PraisePad

Privacy Policy

Effective October 31, 2026.

Esta política en español

This policy says what PraisePad (praisepad.app, “we”) collects, why, who can see it, and what you can do about it. PraisePad is a tool for church worship teams; almost everything in it is put there by a church for its own team.

What we collect

  • Your account: your name and email address, and a phone number if you or your church's leaders add one. If you turn on text messages, the mobile number you verified and the words you agreed to, with the date. You sign in with a password or a code we email you (or Google or Apple, where offered). The sign-in page shows Google's own sign-in button, which loads from Google. Your password is kept by our sign-in provider only in a scrambled form that can't be turned back into it, and a new one is checked against passwords known from data leaks.
  • Your church's data: songs, charts, lyrics, files, set lists, services, positions, schedules and answers, time away, and notes leaders add. This is entered by the church's leaders and members.
  • Your church's people list: the people a church keeps track of, whether or not they have an account: names, contact details, households, birthdays, grades and schools for children, the church's own fields and tags, and lists. This is entered by the church's owners, admins, and the people they give access to, or brought in from a spreadsheet or another church app. A record's private notes (medical, allergies, custody) are kept apart: only owners, admins, and People managers with two-step sign-in can open them, every look is written in the church's activity log, and they are never in lists, exports, or anything the AI features read.
  • Kids & Check-In, if your church uses it: what a church records to check children in and out: each child's name, birthday or grade, and household; a short alert for the name tag (like an allergy); a photo to help at pickup; who may pick the child up and who may not; and each check-in and pickup (the time, the room, who checked the child in, who took them home, and any Kids leader's okay). The church's Kids leaders enter it, or a parent gives it at the welcome desk. The church's check-in iPads and laptops keep a copy of what their own desk or room needs, so check-in works when the wifi drops.
  • Giving, if your church uses it: the church's giving records: each gift's date, amount, fund, how it was given (a check's number, never a bank account or card number), and who gave it, as the giver's name, email and address as given or brought in from the church's giving provider; cash and check batches with who counted and who verified them; and the year-end statements sent, with a copy of each. The church's Giving managers enter it, or bring it in from a file or Planning Center. If the church takes gifts online through PraisePad Giving, a giver's payment is taken by Stripe on the church's own Stripe account: Stripe holds the card or bank account number and we never see it (for a bank payment, Stripe also checks the account's balance before taking it, which we never see or keep); we keep the card's brand, last four digits and expiry, Stripe's ids for the payment and the saved payment method, the gift's receipt, and, for a monthly gift, its schedule. A giver who signs in to see their giving does so with an email code; we keep their email and the sign-in.
  • The activity log: who changed what in a church and when: changes to people, households, access, teams and roles; every export; every look at a private note; every support visit. It records which fields changed, never the old and new values, and it's kept for two years.
  • Two-step sign-in: if you turn it on (owners, admins, and operators must), our sign-in provider keeps the secret your authenticator app shares with us and the names you give your devices; we keep your recovery codes in a scrambled form that can't be turned back into them, and the date by which two-step is needed for your role.
  • Billing: your church's plan, the address receipts go to, and, for a church that pays by invoice, the finance office's email and the church's postal address. Card and bank details go to Stripe, never to us.
  • Your own notes and settings: highlights, notes, and drawings you make on charts, your chart settings, pedal settings, and email settings. These are yours; nobody else in your church can see your notes.
  • Your lessons in Learn your part: which lessons you've opened and when, which have ticked and what counted (a song you added, for example), and the date of a few firsts the app doesn't otherwise keep: the first time you opened the stage, played a recording, saved a set for offline, opened the tuner, published a set, put a slide on the screen, changed a slide while the show ran, designed a slide, or gave someone a position. Only the kind and the date, never which song, set, service, slide or person.
  • Emails and texts we send you: when a scheduling request, reminder, or notice is sent, we keep a record that it was sent (and whether it bounced or was delivered), so we don't send it twice. Texts you send back are kept with what the app did with them (for example, that a reply accepted a request).
  • Use of the app: which pages are used and which features, without session recordings and without the contents of your charts or messages (PostHog). When something goes wrong, an error report with technical details (Sentry); links that contain keys are removed from those reports first, and they carry your account's id (never your name or email), so when you write to us we can see what went wrong for you. On our website (praisepad.app), how many visits each page gets, which site sent them, and each visitor's country, browser, operating system, and kind of device, counted without cookies and without a profile of anyone (Vercel Web Analytics).
  • Visits we count ourselves: in the app, on our website, on the help site (help.praisepad.app) and on every church's own PraisePad Church site, we count visits ourselves: how many times each page is opened, where a visit came from (the site that sent it, or a word on the link itself, like a poster's QR code), the kind of device (phone, tablet or computer), its language, its country, and a rough number of visitors. No cookies, nothing stored on your device, nothing kept that identifies you: the address your device connects from is mixed with a random value that changes every day into a code that identifies nobody, and the address isn't kept. Each day's random value is deleted after two days, so two days can't be joined up, and after that no code can be worked out again from an address, even by us. In the app, a page's address is counted by its kind (“a person”, “a service”), never with the person or service in it, and a private link (a family's pass, a receipt, a shared service) is counted without its code. We count this to see what's used and to keep the service working, and a church's owners and admins see their own site's month; nobody outside PraisePad sees another church's figures.
  • Problems you report: when you use Report a problem, what you write and any pictures or files you attach, with the page you were on (without anything after its address), your browser, the app's version, and your church and role there. Only the people who build PraisePad see it, with the AI assistant that helps us build it (Anthropic's Claude), and it opens a conversation with us (below), so we can write back.
  • Pad: Pad is PraisePad's AI assistant. In the app it answers from your church's pages as you: it reads only what you can already open there (your schedule, set lists and who's on them, songs, published sermons, the church's coming events, people as the People page shows them, your lessons, the serving report for leaders, billing for owners and admins, and, for those on the teams, Kids as counts, Giving as totals and an event's sign-ups as counts), never private notes, a child's details, a giver's gift, or anyone else's private things; and it changes nothing. Your conversations with Pad in the app are kept for you for 90 days after you last asked in one, so you can go back to them. They go when you delete them or your account, and when you leave the church they were in. Nobody at your church can read them; the people who build PraisePad can, only to fix a problem you report. Apart from them, when Pad reads your church's pages to answer, we keep that it did, which pages it looked at and how many rows, and, as above, your account, your church and your role. A message that's only personal (a hard week, a prayer request) isn't kept, not even in your conversations: a count only, with no one's name on it. When it also asks about PraisePad, it's kept like any other question, and you can delete it.
  • A church site's own chat: a church can give its PraisePad site a chat with a name of its own, answered by PraisePad's AI from what that site shows anyone and the answers the church writes. We keep nothing a visitor types there: per question, a count for the church of what it was about (service times, kids, giving, sermons, visiting, or that it couldn't answer), the language, whether the answer helped, and, when it couldn't answer, a word or two for the subject (like “parking”), never the question. A question a visitor sends on to the church goes to its owners and admins by email, and isn't kept by PraisePad.
  • Follow along on phones: a church can put a link or a QR code in its bulletin or on its screens so the people in the room can follow the sermon on their own phones, without signing in: its outline, the verses, the announcements, and the next steps the church sends (like Give or an event's sign-up). We keep nothing about who opens it, and its visits are counted as above, without the link's code. Notes typed there stay on that phone, in its browser, and never reach us. “Email me my notes” sends them once, to the address typed, under the church's name, only around the service (its day, or within a day after it ended); we don't keep the notes, and keep the address only as a scrambled code, made with a key of ours, for two days, to count the emails, so the page can't be used to send anyone more than two a day.
  • Sign-ups for a church's events: when someone signs up for an event on a church's PraisePad Church site, we keep what they type (a name, an email, and a phone number if they give one), the names of the people coming and whether each is an adult or a child, the language they read the site in, and when they signed up. A sign-up from someone who isn't signed in adds them to the church's people list as a guest; it's never joined to anyone else's record or family. Who's coming is seen only by the church's Events managers and the event's organizer, with two-step sign-in done; a copy of each sign-up also goes by email to the addresses the church chooses. We email the person who signed up: the confirmation, with a link to change or cancel; word when a place opens up for them on the waitlist, held for 48 hours; a reminder the day before; word when the event or one of its dates is cancelled or moved; and the messages the church sends about the event. A cancelled sign-up's names and contacts are removed 30 days after it's cancelled.
  • Tickets, questions and check-in at a church's events: a church can sell tickets for an event, ask questions when people sign up (a t-shirt size, an allergy, an emergency contact), and ask them to agree to its words (a waiver or a photo release, say). Tickets are paid for by card, Apple Pay or Google Pay, and Stripe takes the payment on the church's own Stripe account: Stripe holds the card number and we never see it. We keep each order for the church's books: the tickets and their prices, what was paid and how (by card, with Stripe's ids for the payment and its fees; in cash; by check, with its number; or waived, with the name of the manager who said so), who took cash or a check and where, refunds, and any dispute. The answers, and the words agreed to with the time, are kept with the sign-up. At the door, we keep who was checked in, on which date of the event, and at which check-in station; someone who comes without signing up is added there by name, with an email and phone number if they give them. The emails carry a QR code for the door that holds only the sign-up's door code, which only the church's check-in stations use, to find the household; it isn't the link to change or cancel the sign-up. The church's check-in iPads and laptops keep a copy of that day's households (their names, tickets and answers, and what they owe, but not the phone number given at sign-up), replaced each time they sync, so check-in works when the wifi drops.
  • Help questions: when Pad answers from the help, we keep your question and its answer, the page you asked from, and, signed in, your account, your church, and your role there; whether it helped, and whether you asked for a person (then your conversation goes along with your message to us, below). On the help site and our website, the question, its answer, and the page are kept, but not who you are. We also keep your “Did this help?” votes on help articles and Learn lessons, and help searches that found nothing (without who searched). Questions and searches are deleted after 180 days. Only the people who build PraisePad see them. We also count how many times each help article and Learn lesson is read each day, without who read it.
  • Conversations with us: when you talk to a person from help, email help@praisepad.app or team@praisepad.app, report a problem, or ask for an invitation, what you write and the files you send, your name and email address, and, when you're signed in, your account, your churches and your role in each, the browser you wrote from, and the errors the app hit for you in the last two weeks. Our replies are kept with it. Only the people who build PraisePad see them. The AI assistant reads a conversation to sort it (how urgent, what it's about), to summarize a long one, and to draft a reply we read and edit; it never sends anything itself. When we've helped, you can tell us how we did (Good or Not good, and a note if you like); that's kept with the conversation, and the person who helped you sees it.
  • Our status page (status.praisepad.app) shows whether PraisePad is working. It keeps nothing about the people who visit it, and the app asks it for news without saying who you are.
  • While you have a conversation with us open in the app: the address of the page you're on (like “/grace/songs”, never what's on it) and the few before it, so we know you're in the app and can help with the page you mean; when you're typing, and when you've seen our reply. Nothing about where you are is kept when you have no open conversation with us. While you ask Pad in the app, we can see that you're asking (not what, when Pad read your church's pages), and may join to help; you'll see when we do. If we do, your questions and Pad's help answers become a conversation with us, kept as conversations are (below); an answer from your church's pages never goes along.
  • In the iPhone and iPad app: the same account and church information as on the website. To send you notifications, the app gives us a notification token for each device you sign in on, with an id the app makes for that install and whether it's an iPhone or iPad; it's deleted when that sign-in ends (you sign out, or end your other sessions), when Expo tells us the app is no longer on the device, or when you delete your account. The app keeps your sign-in in the device's Keychain.
  • On your device: a set you download for offline (its charts, files, and your notes) is kept on that device until you remove it or sign out. A cookie keeps you signed in; another remembers your theme and last church. On a church's PraisePad Church site, the light or dark you choose at the bottom of a page is kept in that browser, for that church's site alone, with no cookie.

How we use it

  • To run PraisePad: show charts, send scheduling emails (and texts, if you turn them on) and reminders to the people on a service, keep the team's schedule.
  • For a church that uses Kids & Check-In: to check children in and out, print their labels, show each room its list, page a parent by a page number, and tell the church's Kids leaders when a child is still checked in after a service or a pickup is okayed without the code. When a church turns it on, we email the adults of the household that checked a child in when that child is picked up (naming who picked them up) and, when a Kids leader chooses to, a copy of an incident note about their child. We keep a record of what was sent and to whom for as long as the church keeps its check-in records.
  • For a church that uses Giving: to keep its giving records, count and verify cash and checks, match gifts to people, make reports with totals, and send each giver their year-end statement by email (or for the church to print). Statements go only to the giver, or to the adults of their household. For a church that takes gifts online through PraisePad Giving: to take the payment through Stripe, send the receipt, run a monthly gift on its schedule and tell the giver when a payment fails, refund a gift when the church asks, and tell the church's Giving managers about a dispute, a failed payout, or a run of failed card attempts (which pauses the give page for 30 minutes). Signed in on your church's PraisePad Church site, you can change your own details and your children's; adding someone to your family is done by the church.
  • For a church that sells tickets or checks people in at its events: to take the payment through Stripe and email the receipt, with the tickets and the QR code for the door (a receipt for tickets, not a gift: it says they aren't tax-deductible, and they're never on a giving statement); to refund a ticket when the church decides to, and tell the buyer (cancelling a sign-up never refunds it by itself); to tell the church's Events managers and the event's organizer about a dispute; and to check people in at the door, print name tags when the church asks, and count who came in the church's attendance.
  • To keep it working and safe: rate limits, error reports, and looking into misuse.
  • To improve it, from how it's used in general.

We don't sell personal data (giving records included), we don't show ads, and we don't use your church's content for anything but serving your church, except for one count: across all churches, how often a song is sung, by its CCLI number, to see what's popular. Never which church, and never your charts.

Who can see what

  • Your church's owners, admins, and leaders see the team's contact details; other members see names and positions, not contact details.
  • Everyone on a team sees the schedule and the published set lists. Leaders see set lists before they're published.
  • A guest link a leader makes shows one service's published set to whoever has the link, until it expires or is turned off.
  • Your church's owners and admins, and anyone they give People access to, see the people list; access can be limited to one team or one list. A record says who can see it. Private notes are read only by owners, admins, and People managers with two-step sign-in on, and every look is logged.
  • Kids & Check-In: a church's Kids leaders (its owners and admins, and anyone they give Kids access) see its children's check-in details, and need two-step sign-in. Each volunteer check-in station shows only its own desk or room. Pickup always needs the code on the parent's receipt, or a Kids leader's okay. Screens in the service and the hallway show page numbers only, never a child's name or code.
  • Giving: who gave and how much is seen only by the church's Giving managers, whom only an owner chooses, with two-step sign-in done; every look at a person's giving is logged. Owners, admins and a finance committee see totals only, with any fund that fewer than three people gave to added in with others, so nobody's gift can be worked out. Counters see only the batch in front of them. The activity log never names a giver.
  • Events: who's coming, with the answers, the words agreed to, each order and its payments, and who was checked in, is seen in the app only by the church's Events managers and the event's organizer, with two-step sign-in done, and they can print a check-in list for the door. At the door, a check-in station shows a household, with its tickets, answers and what it owes, only when it's found by its door code, a name, or a phone number. Pad and the AI features never read the answers.
  • Follow along: anyone with the link or its QR code sees the sermon's outline (a blank's word only once the pastor gets there), the verses, the announcements and the next steps the church sends, until the church turns the link off; never the pastor's notes or the songs' words.
  • A church's PraisePad Church site is public: anyone with its address sees what the church puts there, its pictures and video among them (a cover photo, a short video, photos and the words written for them, a YouTube or Vimeo link). The church chooses them and answers for having the consent of the people in them; its settings ask it to leave out close-ups of children's faces. Before a picture or a video the church uploads goes on its site, we take out where it was taken. A YouTube or Vimeo video loads nothing from YouTube or Vimeo until a visitor presses Play; then it plays in YouTube's privacy-enhanced player or Vimeo's, under their own terms. A church can also put its site at its own web address, a domain the church owns and manages; the site, and what we keep, are the same there. Signing in and your own pages (your giving, a family pass, a sign-up you made) stay on PraisePad's address, church.praisepad.app, so your sign-in never rests on a church's domain.
  • Learn your part: you see your own lessons. Your church's owners, admins, and leaders see each member's course, whether they've started it, which lessons have ticked, and when, but not what counted. When our support team runs a training session in your church, the lesson on their screen shows who in the room has done it or opened it lately, and how many there haven't yet.
  • Your church's owners and admins read the church's activity log. PraisePad's operators read it too, to support you.
  • Libraries are never shared between churches.
  • We look at your data only to support you, to fix a problem, or when the law requires it. When our support team opens your church to help, it's for up to two hours at a time, each visit is recorded with its reason, and your church's owners can see every one in Settings.

Service providers

These companies process data on our behalf, under their own agreements with us:

  • Supabase (database, sign-in, file storage, and live sync between devices)
  • Vercel (hosting, and its own count of visits to our website, beside the one we keep ourselves)
  • Resend (email)
  • Cloudflare (our domain's email: messages to help@ and team@praisepad.app pass through it to our inbox; it runs our status page; and Turnstile, its check that a person and not a script is sending a church site's forms, such as those for signing in, giving, signing up or buying tickets, or emailing your notes from Follow along, sees the device's address and browser)
  • Sentry (error reports)
  • Expo (delivering notifications to the iPhone and iPad app, through Apple's notification service)
  • PostHog (product analytics, no session recording)
  • Upstash (rate limiting, and what's live for the screens and phones that follow along: where a leader is in a set, kept for a minute; what's on a church's screens, the slide with its notes and messages, kept about 90 seconds; how far a sermon's outline has come, kept three days; and a service's live captions, with their translations, kept until the service ends, then deleted)
  • Stripe (payments, receipts, and invoices; and the gifts and ticket payments a church takes through PraisePad Giving, on its own Stripe account: your card or bank details go to Stripe, never to us)
  • YouTube, Apple, and Brave Search (when a leader looks for a song's recording from inside PraisePad: PraisePad uses YouTube API Services. The song's title and authors, and any words the leader adds, are sent to YouTube's and Apple's search, and, once PraisePad's YouTube searches for the day are used, to Brave Search, which finds the matching YouTube videos for YouTube to describe. Nothing about your church or your people goes with them. When a leader searches Find a song by a song's name, the name goes to Brave Search, which finds the chord charts on the chart sites the church has switched on. YouTube's and Apple's answers are kept for 30 days so the same search costs nothing next time; Brave's aren't kept. Google's Privacy Policy says how Google handles information. Odesli (song.link) receives the chosen recording's link to find the same recording on other platforms. Recordings play in PraisePad's player bar: a YouTube video through YouTube's privacy-enhanced player and its player script, which load when someone presses play and not before; a Spotify or Apple Music link through that service's embedded player, and Spotify's player script, the same way. What a player stores is between the person and that service, as the privacy policy of YouTube, Spotify, or Apple says.)
  • Twilio (text messages, only if you turn them on: your verified mobile number and the texts we send and you reply go through Twilio. Reply STOP to any text to stop them, or turn texts off under Texts in the app. Your mobile number and your consent to texts are never shared with third parties or affiliates for marketing or promotional purposes.)
  • AssemblyAI (a sermon's sound, recorded at the booth or uploaded in Present, goes to AssemblyAI when its transcript is made, and the transcript comes back; and, where a church turns on live captions, the sermon's sound as it's preached goes to AssemblyAI from the booth and the words come back as captions; under AssemblyAI's own terms)
  • Atlas Cloud (pictures made with AI in Present: the words asked for, and any picture chosen to work from (a Library picture to widen, sharpen or cut out, or the photos, name and notes of someone in the church's cast who agreed on their own consent page), go to Atlas Cloud, which makes the picture and holds what it was sent and what it made at web addresses for a few days)
  • Anthropic (the AI features you choose to use: turning a photo, PDF, or pasted chart into an editable one, suggesting songs, changing a set list in words, checking a chart's chords, reading a scheduling rule written in words, answering questions you ask Pad (the pages it reads for you go along as data; we keep which pages it looked at, never what was on them), and, in Present, building slides from a pastor's notes, tidying a song's slides, proofreading and designing slides, making bullets from notes, wording announcements, changing the slides in words, finding a verse, describing the Library's pictures (the pictures go), checking an idea for a picture and who is in one that was made (the cast's names, and the picture), tidying past sermons' details (with the church's speakers and series), writing a sermon's description, and its recap from the transcript, with the email, posts and handout made from it, and caption translation (each finished sentence of a sermon's live captions, with the two before it, into the languages the church turned on); for a church's PraisePad Church site, describing a picture your church put on its site (the picture goes), and drafting the line under its name, its What to expect, a bulletin line and the Spanish of what it wrote, from the church's own words, service times, town and address; and, for us, sorting and summarizing conversations with us and drafting replies we check before sending. What each needs goes to Anthropic's Claude and comes back for you to review, and nothing is sent unless you press its button, except three that run by themselves where a church uses them: a song's slides tidied when it's first added to the slides, a sermon's recap once its transcript is written, and caption translation while captions are on. Problems you report are read by the AI assistant that helps us build PraisePad, and help questions and searches that found nothing are grouped by it, without who asked, so we know which help to write. Each week it also groups what people asked us about and writes us a short note on the week, from the questions and any comments on how we did, without who wrote them. For Giving, AI never sees a giver's name or an amount: it reads a check photo with the bank numbers cut off on the device first (the photo isn't kept), matches a file's columns by their shapes, suggests fund names, helps word the pastor's note and its Spanish, and turns a list described in words into a filter, from the church's fund names only; the numbers on statements and reports are worked out by PraisePad itself, never by AI. Anthropic's commercial API terms exclude using customer data to train its models.)

If we add others, we'll list them here first.

Keeping and deleting

  • Your data stays while your account and churches exist.
  • Delete your account in Your settings: your profile, notes, and settings go at once. Your name stays on the services you were part of, in your churches' histories.
  • When an owner deletes a church, its data is removed for good 30 days later.
  • When an owner or admin deletes a person from the church's people list, the record is hidden at once and emptied 30 days later; the name stays on past services and in the activity log. Every export is logged, and when it includes the people list the church's other owners and admins are told.
  • The activity log is kept for two years, then removed.
  • Your lessons in Learn your part are kept while you're in the church. They're removed 30 days after you leave it (in case you come back), and at once when you delete your account.
  • Kids check-in records (the times, who picked a child up, and any okays) are deleted after three years by default; a church can choose one to seven years. Attendance (which weeks a child came) and each Sunday's numbers per room stay, like the church's other attendance. Incident notes, which can include first aid given, are kept until the church deletes them. A child's photo goes when the church removes it or the child's record, and photos nothing points at any more are deleted after a day.
  • Giving records (gifts, the giver's details on them, and statements) are kept for the number of years the church chooses, seven by default (three to ten), after the year of the gift, then deleted. They stay for that time even if the person is deleted from the church's people list, because the church needs them for its records and its givers' taxes. Practice batches are deleted after a week.
  • A cancelled sign-up for a church's event (or any sign-up for an event the church cancels) keeps its names, contacts and answers for 30 days, then they're removed; how many people it was for stays, for the event's numbers, and so do its order and payments, for the church's books. An event's orders and payments are kept as long as the church keeps its giving records (seven years by default), after the year the event ended, then deleted.
  • Owners and admins can export the church's data at any time from Settings, including the people list, with two-step sign-in on. Giving's records are exported separately, by the church's Giving managers.
  • Backups are kept for a short time and then overwritten.
  • The record of texts sent to you and replies you sent is kept for six months, then removed.
  • A problem you report is kept until we've dealt with it and cleared it from our list; if you delete your account, your name comes off it there.
  • Where you were in the app during a conversation with us is deleted 30 days after it was last updated, or with your account. A conversation with us is kept until two years after its last message. One you started while signed in goes with your account if you delete it; to have others deleted sooner (an email, or a message from the help site), write to help@praisepad.app. A copy of email you send us also reaches our own mailbox.
  • Each week's grouped questions (with a few of people's words as examples) are deleted after 180 days, like the questions; the counts of help article reads after 13 months.
  • The visits we count ourselves are kept as single rows (a page, a moment, the daily code that identifies nobody) for 90 days, then deleted; the totals by day, which hold no code at all, are kept.

Children

PraisePad accounts are for people 13 and older. Leaders can add younger volunteers to a team without an account; their name and position appear on the schedule like everyone else's, and any contact details a leader adds are visible only to the church's leaders.

A church's people list can hold children's records (a name, birthday, grade, school, household, and private notes such as allergies or custody), entered by the church or by a parent. Children don't sign in. These records are seen only by the church's owners and admins and the people they give access to, and the most sensitive parts need two-step sign-in and are logged every time they're opened. A parent can ask the church to change or remove their child's record, or write to us.

A church that uses Kids & Check-In may record its children's information, given by their parents or guardians, to check them in and out. The church decides what it records and answers for it; PraisePad keeps and processes it for the church, only to run check-in. Labels print only a child's first name and last initial, room and time, pickup code and picture, page number and the short alert, never medical or custody notes. “No photos” on a child means don't post photos of them. Photos for pickup are private: they're shown to the church's Kids leaders, and on its check-in desk and room iPads on the day of a check-in. Alerts, pickup lists and photos of children are never sent to an AI feature. When a Kids leader asks, a photo of a paper registration form or the wording of an incident note, with children's names replaced by placeholders, is sent to produce a draft that the leader sees before anything is saved. Children never have accounts and are never emailed.

Bringing people in from a spreadsheet

When a church imports a spreadsheet of people, the first few rows are sent to Anthropic's Claude to work out which column is which (a name, an email, a birthday), and nothing is written until an owner or admin reviews the result. The rows themselves aren't used to train any model. The Kids import works the same way for a church's Kids leaders, and the contents of alert and pickup columns are never sent.

Your rights

You can see and change your details in Your settings, export your church's data if you're an owner or admin, and delete your account. Depending on where you live, you may have other rights over your personal data; to use them, or to ask anything about this policy, write to team@praisepad.app.

Changes

If we change this policy in a way that matters, we'll show the change when you next sign in. The Terms of Service say how the service works.