Privacy policy

Ministry release policy — effective upon the configured ministry service launch. This explains the implemented ministry data flows and must be reviewed by the ministry operator before launch.

Information we collect

Accounts use an email address, a password handled by Supabase Auth and an optional first name. Prayer requests include the request, chosen privacy/category, status and follow-up preference. Guest names are optional. We retain an email with a prayer only when follow-up is requested. Testimonies include content, display preference and publication consent.

Why and who can access it

Data supports accounts, prayer, follow-up and testimony review. Users see their own records. Authorized prayer staff see unassigned team requests or requests assigned to them. Pastor-only requests are restricted to authorized pastoral staff and administrators. Administrators manage assignments, access and publication. Internal team notes are not shown to users or the public. No personally identifying data is shown in ministry statistic summaries.

Publication and AI

Prayer requests are never automatically public or used as AI training data. Private requests are not submitted to the BibleVerity research AI. Only consented, administrator-reviewed testimonies are published, with your selected name. Reviewers must remove private contact details from testimony prose before approval. We do not sell prayer content.

Protection and providers

Vercel hosts the website/API; Supabase provides authentication and ministry storage. Access controls, encrypted secure session cookies, validation, rate limits and administrative audit records protect the ministry service. Existing guest AI uses a separate Worker/D1 backend with expiring research sessions. Hosting/auth providers may process technical logs; avoid unnecessary personal details in requests.

Choices, withdrawal and deletion

Withdraw testimony consent in My Testimonies to remove it from the public feed immediately. Request account/data deletion in My Profile; only administrators can review that request. An administrator will verify the request and review retention needs before removal. Guest users can submit a private follow-up prayer titled “Privacy request” with their contact address and details sufficient to locate their submission; do not include passwords.

Retention schedules, backup deletion periods, ministry operator contact details and regional rights procedures require operator confirmation before production release. Security/audit records and backups may require limited retention. Do not interpret this policy as a promise of immediate backup deletion.