Privacy Policy

1. Introduction

Welcome to Strengthening the Saints (“STS,” “we,” “our,” or “us”), operated by Strengthening the Saints LLC. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what data we collect, why we collect it, how it is used and protected, and what rights you have regarding it when you use our application, website at https://thewordbibleapp.com, and related discipleship tools and services (collectively, the “Service”).

Strengthening the Saints is a church-centered discipleship platform designed to help individuals grow in their understanding and application of Scripture through structured Bible reading plans, sermon-based content, and guided reflection. The Service is intended to operate within the context of local churches, where spiritual oversight, teaching, and discipleship relationships are encouraged.

Strengthening the Saints is designed to support the work of the local church, not replace it. The platform functions as a tool for Scripture engagement and discipleship under the guidance of church leadership.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use immediately.

This policy applies to all users, including individual disciples, Shepherds, and church administrators. It does not apply to third-party websites or services that may be linked within STS.

The Service operates within a defined theological and ministry framework and is not a neutral or viewpoint-agnostic platform. However, we do not guarantee that all content or participants will fully align with these standards.

2. Information We Collect

a. Information You Provide Directly

• Account registration data: name, email address, and securely hashed passwords
• Church or organization affiliation and role (Disciple, Shepherd, Shepherd Admin)
• Profile information and in-app preferences
• User-generated content: sermon notes, Bible highlights, verse annotations, reading plan progress, cohort reflections, and plan submissions
• Communications you initiate with us, including support requests and feedback

b. Information Collected Automatically

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps
• Device identifiers and platform information (e.g., iOS, Android, web browser)
• Usage data: features accessed, reading progress, plan enrollment and completion, cohort activity
• Session tokens and authentication data
• Referral and sharing data: we may collect information about how you access and share plans (such as through invite or referral links) in order to support sharing functionality, measure engagement, and improve the Service
• Cookies, local storage, IndexedDB, and similar tracking technologies (see Section 9)

c. Information from Third Parties

When signing in through third-party providers such as Google or Apple, we receive basic account information (such as your name, email address, and a provider-specific identifier) as authorized during the authentication process.

Church administrators may provide member information (e.g., names, roles) to configure Shepherd features within their organization. Church administrators are responsible for ensuring they have appropriate rights and permissions to provide such information and to use the Service within their organization.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Create, authenticate, and manage your account
• Deliver, operate, and improve the STS Service and its features
• Personalize your Bible reading and discipleship experience
• Enable church and cohort features, including Shepherd visibility into member progress (limited to the scope you authorize by joining a cohort or church plan)
• In certain cases, information submitted as part of church registration, leadership roles, or organizational setup may be reviewed by STS administrators to confirm eligibility for church-level features and permissions
• Send transactional and operational communications (e.g., account confirmations, security alerts, plan enrollment notifications)
• Respond to support requests and user inquiries
• Enforce our Terms and Conditions and this Privacy Policy
• Ensure platform security, detect fraud, and prevent abuse
• Analyze aggregate usage trends to improve the Service (using anonymized or aggregated data where possible)
• Comply with applicable legal obligations
• Participation in church or cohort features is voluntary, and users control whether they join such environments

We do not sell, rent, or monetize your personal data, and we do not use it for third-party advertising or data brokerage purposes.

We do not guarantee the accuracy, completeness, or reliability of user-submitted content or activity data within the Service.

3A. Spiritual Content Disclaimer

The content provided through the Service — including Bible reading plans, devotionals, and teaching materials — is for spiritual and educational purposes. STS does not provide pastoral counseling, legal advice, or professional services of any kind. Responsibility for teaching, interpretation, and pastoral care ultimately rests with the local church and its leadership.

STS does not pre-screen all content made available through the Service. The presence of any content, user, organization, or church on the platform does not constitute approval, endorsement, verification, or ongoing monitoring by STS.

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their own commercial purposes. We may share data only in the following limited circumstances:

a. Within Your Church or Cohort

When you voluntarily join a church plan or cohort, certain activity data (such as progress, reflections, and participation) becomes visible to designated church leaders (“Shepherds”) and, where applicable, other members of that cohort. This visibility is a core feature of the Service and is intended to support accountability, encouragement, and discipleship within a church context.

Leaving a cohort ends ongoing visibility but does not guarantee removal of previously shared data that has already been viewed, referenced, or incorporated into Shepherd or cohort records.

Users are responsible for how they share content or access with others, including through invite links or shared plans.

Deleting your account will remove your personal data from active systems, but may not remove content that has been shared with other users (such as reflections or messages) where retention is necessary to preserve the integrity of group discussions or records.

Plans within the Service may have different visibility settings, including:

• Public — discoverable by all users
• Unlisted — accessible via direct link only
• Private — restricted to specific users or groups

Your participation and activity may be visible to others depending on the visibility setting of the plan and whether you join a church or cohort.

b. Service Providers (Data Processors)

We engage trusted third-party service providers who process data on our behalf to operate the Service. These include:

• Supabase (database, authentication, and real-time infrastructure) — see https://supabase.com/privacy
• Hosting and content delivery providers
• Analytics providers (using anonymized or aggregated data where feasible)

All service providers are contractually required to protect your data, use it only for the services they provide to us, and not disclose it to unauthorized parties.

c. Legal Compliance and Protection

We may disclose your information if required by law, subpoena, court order, or governmental authority, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of STS, our users, or the public.

d. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred to the successor entity. We will provide reasonable notice before your data becomes subject to a different privacy policy, and you will have the opportunity to delete your account if you object.

e. With Your Consent

We may share data in other ways with your explicit consent.

5. Data Retention

We retain personal information for as long as your account is active or as otherwise necessary to provide the Service. Specific retention guidelines:

• Account data: retained for the life of your account plus up to 30 days following account deletion (to allow for recovery requests)
• User-generated content (notes, highlights): deleted within 30 days of account deletion, unless required for legal purposes
• Plan activity: if you restart or repeat a plan, your activity and content from prior participation may be retained unless you delete it or request account deletion
• Log and usage data: retained for up to 12 months, then aggregated or deleted
• Backup copies: may be retained for an additional 90 days in secure backups before permanent deletion

Certain data may be retained longer where required by law, to resolve disputes, or to enforce our agreements.

To request deletion of your account and associated data, contact us at the address in Section 13.

6. Security

We implement technical and organizational security measures appropriate to the sensitivity of the data we process. These include:

• Encrypted data transmission via TLS/HTTPS
• Row-Level Security (RLS) policies in our Supabase database, ensuring users can only access their own data
• Hashed password storage — we do not store plaintext passwords
• Access controls limiting employee and contractor access to personal data on a need-to-know basis
• Local-first data handling: certain content (such as sermon notes) may be stored locally on your device before being synchronized with our servers, reducing unnecessary transmission of sensitive data

No method of electronic transmission or storage is completely secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security, including protection against unauthorized access caused by user actions, shared access, or third-party systems, data loss, or misuse. In the event of a security breach affecting your personal information, we will notify you and relevant authorities as required by applicable law — including within 72 hours where required under GDPR, and within applicable state-mandated timeframes in the United States.

7. Children's Privacy (COPPA)

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not create an account or submit any personal information. If we learn that we have inadvertently collected data from a child under 13, we will delete it as promptly as possible. If you believe a child has submitted information to us, please contact us immediately at the address in Section 13.

8. Your Rights

a. All Users

Regardless of your location, you may:

• Access and review the personal information we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and associated personal data
• Opt out of non-transactional communications (e.g., newsletters or product updates) at any time by contacting us or using the unsubscribe link in any such email

b. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is required, but you have this right should our practices change.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Shine the Light: California residents may request information about disclosures of personal information to third parties for their own direct marketing purposes in the preceding calendar year. We do not make such disclosures.

To exercise California rights, submit a verifiable request to the contact information in Section 13. We will respond within 45 days (extendable to 90 days with notice).

c. European Economic Area, UK, and Switzerland (GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, your personal data is processed by STS acting as data controller. Our lawful bases for processing are:

• Contract performance: processing necessary to deliver the Service you have signed up for
• Legitimate interests: analytics, fraud prevention, and platform security, balanced against your privacy interests
• Legal obligation: compliance with applicable laws
• Consent: where we specifically request it (e.g., optional marketing communications)

In addition to the rights above, you have the right to: object to processing based on legitimate interests; restrict processing; obtain a portable copy of your data; withdraw consent at any time without affecting prior lawful processing; and lodge a complaint with your local data protection supervisory authority.

We are based in the United States. If you are located in the EEA/UK, your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (SCCs) and/or other appropriate safeguards for such transfers where required.

9. Cookies and Tracking Technologies

We use cookies, local storage, IndexedDB, and similar technologies to support core functionality, including authentication, preferences, and local-first data storage. Specifically:

• Essential / Strictly Necessary: authentication sessions, security tokens, and user preferences required for the Service to function. These cannot be disabled without breaking core features.
• Functional: storing reading preferences, theme settings, and local-first persistence of sermon notes via IndexedDB and local storage.
• Analytics: understanding aggregate usage patterns to improve the Service. Where analytics tools are used, we configure them to minimize personal data collection.
• Do Not Track: Some browsers transmit a “Do Not Track” signal. We honor this signal by limiting analytics data collection where technically feasible, though we cannot guarantee all third-party tools respect it.

You may control non-essential cookies through your browser settings. Note that disabling cookies may impair authentication and core functionality.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice by posting the updated policy on our website, updating the effective date, and — where feasible — sending a notification to registered users. Non-material changes (e.g., formatting, clarifications) may be made without individual notice. Continued use of the Service after the effective date of a revised policy constitutes acceptance.

11. Third-Party Links

The Service may contain links to external websites, Bible translation resources, or other third-party services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any external service you visit.

12. Do Not Sell My Personal Information

We do not sell your personal information. We do not sell, rent, or monetize your personal data, and we do not use it for third-party advertising or data brokerage purposes. This section is included for compliance with California law. If our practices change, we will update this policy and provide the required opt-out mechanism.

13. Contact Us

To exercise your privacy rights, submit a deletion request, or ask questions about this policy, contact us at: