Privacy Policy

Psalmly provides software that a church's leaders use to manage their congregation — prayer, events, groups, announcements, a member directory, online giving, a church website, and optional AI features — and that members use on the web and in our mobile apps.

For your personal account (your name, sign-in credentials, and the list of churches you belong to), Psalmly is the controller of that information. For the information inside a church (its members, content, communications, and giving records), the church is the controller and Psalmly acts as its processor — we handle that information on the church's behalf and under its direction. If you have questions about how a particular church uses your information, please contact that church's leaders directly.

This policy also covers people who do not have a Psalmly account at all — someone who gives as a guest, fills in a church's public form, sends a message through a church's contact page, or whose details a church adds to its own records. Where that is the case, we say so.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Account information. When you create an account we collect your name, email address, and a password. You may also add a phone number, a profile photo, and a short bio. Passwords are stored on our servers only in hashed form by our authentication provider — we never see or store your plaintext password. (One exception, entirely under your control, is described in "Signing in with biometrics" below.)

Church and membership information. The churches you create or join, your role in each (such as member, admin, or lead), and any title a church gives you.

Content you create. Prayer requests (which you may post anonymously), group posts and photos, comments and replies, event RSVPs and registration-form responses, messages you send to our AI features, feedback and support requests, and reports you submit about other people's content.

Answers to forms your church builds. Churches design their own event-registration and sign-up forms, so the questions are theirs, not ours. Depending on what a church asks, your answers may include details such as allergies, dietary needs, medications, or an emergency contact. Please see "Sensitive information" below.

Information your church provides about you. A church can keep records about people in its community — including people who have never used Psalmly. These may include a name, email address, phone number, a household or family label, notes its admins write, and offline cash or check gifts (including a check number and an image of a count sheet or deposit record). If a church has published you on its website's staff or leadership page, that entry — your name, role, photo, and bio — is owned and controlled by the church.

Audio recordings and transcripts. Some churches use our recording assistant to turn a sermon, meeting, or class into notes or a written summary. When a church uses it, we receive the audio file, produce a written transcript of it (which may label individual speakers), and generate a document from that transcript. The recording may capture the voices of anyone present, whether or not they use Psalmly. Churches are responsible for telling people they are being recorded and for obtaining any consent the law where they are requires — some states require the consent of everyone being recorded.

Giving information. When you give online, we record the amount, the fund, the date, the frequency (one-time or recurring), and a confirmation number. Card and bank details are collected and stored by our payment processor, Stripe — Psalmly stores only limited information such as the card brand, the last four digits, and the expiration, along with identifiers that let us reconcile your giving. We never receive or store full card or bank-account numbers.

If you give as a guest. You can give to a church without creating an account. When you do, we collect your name and email address (so the church can thank you and send a receipt), any note you add, and your IP address, and we run an anti-abuse check on the form. Your gift is recorded on that church's giving ledger just like any other.

Device and technical information. When you use our apps we may collect a push-notification token, a device identifier, the device's name, its type and operating-system version, your IP address, and log, crash, and diagnostic data. Our mobile apps check for software updates each time they launch. We use cookies and similar local storage to keep you signed in and to operate the Service.

Approximate location. We do not collect precise or GPS location. When you submit a public form such as a church's contact page, we record a coarse origin (for example, "Portland, OR") derived from your connection, so the church can tell a local inquiry from a distant one.

Communications. If you contact us for support, send feedback, or write to a church through its public contact page, we keep that correspondence so we can help you and improve the Service. A message sent through a church's contact page is stored as part of that church's records and is not tied to a Psalmly account, so it remains with the church even if you later delete your account.

Signing in with biometrics. On our mobile apps you can choose to turn on Face ID, Touch ID, or a fingerprint to sign in. If you do, your email address and password are saved on that device only, inside the operating system's hardware-backed secure storage (the iOS Keychain or Android Keystore), and are released only after a successful biometric or passcode check. They are never transmitted to us and never leave your device. Turning the feature off erases them. This is entirely optional and off by default.

Some of what Psalmly holds is sensitive by its nature, and we want to name that plainly rather than bury it.

• Religious affiliation. The fact that you belong to a particular church, and your role in it, reveals religious belief or affiliation.
• Prayer requests. What people share in prayer can reveal health conditions, family circumstances, grief, addiction, or other deeply personal matters.
• Form answers. Because churches write their own questions, answers can include health, dietary, medical, or emergency-contact details.
• Giving records. Your financial contributions to a religious organization.

We do not sell this information, we do not use it for advertising, and we do not use it to build profiles about you. We use it only to provide the Service as described in this policy. If you would rather not share something, you can leave optional fields blank, post prayer requests anonymously, or decline to answer a church's form question.

We use the information described above to:

• Provide, operate, and maintain the Service, and authenticate you;
• Process church subscriptions and online donations through Stripe;
• Send transactional messages — receipts, year-end giving statements, and security and account notices — and the church communications you have signed up for, such as announcements and bulletins;
• Deliver the push notifications you have enabled;
• Power the AI features a church has enabled;
• Keep the Service secure by preventing fraud, abuse, and unauthorized access, and by reviewing content that is reported to us;
• Provide support and respond to your requests;
• Diagnose crashes and errors so we can fix them;
• Comply with legal obligations, including tax and financial-record requirements;
• Understand how the Service is used so we can improve it.

We do not sell your personal information, and we do not use your giving history or private content for advertising.

Churches on a paid plan can enable AI features. These are optional, and a church on our free plan has none of them.

The assistant. Members and leaders can ask questions about the church — service times, events, how to get involved. The assistant draws on what the church has published: its profile, its events, and knowledge-base articles its leaders write. It does not draw on private member content such as prayer requests, group messages, or anyone's giving history. Your conversations with the assistant are not stored by Psalmly — your messages are sent to our AI provider to generate a reply, and we keep no record of them afterward. No church admin can read your conversations.

Assistance for church leaders. Separately from the assistant, leaders can ask AI to help with specific tasks: drafting or polishing text they are writing, generating a form or a web page from a description, drafting a bulletin, creating artwork, producing notes from a recording, or reading a scanned document. In these cases the material the leader submits is sent for processing — and that material sometimes contains personal information. In particular, a leader with financial access can scan a paper offering count sheet, which is read to extract the names and amounts written on it, and a recording can be transcribed with individual speakers labeled.

Where it goes. We use several AI providers depending on the feature: Google (text generation and document understanding), OpenAI (search indexing and image generation), and Deepgram (speech-to-text for recordings). Most of this traffic is routed through Vercel AI Gateway; audio sent for transcription goes to Deepgram directly.

Training. We do not permit our AI providers to use your content to train their models, and we configure our use of these services with that intent. We cannot, however, make promises on another company's behalf beyond the terms we have with them.

A person is always in the loop. The assistant can only ever propose an action — drafting an announcement, registering you for an event — and a person reviews and confirms before anything is saved or sent. The same is true of every drafting feature: nothing AI produces is published, emailed, or stored on your behalf without someone approving it.

AI responses can be wrong or incomplete. Please don't rely on them for important decisions without checking.

Within your church. Information you provide is visible to your church according to its features and your own settings. Your directory listing is shown to other members based on your "How you appear" choices; prayer requests appear on the church's prayer board (anonymously if you choose); group posts are visible to that group; and church admins can see membership and giving records for their church. Anonymity options hide your identity from a church's reports and boards, but your identity is still retained for receipts, tax statements, and your own records. Church administrators and, where content is reported, our own team can see more than an ordinary member — see "Access by our team" below.

Access by our team. Psalmly is a very small company. To provide support, investigate a problem, review reported content, and keep the Service running, our personnel can access church and account information — including your name, email address, phone number, sign-in history, and church memberships, along with feedback, support tickets, and content that has been reported to us. This means content you post anonymously, or a report you file, is not anonymous to us — only to other members of your church. We access this information only when there is a reason to, and our actions on a church's account are logged.

Service providers (subprocessors). We share information with vendors who help us run the Service, under contracts that limit their use of it. These currently include:

• Supabase — database, authentication, and file storage;
• Stripe — subscription billing and online-giving payment processing;
• Vercel — application hosting and delivery, website analytics, and AI request routing;
• Resend — delivery of transactional and church emails;
• Google — AI text generation and document understanding;
• OpenAI — AI search indexing and image generation;
• Deepgram — speech-to-text transcription of recordings;
• Sentry — crash and error reporting, so we can find and fix bugs;
• Expo, Apple Push Notification service, and Google Firebase Cloud Messaging — push-notification delivery and mobile app updates;
• hCaptcha — to protect public forms and guest giving from abuse.

Advertising. Meta receives information through its pixel on the page our ads link to; see Our advertising.

Legal and safety. We may disclose information if required by law or legal process, or where we believe in good faith it is necessary to protect the rights, safety, or property of Psalmly, our users, or the public.

Business transfers. If Psalmly is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will require the recipient to honor this policy.

With your consent, or in aggregated or de-identified form that cannot reasonably be used to identify you.

Online giving runs on Stripe. Each church connects its own Stripe account and is the merchant of record for the gifts it receives — funds settle directly to the church, and Psalmly never holds your donation. Stripe collects and secures your card or bank details under the PCI Data Security Standard.

Psalmly keeps a record of your gifts so we can send receipts, build your year-end contribution statement, and show your giving history. Because donations are financial records, we retain them as described in "Data retention" below, even if you later leave the church or delete your account.

Churches can also record offline gifts — cash or checks received in person. If a church records a gift from you this way, that record sits alongside your online giving even if you have never used Psalmly yourself.

Choosing to give anonymously hides your name from the church's giving reports, but your identity remains attached to the gift for receipts, statements, and the church's own Stripe records, as required for legitimate financial and tax purposes.

Every church on Psalmly can have a public website that anyone on the internet can read, and search engines can index. It is worth knowing what can appear there:

• the church's profile, service times, address, and contact details;
• events the church publishes, including their images and descriptions;
• announcements and news the church publishes;
• custom pages the church builds, and photos it adds to its gallery;
• staff and leadership entries, including names, roles, photos, and bios;
• bulletins — and a bulletin can include prayer requests.

That last point deserves emphasis. When a church prepares a bulletin, its leaders can include prayer requests that are visible to the congregation, and a published bulletin is a page of the church's website, which anyone can read. Requests you send privately to a church's prayer team are never included. If you would rather a request never appear publicly, send it to the prayer team or ask your church's leaders.

Churches on a paid plan can also connect their own domain name, in which case these pages are served from the church's own web address.

You have control over much of your information:

• Profile and visibility — update your name, photo, phone, and bio anytime, and control how you appear in each church's directory;
• Email — manage announcement and bulletin email subscriptions, or unsubscribe with one click from any such email;
• Push notifications — turn categories on or off in the mobile app, or in your device settings;
• Biometric sign-in — turn it off at any time, which erases the credentials saved on that device;
• Leave a church — remove yourself from a church at any time, unless you are the only lead admin of a church that is still open (hand it off or close it first);
• Delete your account — request deletion of your account and personal data, subject to the same sole-lead-admin condition.

How account deletion works. Deletion is scheduled rather than immediate: your account enters a 30-day waiting period, during which you can sign back in and restore it. After that it is permanently deleted. Two things to know before you start. First, any recurring gifts you have set up continue to be charged during those 30 days — cancel them separately first if you do not want them to run. Second, your giving records do not disappear: as explained below, your name and email remain attached to your past gifts on your church's ledger.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; to opt out of its sale (we do not sell personal information) or of its sharing for targeted advertising (see Our advertising); and to not be treated differently for exercising those rights. You may use an authorized agent to make a request on your behalf. To make a request, email privacy@psalmly.app. We will verify your request and respond as required by law. If we decline, you may appeal by replying to our response, and we will review it and explain our decision.

If information about you is held by a church — for example a record its leaders created, or a staff entry on its website — the church controls it, and we will refer your request to the church and help it respond. Note also that some information, particularly giving and financial records, must be retained even after a deletion request.

We keep your information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete your profile and the personal content tied to it, except where we are required to keep something or where it belongs to a church rather than to you.

Giving records are kept, and they are not anonymous. So that churches can keep accurate contribution records and issue valid tax acknowledgments, your name and email address remain attached to your past gifts on that church's giving ledger after your account is deleted. The church continues to see who gave. We keep these financial records for as long as required to meet tax, accounting, and legal obligations; in practice they are retained indefinitely, so that a church's books and a member's contribution history stay complete and reconcilable.

Some other things are also kept deliberately. Messages you send us through a contact or support form are retained so we have a record of the conversation. Content that has been reported to us, and our record of what we did about it, is retained so that repeated problems can be recognized. A staff or leadership entry a church published about you belongs to the church and stays with the church.

When a church closes its account on Psalmly, its giving ledger is preserved so members keep access to their contribution statements. Residual copies may remain in backups for a limited time before they are overwritten.

We protect information with encryption in transit, row-level access controls so each person and church can reach only their own data, and reputable infrastructure providers. Card and bank data are handled by Stripe under the PCI Data Security Standard. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security — but we work hard to protect your information and to respond promptly if something goes wrong.

If we become aware of a breach of security that affects your personal information, we will notify you and any relevant authority as required by applicable law, without undue delay. Where Psalmly acts as a church's processor, we will notify the church so it can meet its own obligations.

The Service is designed for churches and their members, not for children. You must be at least 13 years old to hold a Psalmly account, and we do not knowingly allow anyone younger to create one or knowingly collect personal information directly from a child under 13.

Many churches serve families, and a church may add information about a minor to its own records — for example a youth-event registration completed by a parent. When it does, the church is the controller of that information and is responsible for obtaining any parental consent the law requires. If you believe a child's information has been provided to us without proper consent, contact us at privacy@psalmly.app and we will remove it.

We use cookies and similar local storage to operate the Service — keeping you signed in, remembering your preferences, and protecting forms from abuse. The page our ads link to also uses Meta's advertising cookies (see Our advertising). We do not run session-recording or replay tools.

Some of our providers set their own cookies in order to do their job: Stripe for payment fraud prevention, and hCaptcha for anti-abuse checks on public forms. Our website analytics do not use cookies at all. You can block or clear cookies in your browser, though signing in will not work without the ones that keep your session.

We advertise Psalmly on Facebook and Instagram. The page our ads link to, and no other page, uses the Meta Pixel. Through it, third parties including Meta may use cookies, web beacons, and similar technologies to collect or receive information from our website and elsewhere on the internet, and use that information to provide measurement services and to target and deliver ads. Meta handles that information under its own privacy policy.

To opt out, turn on Global Privacy Control in your browser (the page then won't load the pixel), change your ad settings on Facebook or Instagram, or visit aboutads.info/choices.

Psalmly is operated in the United States and offered for use in the United States. The information we collect is processed and stored in the United States. The Service is not directed to the European Economic Area, the United Kingdom, or Switzerland, and we do not offer it to churches there.

If you access the Service from outside the United States, you do so on your own initiative and you understand that your information will be processed in the United States, where data-protection laws may differ from those in your country.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will provide a more prominent notice — such as an email or an in-app notice — before the change takes effect. Your continued use of the Service after an update means you accept the revised policy.

Psalmly is operated by Everwood Ventures LLC, based in New Mexico, United States. Questions about this policy or your information? Email us at privacy@psalmly.app, reach support at support@psalmly.app, or visit our Help Center. You can also review our Terms of Service.