Privacy Policy

1. Who We Are

Good Church of Houston ("Church," "we," "us," or "our") is a nonprofit religious organization located in Katy, Texas. We operate the Good Church of Houston mobile application ("App") and website at goodchurchhouston.org ("Site") to serve our congregation and community.

Contact:
Good Church of Houston
Katy, TX, United States
Email: goodchurchhouston@gmail.com
Phone: 832-296-3141

2. Scope of This Policy

This Privacy Policy applies to all personal information we collect through:

• The Good Church of Houston mobile application (iOS and Android)
• Our website at goodchurchhouston.org
• In-person forms and communications that reference this Policy

This Policy is intended to comply with the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, as well as applicable federal laws. If you are a resident of Texas, you have specific rights described in Section 9.

3. Personal Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

• Push Notification Token:A device-specific identifier generated by your device OS (APNs for iOS, FCM for Android) and processed via Expo's push notification service. This is used solely to deliver notifications to your device.
• Device Type: iOS or Android platform identifier, used to route notifications correctly.
• Authentication Session:A secure session token stored in your device's secure storage to keep you logged in. This token is not tied to any personal identifier beyond your account.

3.3 Information Collected via Plan Your Visit Form (Website)

When you submit a "Plan Your Visit" request on our website, we collect your name, phone number (optional), and any notes you choose to include. This information is used exclusively to welcome you and follow up as a new visitor.

3.4 Sensitive Personal Information

Under the Texas TDPSA, the following categories constitute sensitive data, and we collect them only with your explicit, affirmative consent:

• Religious beliefs and practices — Your prayer requests, ministry participation, and worship history reveal information about your religious beliefs. You control the visibility of prayer requests (Public / Ministry members only / Leadership only / Pastor only).
• Precise geolocation — We do not collect GPS or real-time location data. Address information is provided voluntarily by you.

By completing the registration process and tapping "등록 신청" (Submit Registration), you expressly consent to the processing of your sensitive personal information as described in this Policy.

4. How We Use Your Information

We do not use your information for targeted advertising, sale to third parties, or any commercial purpose unrelated to church ministry.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

• Within the Church Community: Your name and ministry role are visible to other active members within the App. Prayer requests are shared only with the audience you designate. Detailed personal information (phone, address, age) is visible only to church administrators.
• Service Providers: We use the following third-party services, each bound by their own privacy policies and data processing agreements:
  • Supabase (supabase.com) — Database and authentication infrastructure. Data stored on AWS servers.
  • Expo / Expo Push Notification Service (expo.dev) — Mobile app platform and push notification delivery. Notification tokens are processed by Expo.
  • Apple Push Notification service (APNs) — iOS push notification delivery.
  • Firebase Cloud Messaging (FCM) / Google — Android push notification delivery.
  • Twilio (twilio.com) — SMS OTP delivery for phone number verification. Your phone number is transmitted to Twilio solely for sending the verification code.
  • Vercel (vercel.com) — Website hosting and serverless infrastructure.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Organizational Transfers: In the event of a merger, acquisition, or reorganization of the Church, personal information may be transferred, subject to the same privacy protections.

6. Data Retention Policy

We retain personal information only as long as necessary for the purposes described in this Policy:

Upon deletion of your account, all personally identifiable information will be removed within 30 days, except where retention is legally required (e.g., donation records under IRS guidelines).

7. Security

We take the security of your personal information seriously and implement the following measures:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Database data is encrypted at rest by Supabase (AES-256).
• Row-Level Security (RLS): Our database enforces granular access controls so that each user can only access data they are authorized to view. For example, a regular member cannot access another member's prayer requests marked as private.
• Authentication: We use phone-number-based OTP (one-time password) authentication via Twilio, eliminating password-related risks such as credential stuffing.
• Session Management: Authentication tokens are stored in your device's secure storage (iOS Keychain / Android Keystore equivalent via Expo SecureStore).
• Access Control: Administrative functions are restricted to verified administrators and require separate authentication.
• Brute-Force Protection: Our administrative systems implement rate limiting to prevent unauthorized access attempts.

Despite these measures, no system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals in accordance with applicable law.

8. Children's Privacy

Our App and Site are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at goodchurchhouston@gmail.com and we will promptly delete that information.

For minors between 13 and 17 years of age, we require parental or guardian consent before the minor's information is collected and processed through our App.

9. Your Rights (Texas Residents — TDPSA)

If you are a resident of Texas, the Texas Data Privacy and Security Act (TDPSA) grants you the following rights with respect to your personal information:

• Right to Access (Art. 541.051): You have the right to confirm whether we process your personal information and to access that information in a portable, readily usable format.
• Right to Correct (Art. 541.052): You have the right to correct inaccurate personal information we hold about you. You may update your profile directly in the App, or contact us for corrections we are unable to make within the App.
• Right to Delete (Art. 541.053): You have the right to request deletion of personal information you have provided or that we have collected about you. Note that certain data (e.g., donation records) may be retained as required by law.
• Right to Data Portability (Art. 541.054): You have the right to obtain a copy of your personal data in a portable, machine-readable format where technically feasible.
• Right to Opt Out of Sale / Targeted Advertising / Profiling (Art. 541.055): We do not sell personal information, engage in targeted advertising, or use automated profiling that produces legal or similarly significant effects. This right is not applicable to our practices, but we acknowledge it.
• Right Regarding Sensitive Data (Art. 541.101): We obtain your explicit consent before processing sensitive personal information (religious data). You may withdraw this consent at any time by contacting us; however, withdrawal may affect your ability to use certain features of the App.
• Right to Appeal (Art. 541.056):If we decline to take action on your request, you may appeal our decision by contacting us at goodchurchhouston@gmail.com within 60 days of receiving our decision. We will respond to your appeal within 60 days. If your appeal is denied, you may contact the Texas Attorney General's office at texasattorneygeneral.gov.

How to Exercise Your Rights

To exercise any of the above rights, please contact us using one of the following methods:

• Email: goodchurchhouston@gmail.com
• Subject Line: "Privacy Rights Request – [Your Name]"
• Phone: 832-296-3141

We will respond to verified requests within 45 days. If we need additional time (up to 45 additional days), we will notify you of the extension and the reason for it. We will not discriminate against you for exercising your privacy rights.

To protect your privacy and security, we may require you to verify your identity before fulfilling your request. We will use reasonable measures to verify identity, such as confirming your registered phone number.

10. Push Notifications

With your permission, we send push notifications to your device for:

• Church announcements and ministry news
• Upcoming events and calendar updates
• Prayer request activity (subject to your privacy settings)
• New visitor notifications (for designated ministry team members and administrators only)
• Weekly worship and sermon updates

You may opt out of push notifications at any time by:

• Adjusting notification settings in your device's system settings (iOS: Settings → Notifications → Good Church; Android: Settings → Apps → Good Church → Notifications)
• Adjusting notification preferences within the App (More → Settings)

Disabling push notifications does not delete your account or affect your ability to use other features of the App.

11. International Users

Our services are operated in the United States. If you access our App or Site from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using our services, you consent to this transfer and processing.

For users who are nationals of the Republic of Korea, we note that your information is processed in the United States and is subject to U.S. law. We process your data solely for the purposes described in this Policy and do not transfer your data to any third party beyond the service providers listed in Section 5.

12. Account Deletion

You may request deletion of your account at any time by:

• Contacting us at goodchurchhouston@gmail.com with subject "Account Deletion Request"
• Calling us at 832-296-3141

Upon a verified deletion request, we will:

1. Remove your account from the App within 7 business days
2. Delete all personally identifiable information from our active databases within 30 days
3. Remove your push notification token immediately upon request
4. Retain donation records for 7 years as required by IRS regulations (anonymized where possible)
5. Retain prayer request content for up to 30 days in backup systems before permanent deletion

Note: Deletion of your account will remove your access to all App features, including ministry team content, announcements, and church calendar.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send a push notification to App users announcing the update
• Require re-acknowledgment within the App for changes that significantly affect how we process sensitive data

Your continued use of the App or Site after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must discontinue use and may request account deletion as described in Section 12.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: