Privacy Notice
Version 2026-09-06 · Effective 6 September 2026
DRAFT — NOT YET REVIEWED BY A LAWYER. Every
[[PLACEHOLDER]]must be filled in, and a licensed attorney must read this, before Frithon accepts a registration from anybody outside the pilot church. The retention periods in §6 in particular are guesses that need to become decisions.
This notice is given to you at the point we collect your information, which is the registration form — that timing is a requirement of California Civil Code §1798.100(a), and it is why you are reading this before you have an account rather than afterwards.
1. Who is responsible
LEGAL_ENTITY_NAME, REGISTERED_ADDRESS, CONTACT_EMAIL.
Your church is responsible alongside us for the information it puts into Frithon about you. We provide the software; the church runs the ministry.
2. What we collect, where it comes from, and why
| What | Where it comes from | Why we have it |
|---|---|---|
| First and last name | You, at registration | To show who is serving |
| Email address | You, at registration | To sign you in, and to send you your schedule |
| Telephone number | You, at registration | So your leader can reach you about a service |
| Password | You, at registration | Stored only as a cryptographic hash, never as text |
| Photograph | You, if you upload one | To show who is serving |
| Languages you speak | You, if you tell us | So a leader can staff a service in the right language |
| Your church, department and role | Your church's administrator | To decide what you can see and do |
| When and where you served | Your leader, and you | The schedule itself, and the record of it |
| Your preferences and language | You | To show Frithon the way you asked for it |
| Sign-in times, IP address, browser | Automatically, when you use Frithon | Security, and diagnosing faults |
| Your answers on this form | You, now | To prove we had your permission |
We do not ask you for, and please do not send us, a Social Security number, a payment card, a government identifier, health information, or anything about your beliefs beyond the fact that you serve in this church.
3. Who else sees it
- People in your church. Other volunteers see your name and, if you have uploaded one, your photograph. Leaders and administrators of your church see your contact details and your service record. *Showing your photograph and telephone number to other volunteers is optional and you are asked about it separately at registration.*
- Our suppliers, who process data on our instructions and nobody else's: Supabase — database, authentication and file storage, United States, Vercel — application hosting, United States, EMAIL_PROVIDER — sending email. Each is bound by a written contract.
- Nobody else. In particular:
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the preceding twelve months. There is nothing to opt out of, because there is nothing happening.
We would disclose information if a law or a court required it, and we would tell you unless we were forbidden to.
4. Cookies and tracking
Covered separately in the Cookie Notice. In short: the cookies that keep you signed in are strictly necessary and cannot be switched off; anything measuring how the site is used is optional, off by default, and you are asked about it at registration and can change your mind in settings.
We honour the Global Privacy Control signal. If your browser sends it, we treat it as an instruction to opt out.
5. Where your information is held
On servers in the United States. If you are outside the United States, that is where your information goes. If Frithon ever has users in the EEA or the UK, this section needs a lawful transfer mechanism — Standard Contractual Clauses — and this notice needs a GDPR section that it does not currently have.
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Your account and profile | While you have an account, then 30 days | So an accidental deletion can be undone |
| Your service record | ? after the service | The church's own record of who served |
| Consent records | ? after the account ends | To be able to prove we had permission |
| Sign-in and security logs | 90 days | Investigating misuse |
These four numbers are the ones a lawyer will ask about first. They are currently guesses. A retention period must be a decision Pavlo makes, written down here, and then actually implemented — a notice promising deletion after thirty days by a system that never deletes is worse than no notice.
7. Your rights in California
If you live in California, the CCPA as amended by the CPRA gives you the right to:
- know what we have collected about you, where it came from, why, and who we disclosed it to;
- get a copy of it, in a portable form;
- correct anything inaccurate;
- delete it, subject to the narrow exceptions the statute allows;
- opt out of sale or sharing — nothing to do, we do neither;
- limit the use of sensitive personal information — nothing to do, we do not collect any;
- not be treated worse for exercising any of these rights. We will not close your account, degrade the service or charge you differently because you asked.
To exercise any of them, write to CONTACT_EMAIL from the address on your account, or use the controls in your settings. We answer within 45 days and will tell you if we need the extra 45 the statute allows. We verify a request by confirming control of the account email; for a deletion we ask a second time, because deletion cannot be undone. An authorised agent may act for you with written permission from you.
We will never ask you to waive any of these rights, and we could not enforce it if you did — §1798.192 makes such a waiver void. If anybody tells you otherwise, including a future version of Frithon, this paragraph is the one that is correct.
Rights under other states' laws — Virginia, Colorado, Connecticut, Utah, Texas and the rest — are substantially similar, and we apply this section to everybody rather than asking where you live.
8. Children
You must be at least 16 to create a Frithon account yourself.
We know church ministries include people younger than that, and we would rather say plainly what we do than pretend the question does not arise. A volunteer under 16 can be placed on a schedule by their leader as a named person without an account: a name, and the dates they serve. No email address, no telephone number, no password, no sign-in.
We do this because collecting personal information online from a child under 13 requires verifiable parental consent under COPPA, and a tick-box is not verifiable consent. Building that properly — a guardian who is asked, and who can refuse — is on our roadmap and is not finished. Until it is, we do not take the information.
If you believe a child under 13 has an account, write to CONTACT_EMAIL and we will delete it.
9. Security
Passwords are hashed, never stored as text. Traffic is encrypted in transit. Access to your data inside Frithon is enforced by the database itself through row-level security, not only by the application — so a fault in a page cannot show your details to somebody in another church.
No system is perfectly secure, and we do not claim this one is.
10. Changes
When we change this notice in a way that changes its meaning we bump the version at the top, email you, and ask you to accept the new version. We do not retroactively apply a new purpose to information collected under an old notice — §1798.100(c) forbids it and so do we.
11. Contact
LEGAL_ENTITY_NAME, REGISTERED_ADDRESS — CONTACT_EMAIL.