Privacy Policy

1. Who this applies to

This Service is used in two ways:

• Team members — staff and volunteers at a church or organization (“Organization”) who are given accounts to review and manage assistance requests.
• Applicants — individuals who submit a request for assistance through an Organization’s public request form. Applicants do not create an account.

2. Information we collect

From team members: name, email address, phone number (optional), and a securely hashed password. We never store passwords in plain text.

From applicants (submitted through an Organization’s request form): name, address, phone number, email address, household information (number of adults/children, employment status), financial information relevant to the request (income, expenses, amount requested), a description of the need, and any supporting documents voluntarily uploaded (such as bills or notices). If someone submits a request on another person’s behalf, we also collect the submitter’s name and contact information.

3. How this information is used

Information is used solely to operate the Service for the Organization that collected it: to review and process assistance requests, communicate with applicants about their request status, allow the Organization’s team to coordinate internally, and (in anonymized or summarized form) to generate reports for the Organization’s own internal or board reporting.

4. Who can see this information

Each Organization’s data is isolated from every other Organization using the Service — team members at one church cannot see another church’s requests or team. Within an Organization, applicant information is visible only to that Organization’s signed-in team members.

5. Data storage and security

Data is stored in a managed PostgreSQL database and is not shared with, or accessible to, unrelated third parties. All traffic to the Service is encrypted (HTTPS). Passwords are hashed and never stored or transmitted in plain text. Login attempts are rate-limited, and administrator actions (such as removing a team member) are logged and reversible.

Uploaded documents are stored directly in our database and are only ever served back through an authenticated request — there is no public link to any uploaded file.

6. Third-party service providers

We rely on the following subprocessors to operate the Service:

• Vercel — application hosting and database infrastructure
• Resend — delivery of transactional email (request confirmations, status updates, password resets)

These providers process data only as necessary to provide their respective services.

7. Data retention and deletion

Information is retained for as long as the Organization maintains an active account, so the team can reference request history. An Organization’s owner can export a full copy of that Organization’s data at any time, and can request deletion of data by contacting us at [support email].

8. Your rights and choices

If you are an applicant and have questions about a request you submitted, or want your information corrected or removed, please contact the Organization you submitted the request to directly — they control that data and are best positioned to act on your request. If you are unable to reach the Organization, you may contact us at [support email] and we will assist as we’re able.

If you are a team member, you can update your own name, email, and password at any time from your profile page. An Organization’s owner or admin can deactivate a team member’s account, and account owners can export or delete Organization data as described above.

9. Children’s privacy

This Service is not directed to children, and we do not knowingly collect information from anyone submitting a request on their own behalf who is under the age of 18. Requests submitted on behalf of a minor by a parent, guardian, or other adult are permitted.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify Organization administrators.

11. Contact us

Questions about this Privacy Policy can be sent to [support email].