SHPRD Legal
Privacy Policy
Last updated: October 22, 2026
1. Scope and roles
SHPRD provides youth-ministry software for organizations, their adult administrators and leaders, and participating students. This policy covers SHPRD's website, iOS app, student experience, and related services, including information submitted through web pages displayed inside the iOS app's WebView.
For an organization's rosters, attendance, prayer requests, ministry notes, events, and similar records ("Organization Data"), the organization decides why the information is collected and how it is used. The organization is the data controller or business, and SHPRD acts as its processor or service provider. SHPRD is the controller or business for account administration, direct support, billing administration, service security, and our own legal obligations.
2. Information we collect
Depending on how SHPRD is used, we collect the following:
- Contact and account data: names, email addresses, phone numbers, avatars, organization and role, login credentials in protected form, and account status.
- Student and ministry data: student names, grade, date of birth where it is collected for age screening, phone number, recovery email, group assignments, attendance and check-ins, event signups, event payments, lesson views and ratings, follow-up status, engagement or care signals, and ministry notes.
- Sensitive and religious data: prayer requests, prayer activity, ministry participation, and content that may reveal religious or philosophical beliefs, health, wellbeing, family circumstances, or other sensitive matters. Please do not include sensitive details that are not needed for ministry care.
- User-generated content: prayer text, student and group notes, lesson content and questions, announcements, event and task descriptions, uploaded avatars and event photos, and support messages.
- Identifiers and device data: SHPRD, organization, account, student, session, Apple, and Google identifiers; IP address; browser and device information; cookies; Apple (APNs) or Firebase Cloud Messaging push tokens; app version and build; platform; and time zone.
- Parent and guardian data: a parent or guardian's name, email address, phone number, and relationship to a student; the consent and permission decisions they make, with dates; and the notification choices they set. A parent's phone number is also used to text a one-time code when they help their child get back into a locked-out student profile.
- Household and health information a parent chooses to provide: emergency contacts and people authorized to pick up a student (name, relationship, and phone number); allergies, medical conditions, and dietary restrictions; a physician's name and phone number; and medications, with dosage, instructions, and whether the student carries them. A parent enters this in the parent portal or on a permission form, and may leave any of it blank.
- Permission and registration forms: answers given on an event or annual permission form, the signature drawn or typed to complete it, the date, and any signed form or photo of one that is uploaded.
- Purchases and billing: plan, purchase history, Stripe customer and subscription identifiers, Apple transaction, product, and app-account identifiers, entitlement status, and organization event-payment records. SHPRD does not receive or store full payment-card numbers.
- Usage and diagnostics: app interactions, feature and lesson activity, request time and path, crash data, performance data, error details, device/operating-system details, security events, user agent, and recovery-attempt logs. We configure Sentry to omit default personal identifiers and redact common contact and authentication data, but diagnostic reports may still contain information connected to an account or device.
3. Where information comes from
We receive information directly from you; from a parent, guardian, organization administrator, or ministry leader; automatically from your browser, device, and use of SHPRD; and from authentication, billing, hosting, security, email, diagnostics, and app-platform providers. If an organization enters information about someone else, it is responsible for having authority to do so and for giving any notice or obtaining any consent required by law.
4. How we use information
- Provide accounts, student access, ministry workflows, and requested features.
- Manage rosters, attendance, events, lessons, tasks, prayer, and notifications.
- Give a student's ministry the emergency, health, and pickup details a parent provides, so its leaders can care for that student at gatherings and events.
- Obtain and record parental consent and permissions, and keep parents informed about their student's schedule, forms, and balances.
- Authenticate users, recover accounts, prevent abuse, and protect the service.
- Process subscriptions and maintain purchase and entitlement records.
- Operate, troubleshoot, measure, and improve reliability and performance.
- Provide support and send transactional or service communications.
- Comply with law, enforce agreements, and protect people, rights, and safety.
We do not sell personal information. We do not use personal information for cross-context behavioral advertising, and SHPRD does not display third-party advertising. We do not use prayer requests, household and health information, or other Sensitive Info for advertising, and household and health information is not sent to the SHPRD assistant's AI provider.
5. Organization records and individual rights
Individuals retain any ownership rights they have in content they create and do not give up privacy rights in their personal information. An organization controls its Organization Data as a ministry record, including the roster, attendance, event, payment, task, note, lesson, prayer, and care records its administrators and users maintain. SHPRD does not claim ownership of that content and processes it to provide the service.
Organization administrators determine who can access Organization Data and may correct, export, retain, or delete it. A student, parent, guardian, leader, or former member may ask the organization to exercise rights over organization-controlled records. If a request sent to SHPRD concerns those records, we may refer it to the organization and assist the organization in responding. We remain responsible for requests concerning SHPRD-controlled account, security, billing-administration, and support data.
6. Youth and parental consent
SHPRD's direct student experience is designed for students in grades 6–12. Organization administrator and leader accounts are intended for adults age 18 or older. A child under 13 may create or use a student profile or submit information directly through SHPRD only after a parent or legal guardian has given verified parental consent, as described under "Children under 13 (COPPA)" below.
A participating organization may maintain adult-entered ministry records about younger students. The organization is responsible for its relationship with families, determining the legal basis for that processing, giving required notices, and obtaining consent from a parent or guardian when required. For a student under the age of majority, the organization must also obtain parent or guardian permission for direct student use when required by law or the organization's policies.
If we learn that a child under 13 provided personal information directly without the required verified consent, we will disable the direct-use profile and delete the information or work with the parent, guardian, and organization to complete a legally valid consent process. Withdrawing consent may end the child's direct use of SHPRD, but an organization may retain a lawful ministry record as explained in Sections 5 and 8.
Children under 13 (COPPA)
Where the SHPRD student experience is made available to a child under 13, SHPRD acts as an "operator" under the U.S. Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and its rule, 16 CFR Part 312. Before that child uses the student experience, SHPRD gives the child's parent or legal guardian a direct notice of what we collect, how it is used, and that we will not collect, use, or disclose the child's personal information without the parent's consent, and we obtain verifiable parental consent — the parent completes a consent form in the SHPRD parent portal and SHPRD sends a confirmation email that also lets them withdraw consent, or a ministry leader who knows the family verifies the parent's signed form. SHPRD does not condition a child's participation on disclosing more personal information than is reasonably necessary for the activity.
A parent or legal guardian of a child under 13 may, at any time, review the personal information SHPRD has collected from the child, ask us to delete it or permanently de-identify it, and refuse to permit any further collection or use of it. A verified parent can exercise these rights in the SHPRD parent portal, under Data & Permissions, or by writing to coppa@shprd.life. We verify that the requester is the child's parent, then carry out the request, together with the child's ministry, within 30 days; for a review request we provide a copy of the child's information. Refusing further collection ends the child's use of the student experience. Ministry staff may keep the organization's own attendance and pastoral records unless the parent also asks the organization to stop, as explained in Sections 5 and 8.
Our COPPA Children's Privacy Notice sets out, for children under 13, exactly what SHPRD collects, how it is used and shared, how long it is kept, and how a parent exercises each of these rights.
7. When we disclose information
We disclose information only as needed:
- Within the participating organization, according to administrator and leader permissions. The household and health information a parent provides is visible to that organization's administrators and leaders, and to the student's linked parents and guardians.
- To the service providers listed below to operate SHPRD.
- To a billing provider or app platform when someone initiates or manages a purchase.
- When required by law or reasonably necessary to protect safety, security, rights, users, or the public.
- In a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice obligations.
- With the individual's or organization's direction or consent.
We require providers by contract or binding service terms to use information only for authorized services and to provide privacy and security protection consistent with this policy and applicable law. Some providers, such as Apple, Google, or Stripe, may also act as an independent controller for information they collect through their own account, app-store, or payment relationship; their privacy policies then apply to that processing.
8. Retention and deletion
We use the schedule below unless a shorter period is required by law or an organization's written agreement, or a longer period is necessary for a legal hold, dispute, safety matter, fraud prevention, or legal obligation.
| Category | Usual retention | After deletion |
|---|---|---|
| Account and profile | While the account is active. | Removed from active systems within 30 days; protected backups age out within 90 days. |
| Organization and ministry records | While the organization uses SHPRD and for up to 90 days after service termination, unless the organization deletes them sooner. | An individual's account deletion does not automatically delete the organization's lawful records. Attribution may be removed or changed to a former-user reference. |
| Under-13 records pending parental consent | When a child checks in and is identified as under 13, the check-in name, grade, and date of birth and a pending guardian record are kept only until consent resolves. If a parent does not give verifiable consent within 30 days of the check-in, or an organization administrator removes the record from the parent-consent queue sooner, the child's identifying details are cleared. A refusal is cleared within about 7 days. | A de-identified record that consent was sought, when, and the outcome is retained as the organization's compliance proof. The organization's attendance entry is scrubbed of the child's name, and anything the child entered in the student experience is deleted. |
| Parent-provided household and health information | Until a parent changes or clears it in the parent portal, or the student's profile is deleted. | Deleted with the student's profile, and when a student's record is de-identified after a parent's deletion request or an unanswered or refused consent request. Answers and signatures on a completed permission or registration form are part of the organization's event records and follow the organization-record schedule above. |
| Prayer requests and other content | Until deleted by an authorized user or administrator, or under the organization-record schedule above. | Personal prayer content tied only to a deleted login is deleted; organization-controlled or student-submitted records may survive until the organization deletes them or its retention period ends. |
| Push tokens and notification queue | Active tokens while notifications are enabled; inactive tokens and delivery records for up to 12 months. | Tokens tied to the deleted account or student profile are deleted; limited delivery logs may remain for the stated period. |
| Recovery and security records | One-time codes expire in 10 minutes and reset sessions in 15 minutes; related audit and abuse-prevention logs are kept up to 12 months. | Security logs may survive account deletion for the remainder of the period with access restricted. |
| Diagnostics | Up to 90 days. | Redacted crash and performance records may survive until they expire. |
| Purchases, billing, and legal records | Subscription operational records while active; transaction, tax, accounting, dispute, and fraud records for up to 7 years. | Required transaction and entitlement records survive account deletion for the applicable period. |
Deleting a leader or administrator account removes the login, profile, push token, and records that exist only for that account, but it does not dissolve the organization or erase its shared ministry records. Deleting a student profile removes the profile and most directly linked records. The organization's check-in records keep the student's name as its attendance record; the phone number and grade on them are cleared. A limited check-in, prayer, security, or de-identified ministry record may remain where the organization lawfully needs it; direct identifiers are removed when reasonably possible and not required for that purpose.
For a child under 13 whose parent has not given verifiable consent, SHPRD applies this de-identification automatically on the schedule in the table above (about 30 days after an unanswered check-in, about 7 days after a refusal) and immediately when an organization administrator removes the record from the parent-consent queue. A parent may ask for deletion at any time under Section 10 and the COPPA Children's Privacy Notice.
If an administrator account is tied to active Apple or Stripe billing, or if deletion would leave an organization without an administrator, SHPRD may require billing cancellation, billing transfer, or promotion of another administrator before account deletion is completed. Apple subscriptions can continue after SHPRD account deletion unless they are canceled through Apple.
9. Subprocessors
The current providers that may process personal information to operate SHPRD are listed below. Their own subprocessors may also process information under their published terms. Providers may process data in the United States and other countries where they or their subprocessors operate.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase, Inc. | Authentication, database, storage, and realtime services | Account, organization, student, ministry, content, and service data |
| Vercel Inc. | Application hosting, content delivery, serverless processing, and logs | Web requests, IP address, device/browser information, and app data in transit |
| Functional Software, Inc. (Sentry) | Crash reporting, performance monitoring, and diagnostics | Redacted error, performance, request-path, device, and runtime data |
| Apple Inc. (including APNs) | Sign in with Apple, App Store purchases, and push-notification delivery | Apple account identifier, purchase records, app/account token, push token, and notification payload |
| Google LLC | Google Sign-In, Google Play purchases, push delivery, and embedded Google Maps | Google account identifier and profile data you authorize; purchase token and subscription status; push, map, and web request data |
| Stripe, Inc. | Web subscription checkout, billing, fraud prevention, and customer portal | Billing contact, customer/subscription identifiers, purchase status, and payment data provided to Stripe |
| Cloudflare, Inc. | Turnstile bot detection and abuse prevention | IP address, browser/device signals, and challenge results |
| Plus Five Five, Inc. (Resend) | Account and student recovery email delivery | Email address, one-time recovery message, and delivery metadata |
| Twilio Inc. | Student recovery codes by text message | Phone number, one-time recovery code, and delivery metadata |
| OpenAI, L.L.C. (via the Vercel AI Gateway) | The SHPRD assistant for ministry administrators and leaders on the Gathered plan, and for parents in the parent portal. Students do not have access to the assistant. | A leader's question and, in the response context, roster and ministry-participation summaries; or a parent's question and a summary of what their own parent portal shows (their first name, their children, upcoming events, balances, the current lesson, and recent announcements). The personal information of a child under 13 is withheld; for a student 13 or older these summaries may include their name and attendance. Prayer and reflection text and household and health information are never sent. |
We may update this list when our service providers change. Material changes that create a new privacy risk will be reflected in this policy and, where required, communicated to participating organizations.
10. Privacy requests
You may request access, correction, deletion, a portable copy, restriction, or withdrawal of consent, and may appeal a denied request where applicable. Organization administrators can handle many roster and ministry-record requests directly. Account deletion is available in SHPRD account settings; see Delete Your SHPRD Account.
For help, email privacy@shprd.life with the subject "Privacy Request" and include your name, account email or phone, organization, relationship to the student or account, the request, and the state or country where you live. Do not email prayer details, recovery codes, passwords, or identity documents unless we ask through a secure method.
We verify identity and authority before disclosing or deleting information. A parent or guardian request requires reasonable verification of identity and the relationship to the child. We aim to acknowledge requests within 10 days and complete verified requests within 30 days, unless law allows more time. We do not discriminate against someone for exercising a privacy right.
Parents of a child under 13: you may review the personal information collected from your child, delete or permanently de-identify it, and refuse any further collection or use. Use the SHPRD parent portal under Data & Permissions, or email coppa@shprd.life. These rights and the process are described in full in Section 6 and our COPPA Children's Privacy Notice.
A step-by-step explanation is available on our Privacy Choices page.
11. Security and transfers
We use safeguards designed for the nature of the information, including encrypted transport, access controls, tenant and role restrictions, protected credentials, logging, and diagnostic redaction. No system can guarantee absolute security. If you believe information is at risk, contact us promptly.
SHPRD and its providers may process information outside your state, province, or country. Where required, we use contractual and other lawful transfer safeguards.
12. Changes and contact
We may update this policy as SHPRD changes. We will post the revised policy, update the date above, and provide additional notice when required. If a material change requires consent, we will obtain it before applying that change to information covered by the consent.
Questions, youth-privacy concerns, and privacy requests may be sent to privacy@shprd.life.