1. Who this policy covers
GPChurch provides church management tools on its website and participating churches' GPChurch addresses. This policy covers information handled through those services. Your church manages its congregation's records, decides who has staff access, and determines how those records are used for church activities. GPChurch operates the software and supporting infrastructure.
Church records can reveal religious affiliation, family relationships, attendance, and financial contributions. Treat this information as sensitive. A church may have additional privacy practices for its own activities, paper records, or services outside GPChurch.
When you contact GPChurch through the public website, we collect your name, email address, optional phone number and church name, selected topic and message. We save the inquiry in our protected customer lead system and send an alert through our configured Google Workspace mailbox. We use these details to review and respond to your request, not to automatically subscribe you to marketing emails. We use session cookies and hashed rate-limit identifiers to protect the form against abuse.
2. Information handled by the service
- Accounts and profiles: names, emails, phone numbers, addresses, birth dates, profile pictures, membership and attendance status, and protected login credentials.
- Family and participation records: household relationships, anniversaries, check-ins, attendance history, milestones, volunteer requests, commitments, and staff decisions.
- Giving records: donor identity, gift amounts, dates, funds, payment method descriptions, provider references, transaction status, and recurring gift schedules.
- Communications: announcements, conversations, comments, reactions, images or attachments, and messages or membership requests to church staff.
- Technical and security information: IP address, browser and device information, request times, pages and actions, login attempts, account identifiers, and change records used for troubleshooting and accountability.
- Email records: recipient addresses, subjects, provider, timestamps, and sending results. The email history journal does not store bodies or attachments; messages and queued requests may be retained separately by the church and its email provider.
Information may come from you, church staff, linked family members with permission to update household details, or connected payment and email services. Public information pages do not require an account; hosting systems may still record ordinary website access information.
3. How information is used
Information is used to provide accounts and church records, display news and conversations, record attendance and giving, coordinate volunteers, send church messages and recovery emails, process requests, and maintain the service. Security and activity records help investigate misuse and errors and identify who made changes.
Staff may use attendance to follow up with people and send encouragement. Giving records support accounting and donor statements. Aggregate attendance and offering totals can be available to church users.
4. Who can see information
Access depends on the account's church, role, and family relationships. Members can view their own giving. Linked family members may view household profiles and attendance and update permitted family details. Family access does not grant access to another person's individual giving.
People and attendance staff have access needed for their duties. Accounting staff and church administrators can access individual giving amounts. Board Members can see giving participation and aggregate offerings, but their board role does not grant access to other people's individual giving amounts. Administrators manage account access. See the guide's access table and your church's Who to Contact & Data Access screen.
Conversations, replies, reactions, and announcements are shared with signed-in church users. They are not private messages. Volunteer staff can view rosters and requests. Messages through Contact Church Staff go to the church's configured staff inbox and are retained as requests.
The GPChurch operator and authorized technical personnel may need access to maintain, secure, or support the service. Hosting, email, and payment providers handle information required for their functions. Information may also be disclosed when required by law or reasonably necessary to investigate misuse, protect people, or secure the service.
5. Payments and external services
The Flutter mobile app uses Google Firebase Cloud Messaging for optional push notifications. Google processes installation identifiers and notification delivery information; GPChurch stores device registration tokens, notification preferences, and delivery records. You can change notification permissions in Android settings and your GPChurch preferences. Push registrations are revoked when a login is deactivated or verified for deletion.
Church location setup can display OpenStreetMap tiles. Loading those tiles sends the map provider ordinary connection information, including your IP address and the requested map area.
Your church chooses its connected payment providers, which may include Stripe, Square, PayPal, Authorize.net, or Braintree. Payments go to the church's provider account. Sensitive card or bank details are handled by the provider's checkout or payment fields; GPChurch maintains transaction records and references rather than full card or bank account numbers.
Connected email providers process messages and recipient addresses. Some application pages load fonts or icon styles from external services, which receive the browser request and technical information such as your IP address. External links and checkout pages have their own privacy policies. Review them when using those services.
6. Cookies, browser storage, and security
The mobile app stores its login token in platform-protected secure storage. Optional App Lock uses the device biometric or passcode system; GPChurch does not receive your biometric templates. When you choose photos or attachments, the selected files are uploaded for the feature you requested.
Where your church requires location-based attendance check-in, the app asks for foreground location permission and sends your current coordinates, accuracy, and capture time to verify that you are near the church. GPChurch does not request background location. The attendance event is retained; this check-in flow does not store the member coordinates. Network-based presence checks use your connection IP address. You can decline location access, although location-required check-in will then be unavailable.
The church application uses session cookies to keep you signed in and protect account actions. Browser storage remembers interface preferences such as navigation appearance. Blocking cookies may prevent sign-in or form submission. You can clear cookies and preferences through your browser settings.
The service uses account permissions, protected password handling, and safeguards for authenticated actions. No online system can guarantee absolute security. Use a unique password, keep recovery codes private, and sign out on shared devices. Contact staff promptly if you suspect unauthorized access.
7. Account choices, deletion, and retention
Each GPChurch login belongs to one church. Under My Profile → Account Settings on the website or mobile app, you can choose Deactivate My Account or Request Permanent Account Deletion. Actions do not affect your logins at other churches.
Deactivation temporarily disables login and revokes sessions, authentication tokens, and push registrations. It preserves church records, contact information, Conversations, comments, reactions, associated names, privacy settings, and permissions. You can request reactivation from the sign-in page using expiring email verification and a new password. Reactivation does not remove an administrative block or restore old sessions.
To request permanent deletion without signing in or installing the app, visit the GPChurch account deletion page and select your church. Account ownership verification and explicit confirmation are required. After verification, login access is revoked immediately. Deletion normally completes within 24 hours, and we send confirmation when cleanup is complete. Your verification email provides access to processing status. Contact the GPChurch operator through our contact form if processing is delayed. Ordinary deletion does not require church staff approval.
Permanent deletion removes login credentials, authentication tokens, push registrations, eligible account preferences and profile photos, your Conversations and Announcement comments, reactions, and associated media, including eligible soft-deleted content and stored account copies. We preserve other contributors' content and necessary structural relationships. Church-authored announcements and independently managed organizational records are reviewed under the church's retention policy. Deletion cannot be undone. You may register again through normal verified signup; this creates fresh login credentials without restoring previous staff privileges.
Church-managed membership, family, attendance, giving, contact, administrative, and safeguarding records are separate from login access. Necessary records may remain for documented church operations, reporting, financial accountability, safeguarding, disputes, or applicable legal obligations. Names, addresses, email addresses, phone numbers and birthdays remain personal information: keeping a church record does not authorize indefinite retention of every field. Churches must document purposes and retention/review periods, minimize information, and remove or anonymize information no longer needed. There is no universal mandatory retention period for every record.
For review, correction or removal of church-managed information, contact your church office or use Contact Church Staff while signed in. Staff may verify identity, explain retained categories and reasons, and involve the GPChurch operator. Public blog comments and other information without a login association may require separate ownership verification.
Deleting a GPChurch login does not necessarily cancel an existing recurring contribution or payment instruction. Use the existing giving controls or contact your church or payment provider for cancellation assistance. Cancellation is not a prerequisite to login deletion.
Verification and deletion tracking retain only necessary processing evidence. Verification credentials are single-use and expire; expired challenges are cleared and removed after seven days. Read-only status links expire after 30 days. Temporary encrypted notification contact is removed after notification, and completed request links to the person and email are removed after 90 days. These are service policy periods, not statements of legal requirements. Minimal security and organizational evidence may be retained under a documented purpose and schedule. Backups and provider systems follow documented expiry procedures; any restoration must reapply completed deletions before normal access resumes.
8. Children's and household information
Churches may maintain children's profiles and attendance as part of family and ministry records. Parents or guardians should coordinate with staff about those records, photographs, household access, and account use by a minor. Avoid posting a child's personal details or image without appropriate permission.
If you believe a child's information was collected or shared improperly, contact the church promptly for review or removal. Churches and the operator are responsible for assessing applicable parental notice and consent requirements. Household editing permissions are not a substitute for parental consent.
9. Questions and updates
For questions about your church account or records, use Contact Church Staff after signing in, or contact your church office directly if you cannot sign in. For a question about GPChurch's operation or your public website inquiry, use our contact form. Include your church and a description of the request; do not send passwords or full payment details.
Updates appear here with a revised date. Changes requiring additional notice or permission will be handled as applicable. See also the Terms of Service.