Catedral da Familia USA

Privacy Policy

Effective November 8, 2026 · Version 2026-11-08

This policy explains what the Catedral da Família app and website collect, why, who can see it, how long it is kept, and your choices.

Who is responsible

  • The church Catedral da Família, in Burlingame, California, decides what data is collected and why. It is the "controller".
  • Leonardo Machado publishes and runs the app for the church, and handles the data only on the church's instructions (the "processor").
  • Contact: catedraldafamilia@gmail.com.

What we collect

  • Your account: name, email and/or phone number, password (stored scrambled), language.
  • Your profile: photo (if you add one), birth date, gender, marital status, address. You choose most of these.
  • Your family: the people in your household, including children's names, birth dates, allergies, notes for the Kids ministry and photos (a child's photo only if a parent shares it). Parents enter children's details; children do not have accounts.
  • Kids check-in: when each child is checked in and out, in which room, by which volunteer, and which adult typed their Kids passcode; calls from the Kids room to a parent and the answers; and any release a leader makes by hand, with the reason.
  • Kids passcodes: each parent, and each pickup person, sets their own 4-digit Kids passcode. We keep it only in scrambled form (nobody can read it), with the number of wrong tries.
  • Pickup people: the name and phone number of someone a parent allows to collect their children (for example, a grandparent), whether they accepted, and when the permission ends.
  • Kids volunteers: the date a volunteer's background check was completed and when it expires (never the results), and that they read the child-safety rules.
  • Ministries and serving: the ministries you join, your serving schedule (your escalas: an escala is one ministry's service date), answers you give when you apply.
  • Escala chat: the text messages you write in the chat of an escala (a ministry's service date) you serve in. The people in that escala, the ministry's leaders and the Lead Pastors can read them. A message you delete keeps no text. If someone reports a message, the ministry's leaders and the Lead Pastors get a copy of what it said; a report about a leader never goes to that leader, and a report about a Lead Pastor goes only to the other Lead Pastors.
  • Escala songs and details: the songs added to a Worship escala (song name, artist, key and an optional YouTube link) and who added them; an escala's arrival time, notes and the colours to wear.
  • Events: your sign-ups, tickets and the answers on sign-up forms. Guests who sign up without an account give a name and an email or phone.
  • Guest accounts: if you make a guest account to pay for an event: your name, email or phone, date of birth, your tickets and your payments. Nothing else.
  • Payments: whether a payment went through, the amount, the card type and the last four digits of the card. Your full card number stays with Stripe; we never see it.
  • Giving and finance records the church keeps by law.
  • Visitor forms: what a visitor writes on the welcome form, including prayer requests. If a visitor ticks "You may contact me", a leader may reach them by phone, text, email or WhatsApp from the leader's own phone, and writes short follow-up notes about each contact.
  • Pastoral notes: written by pastors and locked (encrypted) on their own devices. We cannot read them.
  • Notifications: the notices the app sends you (in the app, by push and by email) and your notification settings.
  • Technical data: your phone's notification address (push token), the app's installation ID used for app updates, the device keys that lock pastoral notes on a pastor's phone, security logs, and the robot check on forms (Cloudflare Turnstile).

Why we use it

  • To run the church's app: your account, your family, ministries, serving, events, Kids check-in, messages from the church.
  • To keep children safe at check-in.
  • To keep the app secure and stop misuse.
  • To keep the records the law requires (for example, finance records).

We do not sell your data. We do not show ads. We do not use third-party analytics or tracking.

Who can see it

  • You can see and change your own details.
  • Church leaders see only what their role needs. For example: ministry leaders see their ministry's members; the people on that day's Kids escala, the Kids leaders and the Lead Pastors see a child's name, age, allergies, notes and photo (photo only if a parent shares it) at the Kids desk, and only Lead Pastors read the Kids log; only finance roles see giving.
  • Visitor forms and the follow-up notes are seen by the Lead Pastors and the leaders who follow up with visitors. Prayer requests are seen by the Lead Pastors and the leaders of the Intercession ministry (for a visitor under 18, by the Lead Pastors only). Pastoral notes are read only by the Lead Pastors.
  • Escala songs are seen by everyone on that escala, the ministry's leaders and the Lead Pastors, with the name of who added each song.
  • Other members see only basic details (like your name and photo) of people they share a ministry or household with.
  • Our support staff cannot see church data unless the church gives them time-limited access, which is logged.
  • Service providers (below) store or send data for us.

Service providers

  • Supabase: stores the app's data, sign-in and files (servers in the United States).
  • Vercel: hosts the website (sees your internet address when you visit).
  • Expo, with Apple push services: app updates and push notifications (your phone's push address, the app's installation ID and the notice's text).
  • Resend: sends emails (your email address and the email's content).
  • Twilio Verify: sends sign-in codes by text to US numbers (your phone number).
  • Stripe: card payments for the church (your name, email, card and the amount; we never see the full card number).
  • Cloudflare Turnstile: the robot check on forms (technical details of your browser or phone).
  • LRCLIB and YouTube: finding a song's name and artist, and the title of a YouTube link you paste. Only the search words or the link are sent, from our server, never your name. A YouTube link opens in YouTube, under Google's privacy policy.

Each provider uses the data only to provide its service to us and must keep it safe. We tell the church before we add a new provider.

Text messages

  • If you choose to sign in or confirm your phone by text, we send a one-time code by SMS through Twilio. Codes work with US numbers only; other numbers sign in by email.
  • We text only the codes you ask for. No marketing or other texts. We never share your phone number with anyone for their marketing. Message and data rates may apply.
  • You can always use email instead.

Cookies

  • The website uses only the cookies it needs to work: one to keep you signed in, and the robot check on forms.
  • We use no advertising or analytics cookies, so there is no cookie banner.
  • "Do Not Track": we do not track you across other websites, whether or not your browser sends this signal.

Photos and media

  • Your profile photo is seen by people in your ministries and household.
  • A child's photo is seen at the Kids desk (that day's Kids escala, the Kids leaders and the Lead Pastors) only if a parent turns it on.
  • Photos in announcements, on the screen at church or on social media need a separate yes from you (or from a parent, for a child). You can change your mind at any time. Children are never shown publicly with their name. Printed material already made cannot be taken back.

How long we keep it

  • Text sign-in codes expire within minutes. Twilio keeps its own delivery records under its own policy. Accounts never confirmed: 7 days.
  • Ministry application answers: 90 days after the decision.
  • Guest sign-ups: contact details and tickets 30 days after the event; unconfirmed ones after 1 day.
  • Kids check-in history and calls from the Kids room: 12 months. The Kids safety log (who checked in or picked up which child, and leader releases): 3 years. A parent's acceptance of the Kids notice: the latest one is kept; older ones 3 years. Background-check dates: 12 months after they expire. Kids passcodes: until changed, or until the account is deleted.
  • Pickup permissions that ended: 30 days.
  • Escala chat messages, and reports about them: deleted 31 days after the service date (the day after the 30th day). A closed report keeps no copy of the text.
  • Escala songs and details: kept with the escala. When you delete your account, your name is removed from the songs you added.
  • Notices in your app inbox: kept while you have an account.
  • Downloaded files (exports): 7 days.
  • Visitor forms and their follow-up notes: made anonymous 24 months after the follow-up ends.
  • Finance records: at least 7 years (the law requires it).
  • Guest accounts: kept until you delete the account or become a member (then it is your member account). Their payment records: 7 years, like all finance records.
  • The record of important changes (the security log): kept for now. It cannot be shortened yet without breaking its tamper check; a 3-year limit is planned.
  • Records of the consents you gave: kept while you have an account. After you delete it, kept 3 years without your name, then deleted.
  • Pastoral notes: until a Lead Pastor deletes them (a reminder each year for notes older than 3 years).
  • Backups: deleted data can stay in the daily backups of our database provider for up to 7 days before it is gone. This includes deleted or edited chat messages, whose earlier text can stay in the database's backups and change logs for that time.

Your choices and rights

  • See and download your data: Me, then Account, then Download my data (once a day).
  • Correct your details in your profile.
  • Delete your account: Me, then Account, then Delete account. Your contact details, profile and sign-in are removed, and your name is replaced by "[deleted]". Some records stay without your name: past serving, Kids check-in and safety logs, paid event records, the security log and consent records. The church keeps your name on past gifts, because finance law requires it.
  • Withdraw a consent (for example, photos in announcements) in the app, at any time.
  • Stop emails about a kind of notice with the link at the bottom of each email.
  • Children: a parent can see and change a child's details, allergies, notes and photo choice on the household page, remove a pickup person, and ask the church to delete a child's record. The download file has your children's check-ins; their other details are on the household page.
  • How we answer: we check that the request comes from you, and answer within 45 days. You can ask someone to make a request for you with your written permission. Using these rights never changes how the church treats you.
  • You can also ask the church at catedraldafamilia@gmail.com.

California residents

  • We do not sell or share your personal information, including for advertising across other apps or websites, and we do not give it to anyone for their own marketing.
  • Because nothing is sold or shared, there is nothing to opt out of. The app works the same if your browser sends a Global Privacy Control signal.
  • We use sensitive information (such as church membership, prayer requests and children's allergies) only to run the app for the church, never to draw conclusions about you or for ads.

Children

  • The app is not made for children. We do not knowingly collect information directly from a child under 13; a parent enters and controls a child's details. If we learn that a child under 13 made an account, we block it at once and delete it.
  • Accounts are for people 13 and older. Children under 13 are added by a parent and never have their own account.
  • If you are under 18, you can remove what you posted, or ask us to remove it.

Security

  • Data is encrypted in transit. Access is limited by role. Sensitive roles need a second sign-in step. Every important change is logged.
  • If a data breach affects you, the church will tell you as the law requires (in California, within 30 days).

Changes to this policy

  • When we make an important change, the app shows the new version and asks you to accept it. The date at the top shows when this version took effect.

Contact

  • catedraldafamilia@gmail.com

Catedral da Família · Burlingame, California