Privacy policy

Who we are

The app is run by Rapid App Development, LLC (“we”), which is responsible for your personal information. Write to info@rapidapp.dev with any question about this policy or your data.

What we collect

Your account

• Your email address and how you sign in (email and password, Google, or Apple).
• Your password, which is stored only as a secure hash.
• If you sign in with Google or Apple: the name and email address they share with us, and your Google profile picture.

Your profile

• Your first and last name.
• A profile photo, if you add one.

Your parishes

Which parishes you belong to or have asked to join, and your role in each (for example, parishioner or admin). Belonging to a parish shows your religious affiliation, which the law treats as especially sensitive. We use it only to give you the parish features you joined for. We rely on your explicit consent, which you give when you send a request to join after reading the notice on that screen. You can withdraw it at any time by leaving the parish or deleting your account.

A parish’s admins can also make you an admin of that parish using your email address, without a request from you. Admins can’t leave a parish themselves, so if this happens and you don’t want it, ask one of the parish’s admins to remove you, write to info@rapidapp.dev, or delete your account.

Groups

• Messages you send, including edits and the people you mention.
• Photos you send.
• Your reactions, and how far you have read in each group.
• Your notification setting for each group.
• Reports you make about a message, including any note you add and a copy of the reported message, and the people you block.

Device and technical information

• Your IP address and the type of browser or device you use, recorded when you sign in and kept in our service providers’ request logs.
• On the mobile apps, your device model, operating system version, language, and app and installation identifiers, collected by our analytics and crash reporting.

Other

• Which parish calendars you have chosen to hide.
• On the mobile apps, a device token so we can send you push notifications.
• On the mobile apps, usage and crash data, described below.

We don’t use your device’s GPS location, and we don’t collect your contacts or audio. Our analytics provider estimates your approximate region from your IP address. The apps use your camera and photo library only when you choose a photo to send or to use as your profile photo, and we remove location and other camera details from those photos before they are uploaded.

How we use it

• To run your account and the parish, group and calendar features.
• To send the notifications you have asked for.
• To keep the app safe, through reports and blocking.
• To find and fix crashes, and to understand which features are used.

We don’t sell your personal information, and the app shows no ads.

Analytics and crash reporting

The mobile apps use Google Firebase Analytics and Firebase Crashlytics. They receive the actions you take in the app (for example, opening a parish or sending a message, but never what you searched for or what the message said), the screens you visit, crash reports, your account ID, your role, and the ID of the parish you are viewing. They also collect device information (model, operating system, language, app and installation identifiers) and an approximate region derived from your IP address. This data is linked to your account.

On Android, Firebase Analytics also collects your device’s advertising ID, an identifier Android assigns to your device. We use it only as part of usage analytics, not to show you ads. You can reset it or delete it in your device’s settings, under Privacy › Ads.

There is no setting in the app to turn this off. The website has no analytics.

Who can see what

• Members of your parish can see your name and profile photo. The parish’s admins can also see your email address.
• An admin of any parish can check whether an exact email address has an account and see that person’s name, so they can add them as an admin.
• Members of a group can see the messages, photos and reactions you send there. In a public group, anyone in the parish who joins can see the group’s whole history. In a private group, members see only what was sent after they joined. When you send a message, you can see how many members have read it and who they are; others can see the same about theirs.
• A parish’s admins can read reports made in that parish, including who made the report, who was reported, any note added, and a copy of the reported message.
• Parish admins can list clergy and staff with their role, name and email. Any signed-in user can see the names and roles; the parish’s members can also see the emails. Staff who want their details changed can ask the parish or write to info@rapidapp.dev.
• Profile photos, group photos and parish images are stored at web addresses that are hard to guess but not password-protected. Photos sent in groups are private to the group’s members.

Service providers

We use these companies to run the app. They handle your data on our behalf:

• Supabase hosts our database, sign-in and file storage. Messages are encrypted in transit and on disk but are not end-to-end encrypted, so they are readable on our servers.
• Google Firebase provides analytics, crash reporting and push notification delivery.
• Apple Push Notification service delivers notifications to iPhones.
• Google and Apple handle sign-in when you choose them.
• Vercel hosts the website.

A notification about a group message includes the sender’s name and up to the first 180 characters of the message, so that text passes through Google’s and Apple’s notification services. Your data may be processed in the United States.

Cookies and local storage

The website uses cookies to keep you signed in and to remember the last parish you viewed. It uses no advertising or tracking cookies. The mobile apps keep your sign-in, preferences and some cached data on your device, and keep photos from groups in a cache for up to 30 days.

Retention and deletion

• Photos sent in groups are deleted 12 months after they are sent.
• Everything else is kept for as long as your account exists.
• You can delete your account on the website or in the app. That deletes your profile, profile photo, parish memberships and device tokens, and erases every message, photo and reaction you sent. Other members see your messages as “Message deleted”. Reports you made or that were made about you are kept for the parish’s admins, with your note or the reported message’s text erased.
• Deleting your account does not remove analytics and crash data already sent to Firebase, which Firebase keeps under its own retention settings, or a group photo you set as a moderator. Write to info@rapidapp.dev and we will remove these.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, by writing to info@rapidapp.dev. You can correct your name and delete your account yourself in the app.

If you are in the EU or the UK

Under the GDPR you have the right to access, correct, delete, export and restrict the use of your data, and to object to how we use it. We use your data to provide the service you signed up for, in our legitimate interest in keeping the app working and safe, and, for parish membership, with your explicit consent, which you can withdraw at any time by leaving the parish or, if you were made an admin, by asking us or the parish to remove you. You can complain to your local data protection authority.

If you are in California

Under the CCPA you have the right to know what we collect, and to ask us to delete or correct it. We do not sell or share your personal information, and we will not treat you differently for using these rights.

Children

The app is not meant for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, write to info@rapidapp.dev and we will delete it.

Security

Data is encrypted in transit and on disk, and every part of the database checks who is asking before it returns anything. Messages are not end-to-end encrypted.

Changes to this policy

When this policy changes, we update the date at the top of this page. Write to info@rapidapp.dev with any questions.