What we collect
We process account email addresses, securely generated password hashes (never readable account passwords), church workspace details, bulletin content, collaborator names and emails, files you upload, payment-account references supplied by Stripe, optional connect-card and RSVP responses, and basic security logs. When advertising measurement is enabled, Google may process an advertising click identifier, cookies and limited browser or device information as described below. Contributors and public readers do not need an account.
How we use information
Information is used to create, save, review, deliver and publish bulletins; authenticate users; send requested notices; give the church responses it deliberately collects; measure whether an advertisement led to a trial or collected payment; report aggregate bulletin use; provide support; prevent abuse; and meet legal obligations. We do not sell personal information.
Advertising measurement
The Google tag is not loaded unless you explicitly choose “Accept measurement.” If you choose “Continue without measurement,” no Google advertising tag is loaded and every site feature remains available. We save this choice in first-party browser storage and a first-party preference cookie for up to one year so we can respect it on later visits. You can review or change the choice from “Advertising choices” in the site footer; declining after previously accepting applies a denied consent state immediately and prevents the tag from loading on later pages.
After acceptance, the Google tag helps us understand whether a visit from a Google advertisement later results in a verified trial start or the first successful subscription payment. Google may read or set advertising-measurement cookies and receive a click identifier plus limited technical request information under Google’s own terms. Browser privacy settings or content blockers may prevent this measurement.
We do not send Google bulletin content, church names, denomination or tradition choices, contributor information, account email addresses, uploaded files or other customer-provided content. Enhanced conversions and customer-data hashing are not used. Ad-personalization and ad-user-data signals remain denied, Google Signals is disabled, and restricted data processing remains enabled. A trial is reported only after a signed Stripe checkout event and carries a value of zero. A paid conversion is reported only after Stripe confirms the first positive invoice, using its actual currency and collected amount plus an opaque transaction ID to prevent duplicate counting. Renewals are not reported as new customer acquisitions.
Optional AI and voice tools
No bulletin content is sent to an AI provider until a user invokes a tool and confirms the request. A writing or translation request may include the selected section, instructions, fact fields, bulletin title, date and tradition context; transcription sends the selected audio; an AI-assisted import may send rendered pages and extracted text from the file the user chose. The page-arrangement tool sends only structure and layout measurements—not section wording, church identity, dates, contact details or image files. Protected section types are excluded where appropriate. Provider processing is also governed by that provider’s terms. Users must not submit confidential pastoral records or information they are not permitted to process. AI output and imported candidates require human review.
Public bulletin analytics and reader tools
Published mobile bulletins record aggregate events such as views, QR opens, link clicks, PDF downloads and sponsor-section views. We do not store raw reader IP addresses, user-agent strings or destination URLs for analytics. A daily rotating keyed hash limits duplicate counts and cannot follow a reader across days. Sermon notes stay only in that reader’s browser. Optional connect-card and RSVP responses are sent to the church workspace only after consent.
Private contributor links
Contribution links are bearer credentials: anyone holding a link may be able to open its scoped task until it expires or is revoked. Links should not be forwarded or posted publicly. Organizers can revoke and reissue access.
Storage and retention
Workspace content and operational records are retained while needed to provide and secure the service. Imported source files are scheduled for deletion after 30 days, reader responses after 45 days and aggregate analytics events after 400 days. Access tokens expire and can be revoked, but related security, billing, advertising-measurement or submission records may remain until deleted under an applicable operational or legal process. Uploaded image metadata is removed where supported. Payment card details are handled by Stripe and are not stored by this application.
Your choices
Workspace owners may delete reader responses in the workspace and may request access, correction, export or deletion by emailing churchbulletinsoftware@gmail.com. You may continue without advertising measurement when the choice banner appears and may reopen that choice from the site footer. Browser settings and Google’s advertising controls can also limit advertising cookies. Some records may be retained where required for security, billing or legal compliance.
Security and children
We use encrypted transport, one-way password hashing, scoped access, hashed recovery and session tokens, and least-privilege application controls. Password recovery links expire, can be used once and invalidate older sessions when a password is changed. No online system can promise absolute security. Churches must obtain appropriate consent before publishing names or images of minors and should avoid sensitive prayer or pastoral details unless permission is documented.
Changes and contact
Material changes will be dated on this page. Questions may be sent to churchbulletinsoftware@gmail.com.