, whether notifications are allowed, phone type (Android or iPhone), and why the setup stopped) and whether automatic attendance worked on days you attended in person. Location coordinates are not included.
• Turning off automatic attendance stops location use immediately, and you can change the permission in your device settings at any time.

5. Sharing information within a household (separate consent)
• Through the "family card" feature, your information may be shown to members of the same household, but only if you consent yourself.
• Until you set this up, the family screen shows only your name and relationship; phone, address, birthday and so on are not shown.
• You can withdraw consent at any time, and when you do, that information is hidden from the family screen immediately.

6. Donation receipts and resident registration numbers
• Resident registration numbers are processed only to issue donation receipts and are not collected or used for any other purpose. Receipts follow Form 45-2 of the Enforcement Rule of the Korean Income Tax Act.
• There are two ways to handle it, and the member chooses.
  ① Issue now (not stored): under Article 113(1) and Article 208-3 (issuing donation receipts and preparing and keeping donor-by-donor issuance records) of the Enforcement Decree of the Korean Income Tax Act, the number is entered when you request a receipt, used only to create the receipt (PDF), and discarded immediately. It is not stored on the server or written to logs.
  ② Save: kept only if the member chooses "Save for the next receipt", and used to prepare the data the church needs to issue electronic donation receipts through the Korean National Tax Service's Hometax.
• Saved resident registration numbers are stored encrypted, and only the first 6 digits are shown on screen. They are decrypted only when issuing the member's own receipt and when creating data for submission to the National Tax Service, and a record is kept in the access log when a church staff member creates submission data.
• Saved resident registration numbers are not shown on admin screens, and there is no feature for admins to save or look up a number on a member's behalf. However, when the church's donation-receipt staff creates the Hometax bulk-issuance file for electronic donation receipts, the numbers are included in that file so it can be uploaded to the National Tax Service, and the file is passed to that staff member. The church must delete the file without delay after uploading it to Hometax.
• Members can delete a saved resident registration number in the app at any time, and it is destroyed without delay when deletion is requested. It is also destroyed when you delete your account.
• Choosing not to save does not limit receipt issuance. You can get a receipt with option ①, or use the "donor request" feature on the National Tax Service's Hometax.

7. Advertising
• The ChurchLog app does not show third-party ads (such as Google AdMob) or sponsored ads, and does not collect your device's advertising identifier (Android advertising ID, iOS advertising identifier).
• "Ads" in the app are church news (events, announcements and so on) that your church posts directly for its members, and they are processed like the church's other posts.
• Member information such as names and contact details, and church operation information such as attendance, offerings, prayer requests and pastoral visit records, are never used or provided for advertising.

8. Service applications, inquiries and individual donations (information of non-members)
This is information received through service applications and adoption inquiries on the service introduction pages, and the deposit information of donations individuals send to the donation account. This information is not church operation information processed on behalf of a religious organization; it is processed directly by the service operator and is not used to create member accounts or for church operation features.
[Service application]
• Items collected: church name and address, senior pastor's name, applicant's name and mobile phone number, and what you type
• Purposes: verifying the applicant (SMS verification), reviewing the application, and notifying approval or rejection (SMS — sent only to Korean mobile numbers)
• Retention: until the purpose of handling the application is achieved
[Adoption inquiry]
• Items collected: church name (optional), name, contact details, email (optional), and what you type
• Purposes: reviewing the inquiry, consulting and replying, and later re-contacting you about adopting the service
• Retention: 1 year from receipt
[Individual donations]
• Items processed: the depositor name shown on the donation account's bank statement, the amount and date of the deposit, and, if you ask for a cash receipt, the number used to issue it (such as a mobile phone number)
• Purposes: confirming and settling donations, and issuing a cash receipt when asked
• Retention: 5 years from the day after the statutory filing deadline for the tax period the transaction belongs to (Article 85-3 of the Korean Framework Act on National Taxes — keeping books and evidence)
• We confirm donations from deposits into the donation account, without a separate form. We receive a number for issuing a cash receipt only if the donor sends it to the contact in Section 15.
[Common]
• Even before these periods end, we destroy the information without delay if you ask us to delete it (contact in Section 15).
• You can refuse re-contact at any time, and we stop immediately if you do. If we send commercial advertising information by text or email, we obtain separate consent to receive it.
• You may refuse consent, but if you do not agree to the required items, your application or inquiry cannot be accepted.
• We use processors to the extent needed to handle submissions — sending result texts and sending submission notifications to the operator. Submission notifications may include the church name and the name of the person who applied or asked (Sections 10 and 11).

9. Retention period
• We keep and use personal information to provide the service continuously to the religious organization.
• When a member asks to delete their account, we delete their information without delay, except information that laws require us to keep.
• Records such as offerings and donation receipt issuance history may be kept for the periods set by the relevant laws.
• Saved resident registration numbers: destroyed immediately on request, and destroyed automatically if not used to issue a receipt for 3 years.
• Information received through service applications and adoption inquiries, and deposit information for individual donations: the periods set in Section 8
• Inquiries to ChurchLog (including forwarded error reports) and attached screenshots: 1 year from the last message
• Files attached to a move request: deleted automatically 30 days after the request is closed, or 90 days after upload even if the request is still open (the church admin can also delete them earlier). Copies the service operator downloads to do the work are deleted when the move is finished. They are removed from database backups within 14 days.
• Posts, comments and photos on a department's open board: kept until the author or an admin deletes them, and deleted together when the author deletes their account.
• Received news and when it was opened, reactions to announcements and received news, and comments: kept while the church uses the service; when a member deletes their account, that member's receipt records, reactions and comments are deleted together. Comments can be deleted by the author or an admin.
• Passkeys and PINs for unlocking: until the member deletes or turns them off (admin app 마이 › 잠금 풀기 방법 (My › Ways to unlock)), and destroyed together when the member deletes their account
• Dormancy of churches not in use: if a church has no admin sign-ins, member app use or new records for 6 months, we notify the church's top admin by text (Korean mobile numbers) and by admin app notification 30 days in advance, then switch the church to dormant and notify them once more when it becomes dormant. Texts are not sent to overseas numbers, so we notify those admins by admin app notification only, sent between 9 AM and 9 PM in the church's time zone. Information is not deleted when a church becomes dormant, and dormancy ends as soon as an admin signs in to the admin app once. If neither a text nor an admin app notification reaches the church (no Korean mobile number and no device using the admin app), we do not treat it as notified, so we do not send the dormancy and deletion notices below and do not delete the church automatically.
• Deleting dormant churches: we delete only after the operator gives notice of deletion. We notify the top admin by text and admin app notification 30 days and 7 days before deletion, and the deletion is cancelled if an admin signs in during that time. After the notice period, the church's member information and records (attendance, offerings, ledger, photos, attachments, etc.) are deleted permanently and cannot be restored. However, records of the church's payments to ChurchLog for storage and donations (church name, amount and payment date) are books and evidence, so we keep them for 5 years from the day after the statutory filing deadline for the tax period the transaction belongs to (Article 85-3 of the Korean Framework Act on National Taxes).
• A church that is more than 3 months old and has never had any members other than admins or any records is deleted automatically after the top admin is notified by text and admin app notification 14 days in advance.
• Offering, donation receipt and ledger records may need to be kept by the church under the relevant laws (such as the Korean Income Tax Act and the Inheritance and Gift Tax Act). If you receive a deletion notice, please download the data you need from the admin app.
• Deleted information is also removed from the service's backups within 14 days.
• Questions typed into the admin app's AI assistant: 90 days from when they were stored
• How to delete or close your account: "Delete account" in the app, or ask through the contact below

10. Provision to third parties and processors
• As a rule, we do not provide personal information to third parties.
• To operate the service, we entrust the following processing work to processors.
  - Aligo (주식회사 알리는사람들): sending SMS verification codes and notification texts (Korean mobile numbers) — mobile number, message content
  - Aligo (주식회사 알리는사람들) — accounts that churches signed up for directly and connected: sending church notice texts — recipients' mobile numbers, message content (including photos). If a name is included in the text, the name is passed along too.
  - Google LLC (Firebase Cloud Messaging): sending push notifications — device token, notification title and content (on iOS, delivered via Apple APNs)
  - Google LLC (Firebase Crashlytics, Performance Monitoring): analyzing app error and performance records — the app error and performance records in Section 1
  - Cloudflare, Inc.: storing images, attachments and database backups (Cloudflare R2) and providing the network path to the service — uploaded photos and files, encrypted database backups, access traffic
  - Cloudflare, Inc. (Turnstile): anti-abuse checks (human check) — IP address, browser/device check information
  - Google LLC (Firebase Authentication): sending and checking verification texts for US and Canadian mobile numbers — mobile number, IP address, app/device check information (browser information from reCAPTCHA on the web)
  - KEPTAGO LTD (Geoapify): address search for US and Canadian churches — the address text typed into the address field
• When entrusting, our contracts set out what is needed to keep personal information safe, and if processors or the work entrusted change, we disclose it through this policy.
• Processors do not process personal information for any purpose other than the work above.

11. Transfer of personal information outside Korea
To operate the service, personal information is transferred outside Korea as follows. Only the minimum needed for each task is transferred.

[Google LLC]
• Items transferred: device tokens for push notifications, notification titles and content (submission notifications sent to the operator may include the business or church name and the contact person's name, and inquiry notifications to ChurchLog may include the church name and the first line of the inquiry)
• Country: United States
• When and how: sent over the network when a notification is sent
• Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / [email protected])
• Purpose: delivering push notifications (Firebase Cloud Messaging). On iOS, delivered via Apple APNs.
• Retention: until the purpose of delivering the notification is achieved

[Cloudflare, Inc.]
• Items transferred: photos and attachments uploaded by members, access traffic to the service, encrypted database backups (all member information and church records — encrypted with a key only ChurchLog holds before being sent), the IP address and browser/device check information used for the human check (Turnstile, anti-abuse checks)
• Country: United States
• When and how: sent over the network when files are uploaded and when the service is accessed, when database backups are made (daily and continuously), and when a human check runs because many sign-up or login requests arrive at once
• Recipient: Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA / [email protected])
• Purpose: storing images and attachments (Cloudflare R2), keeping database backups in case of failure, providing the network path to the service, anti-abuse checks (human check, Turnstile)
• Retention: until the member deletes the file or their account. Database backups are deleted within 14 days of being made. Human check information is handled under Cloudflare's Turnstile processing terms.

[Google LLC — app error and performance records]
• Items transferred: the app error and performance records in Section 1 (error records; time taken to start the app, display screens and make server requests, and server request addresses; device model, operating system and app version; connection type, carrier and country; app installation identifier)
• Country: United States
• When and how: sent over the network from time to time while the app is in use (crash records at the next launch)
• Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / [email protected])
• Purpose: analyzing app errors and improving speed (Firebase Crashlytics, Performance Monitoring)
• Retention: according to Google's Firebase data processing terms (https://firebase.google.com/support/privacy)

[Google LLC — US and Canadian number verification]
• Items transferred: US and Canadian mobile numbers, IP address, app/device check information (anti-abuse checks and app integrity checks; on the web, browser information checked by reCAPTCHA)
• Country: United States
• When and how: sent over the network when a verification text is requested and the code is checked for a US or Canadian number
• Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / [email protected])
• Purpose: sending verification texts and verifying identity (Firebase Authentication)
• Retention: ChurchLog deletes the verification record on Google's side immediately when verification ends (whether it succeeds or fails), and records from interrupted attempts within 1 hour. Text delivery records, reCAPTCHA information and similar are kept according to Google's terms (https://firebase.google.com/support/privacy · https://policies.google.com/privacy).

[KEPTAGO LTD (Geoapify) — overseas address search]
• Items transferred: the address text typed into the address field
• Country: European Union (Geoapify's EU data centers; the company is based in Cyprus)
• When and how: sent over the network by the ChurchLog server when an admin presses [주소 찾기] (Search address)
• Recipient: KEPTAGO LTD (N. Nikolaidi & T. Kolokotroni, Onisiforou Center 2nd Floor, 8011 Paphos, Cyprus / [email protected])
• Purpose: searching for address candidates (Geoapify)
• Retention: according to Geoapify's privacy policy (https://www.geoapify.com/privacy-policy/), which states that request content is generally deleted within 24 hours.

• How to refuse the transfer and its effect: push notifications stop being transferred if you turn them off in the app or device notification settings, in which case you will not receive notifications for announcements, schedules and so on. Photos and attachments are not transferred if you don't upload them, in which case you cannot use related features such as profile photos and photo attachments. Overseas address search is not transferred if you type the address yourself without pressing [주소 찾기] (Search address). Verification of US and Canadian numbers is needed to sign up and sign in, so if you refuse it you cannot sign up or sign in with that number. The network path to the service and app error and performance records are essential to operating the service, so you can refuse them only by stopping use of the service (deleting your account).
• Aligo (주식회사 알리는사람들), which sends SMS on our behalf, is a Korean business, so this is not a transfer outside Korea.

12. Your rights
• You may request access to, correction or deletion of, or suspension of processing of your personal information.
• Children under 14 (under 13 for US and Canadian churches and for US and Canadian phone numbers) cannot sign up directly in the app. Please ask your church to register them, or a guardian must fill out the registration card provided by the church and consent on their behalf.

13. Security measures
• We encrypt data in transit and keep access permissions to a minimum.
• Unique identifiers such as resident registration numbers are encrypted when stored, decryption is limited to issuing receipts and creating data for submission to the National Tax Service, and a record is kept in the access log when a church staff member creates submission data.
• The admin app locks its screen automatically after a period of inactivity. Unlock PINs are kept only as irreversible hashes and are blocked after 5 wrong attempts, and only the public key of a passkey is kept (the private key used for signing is never sent to ChurchLog; it is kept by the device or the passkey provider (e.g. iCloud Keychain), and a syncing passkey is encrypted by the provider and synced between the member's devices). Unlock methods can be newly registered or changed only right after signing in by text.

14. Changes to this policy
• This policy may be revised as laws or the service change, and changes are announced through the app or the privacy policy page.

15. Contact
• Email: [email protected]

16. Users of US and Canadian churches, and users living in the United States or Canada
For users (church members and admins) of US and Canadian churches, the following applies in addition to the above. Users who live in the United States or Canada but belong to a Korean church can also use the responsible person, access and correction requests, breach notification and complaints below in the same way.
• Person responsible for personal information: the ChurchLog operator (representative) is responsible for processing personal information. Please send questions, requests for access, correction or deletion, and complaints to the email in Section 15.
• Where information is processed: member information is stored on servers in the Republic of Korea (encrypted backups at Cloudflare in the United States for 14 days), and may also be processed in the United States (Google, Cloudflare) and the European Union (Geoapify) through the processors in Sections 10 and 11. Courts, law enforcement and national security authorities of the country where information is located may access it under that country's laws. Processors handle information under their own data processing terms and the laws of their region (such as the EU GDPR), and ChurchLog does not let them use it outside the work in Section 10.
• The church and ChurchLog: member information is entered and managed by your church, and ChurchLog processes it on the church's behalf. You can ask your church or contact us (Section 15) for access or correction, and ChurchLog will reply within 30 days of receiving your request.
• Faith information: because this is a service for churches, member information shows which church you attend and your church life (attendance, offerings, prayer requests, etc.), and we treat it as sensitive information. It is used only for church operations under the consent you give when signing up, and is never used for advertising or other purposes or sold. To withdraw consent, delete your account.
• Children under 13: as in Section 12, they cannot sign up directly in the app. ChurchLog does not knowingly collect information from children under 13 without parental consent, and deletes such information when we learn it was provided. Information about children under 13 registered by a church is entered and managed by the church with a parent or guardian's consent.
• Data breaches: if a breach occurs that poses a risk of serious harm to members, we notify the regulator and the affected members without delay under the relevant laws (such as Canada's PIPEDA), and we keep a record of every breach.
• Complaints: if you are not satisfied with ChurchLog's reply, you may complain to the regulator where you live, such as the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca).
• California users: what we collect and who we share it with or entrust it to are in Sections 1, 10 and 11, and how to request access or correction is above and in Section 12. When we change this policy, we announce it through the app or this page as in Section 14 and update the effective date. ChurchLog does not track users across different websites, and does not change how it works in response to a browser's Do Not Track signal. However, Google may collect records of app use over time through the app's error and performance records (Firebase) (Section 11).

Effective date: October 31, 2026