Privacy Policy

Light Ark Church (a California non-profit religious entity, "we" / "us") respects and protects your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use light-ark-church.com, our mobile app, desktop client, and related services ("the Service").

By continuing to use the Service you confirm you understand and accept this policy. If you disagree, please stop using the Service.

We collect only the information necessary to provide the Service:

· Account info: phone number, email (for login); name, nickname, address, family details you voluntarily share (for personalized pastoral care)

· Birth year and month: collected on first use (year + month only, no day), used solely for 18+ age verification and as consent-record evidence; deleted together with hard account deletion

· Conversation content: full transcripts with the AI (“Pastor Musk”) (used for memory recall + personalization)

· Interaction data: timestamps, city (via IP or your authorized GPS), device model, browser version

· Location: precise coordinates only when you explicitly grant GPS permission. Those coordinates are stored in our database alongside that message, and are also sent to a third party, OpenStreetMap / Nominatim, to obtain a city and country name (see Section 4). If you mention in conversation that you “got home” or are “at church”, we save the coordinates at that moment as a labelled location anchor (“home”, “office”, “church”, and so on). Without GPS permission, we infer only city-level location from your IP address

· Donation info: if you donate, Stripe handles payment processing (we never see card numbers / CVV)

We do NOT proactively request: national ID, SSN, bank card numbers, or medical records; and we never see your card number / CVV during donations (Stripe handles payment).

To be straight with you, though: the Vault feature lets you voluntarily store some of these (ID numbers, insurance numbers, health details) so forms can be auto-filled. Whether to store them is entirely your choice. Highly sensitive items (SSN, bank/card, ID documents) are never auto-filled — each use requires your explicit, per-field confirmation. Since encryption at rest is not yet enabled on our servers, we recommend you do not store or disclose such highly sensitive information.

· To provide AI pastoral care, cross-conversation memory, and life assistance features

· To personalize your conversation experience (based on your faith stage, topics of interest, life context)

· To detect and prevent abuse (e.g. bots, underage users, illegal content)

· With your explicit consent, send service notifications (no advertising)

We will NOT use your data to: serve ads, sell to third-party marketing companies, or train publicly released open-source models.

We use the following third-party processors (data flows are anonymized):

· OpenRouter (US) and its zero-data-retention inference providers: only when our own server is temporarily unavailable, that conversation turn (along with images you've sent recently, and which may include personal details you mentioned in the chat) is sent to them so the same open model (Google Gemma) can generate the reply; providers operate under zero data retention and do not store it or use it for training. In the iOS app, this requires your agreement first, which you can withdraw at any time.

· Anthropic (US): our team uses Claude internally as an engineering assistant (for example, when diagnosing a problem). Claude never answers your conversations; if we investigate an issue that involves your conversation, excerpts of it may be processed by Anthropic.

· vLLM local inference (our H200 server): default model Gemma-31B, no external transmission

· Stripe (US): donation payment processing; PCI-DSS compliant

· Cloudflare (US): DDoS protection + CDN; may briefly cache HTTP request metadata

· Whisper STT (our H200 server): speech-to-text, no external transmission

· Microsoft (US, Edge TTS): when the AI's reply is turned into speech, that text is sent to Microsoft; it does not include your real identity

· OpenStreetMap / Nominatim (OSM Foundation, Europe): once you grant GPS permission, we send your device's precise latitude and longitude to this service to get back a city and country name. The request is made directly by your browser / app and carries no account or name of yours, only our church's contact email (the service requires callers to be identifiable); as with any network request, however, the service can see your IP address. It is a free public endpoint and we call it anonymously

· Sentry (US): crash logs and performance diagnostics. What is sent includes the error stack, the page address where the error occurred, the app version, device and OS information, and a short trail of preceding actions (breadcrumbs); performance sampling is set to 20%. We have not added a custom scrubbing hook on top, so context present at the moment of a crash may be reported along with it

· Google (Firebase Cloud Messaging) and Apple (APNs): push notifications. The device push token is issued by Google on Android and by Apple on iOS, and the notifications we send reach your device through their servers

· Google Sign-In / Sign in with Apple: if you choose to sign in with them, we receive the identity claims they issue (email address, account identifier). In addition, when the Google sign-in button is enabled on our website's sign-in page, that page loads the button from Google, so Google can see your IP address and browser information when you open the page, even if you do not sign in with Google

· Twilio (US): used only when you sign in with, or add, a phone number. We send your phone number to Twilio so it can check that the number is valid and which country or region it belongs to, send a sign-in verification code to that number by text message, and check the code you enter. The code is generated and checked by Twilio; we do not store it. Twilio's privacy policy: https://www.twilio.com/en-us/legal/privacy

· Google (Gmail email delivery) (US): when you sign in with email, the verification-code email is sent from our church's Gmail account through Google's Gmail mail servers (smtp.gmail.com). Google therefore processes your email address and the message body (including the code, which is valid for 5 minutes); as is normal for Gmail, a copy of each sent message is kept in our Gmail account

· Brave Search (US): when you ask the AI to look something up online (including flights, shopping comparisons, and directions), our server sends search terms generated from your question (which may include your own words) to the Brave Search API and gets web results back. The request uses our API key and carries no account, name, or user identifier of ours

· ipinfo.io (US): when you have not granted GPS permission, or your GPS coordinates do not match a city we know, our server sends your IP address to ipinfo.io to get back a city-level location and time zone, so replies fit where you are (we cache the result for the same IP for 1 hour and do not resend it in that time). The request carries no account or name

· Open-Meteo (Europe) and the US National Weather Service (api.weather.gov, US government): when you ask about the weather, our server sends the place name you asked about to Open-Meteo to get its latitude and longitude, then sends those coordinates to the National Weather Service for the official forecast. What is sent is the place you asked about, not your device's GPS location; the requests carry no account or name

· Websites you ask it to open: when you ask the AI (“Pastor Musk”) to look something up or fill in a form on a web page, a browser on our server opens that website on your behalf and enters what the task needs into that site's pages: for example search terms, or details you have saved in your Vault (ordinary details such as name and address are filled in directly; highly sensitive items such as ID or bank card numbers are asked about one by one, every time). These sites are ones you name or that are visited because of your request, and each has its own privacy policy; the final submit or pay button is always pressed by you

· YouTube (Google, US): the sermon video page on our website and in the app plays our sermon videos through YouTube. Opening that page does not connect to YouTube; only after you press play does the page load the player from YouTube's privacy-enhanced domain (youtube-nocookie.com). At that point YouTube can see your IP address and browser information and may store its own data in your browser, handled under YouTube's / Google's own privacy policy. Choosing "Open on YouTube" takes you to the YouTube website or app

· Telegram (Russia/UK): used for internal founder alerts; if you talk with the AI (“Pastor Musk”) through our Telegram bot, your messages and the replies pass through Telegram's servers and are kept by Telegram under its own policy

We have signed Data Processing Agreements with the processors that offer them (Stripe, Cloudflare). For OpenRouter we have no separate data processing agreement; instead, every request is restricted to zero-data-retention providers, and the dedicated key is limited by model and data policy. Text-to-speech (Microsoft Edge TTS) and reverse geocoding (OpenStreetMap / Nominatim) are both anonymous calls to public endpoints for which we hold no separate data processing agreement — we are evaluating self-hosted replacements for both. IP-to-city lookup (ipinfo.io) and weather (Open-Meteo, the US National Weather Service) are likewise account-free calls to public endpoints, and we hold no separate data processing agreement for them either.

We use your conversation content to:

· Real-time response: recall historical memory and feed it as context to the AI model

· Personal profile: automatically extract facts ("works at Google") into your profile_facts table

We will NOT:

· Use your conversations to train publicly released AI models

· Sell or publish conversations that identify you

· Allow other users to see your conversations without notice

We do not currently use your conversations to train or fine-tune any AI model. If we ever decide to use de-identified conversations to improve the model, we will notify you in advance via in-app notice and provide an opt-out.

· Active accounts: all data retained for the duration of account activity

· Dormant accounts: 12 months without login → marked dormant, conversation history deleted after 2 years (account shell preserved)

· Closed accounts: when you actively close your account in settings → 30-day soft delete (you can recover within 30 days) → after 30 days your data is hard-deleted (apart from the narrow exceptions listed below)

· Legal hold: data involved in legal disputes retained as required by law

Exceptions to hard deletion, stated plainly:

· Donation transaction records: retained for 7 years for US tax compliance

· Crisis-intervention records: retained under legal hold; they are not removed by the hard delete

· Your account's primary record: not deleted but anonymized (identifying fields such as name, email, and phone number are overwritten) — this is what keeps the records above from losing their attribution.

To the extent permitted by applicable law, you have the right to:

· Access: view all your data via App settings at any time

· Export: download your complete data in JSON format via "Settings → My Data → Export"

· Delete: initiate 30-day soft delete via "Settings → Close Account"

· Correct: contact churchlightark@gmail.com to correct inaccurate personal info

· Withdraw consent: stop using the Service at any time

If you are a California resident, you have additional CCPA/CPRA rights. If you are an EEA/UK resident, you have additional GDPR rights.

The Service is provided only to adults aged 18 and above.

On first use we require your birth year and month (year + month only, no day) for age verification; if it shows you are under 18, you will be blocked from using the Service, and the block remains in effect on your device. The verification result and the copy version you saw are recorded in our consent ledger as evidence.

We do NOT knowingly collect personal information from users under 18. If we find an underage user, we will immediately:

· Permanently suspend the account

· Delete all collected related data

· Refunds for any donations are at our discretion

If you are a parent / guardian and discover your minor child has used the Service, please contact churchlightark@gmail.com and we will delete related data within 7 business days.

We use the following cookies / local storage:

· Necessary cookies: login state, CSRF tokens, device ID (cannot be disabled; the Service won't work without them)

· Preference cookies: UI language, theme selection

· NOT used: advertising cookies, third-party tracking cookies (exception: after you press play on the sermon video page, the YouTube player may store YouTube's own data in your browser — see Section 4)

You can clear cookies via browser settings, but this will log you out.

Website audience measurement (no cookies): To understand how many people visit, where they come from, and which pages they read, we run first-party analytics on our own servers. It uses no cookies, no localStorage, and writes or reads no identifier on your device, and it sends nothing to Google Analytics or any other third-party analytics service.

· Recorded: page path (without query string), the domain of the referring website, interface language, seconds spent on the page, whether the device is mobile, and marketing source parameters in the link (utm_*)

· Not recorded: your IP address, your full browser identification string, or the full URL

· Visitors are distinguished within a single day by an irreversible hash keyed with a secret that is replaced daily (computed transiently from IP and browser string, then discarded and never stored). Records cannot be linked across days and cannot be traced back to an individual.

· If your browser sends a DNT (Do Not Track) or GPC (Global Privacy Control) signal, we record nothing at all

Newsletter: You may choose to leave your email address in the site footer. We store only the email address, language preference, sign-up time, and referral source, and use it solely to send you our newsletter — for nothing else, never sold, never shared. You must be 18 or older and tick the consent box to subscribe. You can ask us at any time, via the Contact page, to remove you from the list.

The Church is registered in California, USA; our servers (H200) are located in the United States.

If you access the Service from outside the United States, your data will be transferred to and processed in the United States. Data in transit is protected by industry-standard transport encryption (HTTPS). Data is stored on servers we operate ourselves, isolated per account and access-restricted; encryption at rest is not currently enabled. We state this plainly rather than claim more protection than we have.

For material changes we will notify you via:

· In-app pop-up

· Email to registered address

· Prominent notice on our website

Continued use means you accept the updated policy. If you disagree, please close your account.

For questions about this Privacy Policy, contact:

📧 Email: churchlightark@gmail.com

🏢 Entity: Light Ark Church — California non-profit religious organization

We commit to responding to privacy inquiries within 1–2 business days.