Privacy & your data
DRAFT — this policy is awaiting legal review and completion before launch.
The short version: we collect the minimum we need, we encrypt the sensitive parts, we never sell or share your data for marketing, we delete on a published schedule — and your rights are buttons, not request forms.
What we collect, and for how long
| Where | What we hold | Protection | Kept for |
|---|---|---|---|
| Declaration (petition) | Name, email, optional church, your public-listing choice | Double opt-in; only a hash of the confirmation link is stored | Until you remove it (see your rights below) |
| Get Help | Optional first name, a way to reach you, your message | Encrypted at rest; cannot be searched; no analytics on the page | Deleted automatically within 90 days |
| Prayer requests | Your request and optional first name | Encrypted at rest; public only after moderation and with consent | Deleted automatically within 180 days |
| Enquiries / contact | Name, email, message | Email and message encrypted at rest | Deleted automatically within 365 days |
| Materials requests | Name, email, delivery address, items | Address encrypted at rest | Address deleted 30 days after dispatch |
| Bible studies | Name, email, chosen series | Double opt-in | Until you remove it |
| Church register | Church name, town, website, contact email | Hand-verified; contact email never shown publicly | Until the church asks to be unlisted; one never verified is deleted after 90 days |
| Account (optional) | Email, display name, password hash, course progress, points, certificates, saved preferences | Password hashed (never stored); preferences encrypted; session is one essential cookie — nothing kept in your browser | Until you delete the account (one click, immediate) |
Signing the petition, registering for a study and creating an account are double opt-in: nothing counts until you confirm from your inbox. An enquiry, a materials request or a church registration is not confirmed that way: the address you give is used only to answer that message, request or registration. We set no advertising or tracking cookies. The Get Help page never carries analytics of any kind.
Your rights, self-service
You can ask for access, a copy of your data in a machine-readable format, correction, or deletion at any time via thecontact page — we respond within one month, normally much faster. (Self-service download and deletion buttons ship with member accounts.)
For anything the self-service tools do not cover — the encrypted stores above (Get Help, enquiries, prayer), a materials order's delivery address or its deletion, church register removal, or an email change — use thecontact page. We act on rights requests within one month as UK GDPR requires, normally much faster. The encrypted stores are deliberately unsearchable and delete themselves on the schedule above.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).