Privacy Policy

Overview

Servant's Heart ("we," "us," or "the app") is a church service-planning and volunteer-scheduling tool, owned and operated by JSOUNDS4U LLC, a California company, known publicly as the Servant's Heart Team, and developed by B.B.O.V. Industries. Churches use it to build their order of service, schedule volunteers, track availability, and communicate with their team. This policy explains what information we collect, how we use it, and the choices you have.

We built Servant's Heart to serve churches and their volunteers, not to profit from your data. We do not sell your personal information, and we do not use it for advertising.

Using Servant's Heart is also covered by our Terms of Use.

Read the Terms of Use

Information we collect

We collect only what the app needs to work:

• Account information: your name, email address, and (optionally) phone number, used to sign you in and identify you to your church team.
• Church directory records: your church may keep a directory entry about you — your name, email address, phone number, the household you belong to, your date of birth and notes the church writes — including for people who do not have an app account, and for children. Your church decides what goes in its directory; we store it for the church. If your church added you, ask your church to change or remove your entry, or write to us and we will pass your request on.
• Church membership: the church (organization) you belong to and your role in it — for example member, volunteer, planner or admin.
• Scheduling information: your position assignments, your responses to them, and any availability or unavailability you enter.
• Team communication: messages you send in the app's chat, and notifications you receive.
• Push notification tokens: a device identifier we use to deliver push notifications, if you enable them.
• Basic technical data: information needed to keep the service secure and working, such as sign-in activity, IP address, device type and app version, which our hosting and update providers record in their logs.
• Family (household) information: if you or another adult in your family sets up a family in the app, we store the family's name, its address if one is entered, which directory entries belong to it, and who last changed it. When you accept an invitation to a family, the app may ask you to confirm that an existing directory entry in that family is yours before linking it to your account; it never links one without asking.
• Children's records: a parent or guardian, or the church, may add a child to a family. For a child added by a parent or guardian, we store the child's name, their date of birth if given, and who last changed the record. The church may also add contact details or notes to a child's entry. Parents never see those notes. A young person may have their own account. If the church marks their directory entry as a child, the app treats them as a child: they can't start or join a family themselves. Everything recorded about a child's entry is entered by an adult.
• Children's check-in: if your church uses kids check-in, we store, for each child, the allergies and medical or care notes that the church enters on its website, whether the child has an allergy, a history of changes to those details and who made them, a photo of the child if a parent or carer in the child's family adds one, or the church adds one with a parent's or guardian's agreement, and a record of each check-in: the service and room, times, who brought the child, who collected them, which member of the church's team checked the child in and out, and any release made without a pickup code. Health details are entered by your church on the web; the app only displays them.
• Guardians, pickups and restrictions: a church's kids leaders and admins may record which adults are a child's guardians — either linked to the adult's app account, after another leader has seen the account's sign-in email (no one can add themselves), or to the adult's directory entry — and whether each may check the child in; for each child, other people allowed to collect them, with their name, relationship, phone number, email address and photo; and, for each child, people who must not collect them or have any guardian access. A restriction is recorded against a person's app account or directory entry, or as a name the church types, together with a name shown to the kids team and any email addresses the church knows for that person. Only the account or directory entry the church names is blocked. When an account joins the church, or a directory entry is linked to an account (including when an archived entry that is linked to it is restored), the app compares the account's names and email addresses with the church's restrictions; if they look like a restricted person, the account is held back from the kids team and from being added as that child's guardian — and, if the account belongs to a kids leader or admin, from all kids check-in records and tools in that church — and the church's kids leaders and admins are told at once that an account was paused and why, and are asked to decide whether to keep that person out of kids or let them back in. The church appoints its own kids team and is responsible for reviewing every hold: the app only pauses the account until the church decides, and records the church's decision, which leader or admin made it, and when. The hold, and its later confirmation or clearing, are logged. The person concerned is not told, with these limits: a kids leader or admin who is restricted for any child in the church, or held for review, is shown the same "not a kids leader" message as anyone without kids access, which they may notice differs from their role; an admin who is held for review is told on the review page that they are on hold, that another admin must review it, and that if they are the church's only admin they should first make someone else an admin; and an admin keeps the church's kids settings (the department, the retention period and the on/off switch), which hold no information about children. Their own access as a parent to their own children is not affected by a review hold. A directory entry that a restriction names cannot be linked to anyone's app account while the restriction exists; when someone joins with that entry's email address, they get a new entry and are held for review. An account that was already linked to that entry when the church named it on a restriction is held back in the same way until the church changes or removes the restriction. A hold is removed by another admin when it concerns an admin's account, and by a kids leader or admin for anyone else. When a hold is cleared, or a person is taken off a restriction, the sign-in email address of their account and the email addresses on every directory entry that was linked to their account in that church are removed from that restriction, except an address that is also the email address of the directory entry the restriction names; the restriction keeps the directory entry it names and that entry's email address, the name shown to the kids team (until a leader edits it), any other people it names, and any other email addresses the church recorded or typed; and the log no longer shows them the entries about themselves. A leader or admin may still see, on a restriction, an email address the church typed that happens to be their own. A person who shares a restricted person's name or email address may therefore be held back from the kids team until a leader reviews it. Changes to guardians, pickups and restrictions are logged with who made them, and the church's kids leaders and admins are told about every change a leader makes; when a guardian's access ends because they left the church or deleted their account, that is logged but not announced; when the church links a guardian's account to a different directory entry, the photo shown for that guardian changes to the new entry's, the leaders and admins are told so they can check it, and the guardian's recorded identity changes only if a leader re-confirms them. Changes to the church's kids check-in settings, including how long records are kept, are logged and announced to the kids leaders and admins; only a leader or admin who is not restricted may shorten how long records are kept. These are entered on the church's website, not in the app. Visiting families who are checked in as guests have no guardian or restriction list.
• Photos for kids check-in: if your church uses kids check-in, you can add, replace or remove a photo of yourself, and any adult in your family on Servant's Heart can add, replace or remove a photo of each child in your family, on the Family page of our website. Before you add a child's photo you confirm that you are a parent or carer in the family and agree that the church's kids team may see it. We store the photo, who added it, whether it came from your family or from the church, and when. To stop photos being changed too often, a family member can make up to 10 photo changes a day; we keep a note of when each change was made for two days. We remove location and camera details from every photo before we store it. We also keep a small copy of each photo in our database so the kids team's screen can show it at once. The church's kids leaders and admins can also add, replace or remove any of these photos. When they or another adult in your family change one, the adults in your family are told in the app (without anyone's name), unless the photo is of a directory entry the church has archived; a change to a child's photo is written in the child's check-in log, and the church's kids leaders and admins are told when a family replaces or removes a photo the church added. A child's guardians who live in another family can see the child's photo but are not told about changes. An adult the church has recorded as not allowed to collect a child in their own family cannot add, change or see the photos of that family, including their own, and is not told about changes; the church manages those photos. A review of an account (a hold) does not affect photos. Photos of the other people allowed to collect a child are added only by the church. A church planner who adds their own directory entry to a family can manage that family's photos like any adult of the family; churches choose their planners.
• Pickup codes: a pickup code exists only while a guardian is collecting. It is created when they tap Pick up in the app, lasts 15 minutes, works once, and is recorded against the guardian who asked for it. For a visiting family without the app, the church's team is shown a pickup code for that visit.

How we use your information

• To provide the core service — showing your schedule, order of service, availability, and team communications.
• To send notifications about your assignments, schedule changes, and messages (when you enable them).
• To keep your account and your church's data secure.
• To respond to your support requests.

How your information is shared

Anyone can create an account, but an account on its own does not let you see any church. You only see a church's information after that church admits you, for example through an invite, a QR code or a join link from that church.

Inside the app, your information is shown only to people in your own church, according to their role, and to family members as described below. A small number of our own team can see church data when they need to, to support churches and keep the service running. For example, planners and admins in your church can see your name, assignments, and availability so they can schedule your team. Members cannot see the data of other churches.

Within a family, the adults in your family can see each other's name, email address and phone number as held in the church directory, whether each has the app, the family's name and address, and the names and dates of birth of the children in the family. This includes the directory entries of family members the church typed in who do not have an app account, entries the church has archived but not removed, and the entry of an adult who has since left the church, which keeps the email address and phone number it held. Anyone whose directory entry the church itself places in that family can see the same.

To invite someone, an adult in a family can look up fellow members of the same church by name; nothing else about them is shown. The app tells you this before you start a family, send an invitation, or accept one. Adults in a family cannot see each other's date of birth or any notes the church keeps. Planners and admins of your church can see every directory entry and family in their church, as part of running it.

Kids check-in information is visible to the church's admins and to the leaders of the department that runs check-in, except that a leader or admin who is themselves restricted for any child in the church, or held for review against any restriction there, cannot see any child's kids check-in records in that church or hear about changes to them (apart from their own children, as a parent), and — only while a check-in session is open — to the volunteers the church has scheduled to serve in that department that day: for any child on that session's list (checked in, waiting to be confirmed, already collected, or a cancelled or expired pre-check), their name, date of birth, photo, room, allergies and notes, the record of who brought them, their guardians and approved pickup people with photos, phone numbers and relationship, and the people not allowed to collect them; and, by name search, the names of the church's children and their families. Those volunteers see each child's guardians and other approved pickup people with their photos and phone numbers, so they can recognise and call them. Kids leaders and admins see the sign-in email address of adults they consider adding as guardians or restricting, and of anyone held for review against a restriction, so they can be sure they have the right account. A child's guardians who use the app can see the names of the child's other guardians, the people allowed to collect the child, and the people who must not collect the child. At an open session, volunteers can look up any child in the church's directory by typing at least three letters of the child's name or the family's name; a search shows at most five families, with the children's and family's names and whether each child is checked in or waiting at an open session. A child's allergies and notes are entered and changed only by the church's kids leaders and admins on the church's website; the guardians the church has linked to an app account can see them in the app, unless that person is restricted for that child. A photo of a person is also shown to that person, to the adults in their family on Servant's Heart, and, for a child, to the child's guardians who use the app; the kids team's screen says whether each photo came from the family or from the church. Photos are stored privately and shown to these people through links that expire after five minutes. Check-in notifications sent to phones never include anyone's name.

We use a small number of trusted service providers to run the app, who process data only on our behalf. Each provider handles your data only to run the app for us, under terms that protect it at least as well as this policy does. They are:

• Supabase — our database and sign-in provider, which stores your account and church data.
• Resend — sends our emails, such as invitations and account emails.
• Expo — delivers app updates and push notifications, handing notifications to Apple and Google for delivery to your device.
• Vercel — hosts our website and keeps its request logs.
• Cloudflare and Google — run our hello@servantsheart.app mailbox.

Photos

A parent or carer, or the church, may add a photo of a child, or of an adult who drops off or collects children. We use these photos for one purpose: so your church's kids team can recognise the right child and the right adult at check-in and pickup. They are seen only by the person in the photo, the adults in that family, a child's guardians who use the app, and your church's kids leaders, admins and the volunteers serving at check-in that day. We store them privately, remove location and camera details from the file, and show them through links that expire after a few minutes. We do not sell them, use them for advertising, share them outside your church, or use them for face recognition: the photo is cropped by hand by the person who adds it, and nothing matches faces.

Deleting your account removes the photo of you at the churches you still belong to, whoever added it. A photo of you at a church you left earlier stays until it is removed. Photos you added of your children stay with your children's records. If the church added you, with a photo, to a child's list of other people allowed to collect them, that entry and its photo belong to the church's pickup list and stay until the church removes them. A family or the church can replace or remove a photo at any time.

Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the service. When a church stops using Servant's Heart, its associated data may be removed.

Directory, family and children's records stay until the church removes them or the church is closed. Closing a church deletes everything in it. Records kept after you delete your account (see below) stay as long as the church uses Servant's Heart. Family invitations that were replaced by another are deleted after 14 days, and the family-invitation activity log after 31 days.

If you start creating an account but never confirm your email address, the unconfirmed account is deleted automatically after 7 days.

Notifications in your in-app inbox are kept for a limited time and then deleted automatically: chat notifications for 30 days, and all other notifications for 180 days. This does not delete the chat messages, rosters or prayer requests themselves — only the notification entry in your inbox.

If you register for a church event through a public link or QR code without an account, we keep the name, email address and phone number you give us only so the church can manage that event. These guest registrations are deleted automatically 30 days after the event, unless you ticked "keep my details" when you registered, in which case they are deleted 12 months after the event. You can cancel a registration at any time from the link in your confirmation email.

If you sign up to serve or to bring something for an event, that sign-up and any note you add are part of your registration: they are deleted when you cancel the registration and whenever the registration itself is deleted.

Check-in records, the notes and names recorded on them, pickup codes, the history of changes to a child's health details, and the log of changes to guardians, pickups and restrictions are deleted automatically after the period the church sets, between 3 and 84 months (12 months unless the church changes it). Check-in notifications on your phone are deleted after 180 days. Technical notes our automatic clean-up writes when one of its runs fails are deleted after 90 days; if a run keeps failing, records due for deletion are deleted once we fix it. A child's current health details, guardians, pickups and restrictions are kept until the church removes them or closes its account; a child's photo is kept until an adult in the child's family or the church removes it, or the church closes its account. A review hold is kept until a leader or admin confirms or clears it, the restriction is lifted, the church closes its account, or the account it concerns is deleted; it is kept if that person leaves the church, so the review is still waiting if they rejoin. When a hold is cleared, a record that it was cleared, with who cleared it and when, is kept for as long as the restriction exists in its current form, so the same person is not held again for the same restriction; it is deleted when the church changes who or which email addresses the restriction names, when the restriction is lifted, when the church closes its account, or when that person's account is deleted; a child's directory entry that has check-in records is archived rather than deleted, and keeps those records. A photo stays with the person it shows, not with the person who added it, so a child's photo stays if the parent who added it leaves the family or the church or deletes their account. When a photo is replaced or removed on our website, by your family or by the church, we delete the file. When a photo's record is removed any other way (for example when a church closes or an account is deleted), the file can no longer be reached by anyone. We also check our private storage for leftover files from time to time and delete them.

Separately from the in-app controls described below, you may request access to, correction of, or deletion of your personal information at any time by contacting us at the address below, and we will respond.

Deleting your account

You can delete your account yourself, at any time, from Account → Delete my account in the mobile app or on the web. You will be asked for your password to confirm. Deletion is permanent and we cannot undo it or recover the account afterwards. Our backups keep a copy of the database for up to 30 days, then that copy is overwritten. Deleted information disappears from backups on that schedule.

Deleting your account removes your login and password, so you can no longer sign in; your name, phone number and profile; your membership of every church you belong to; anything you are rostered for from the following day onwards; the dates you had marked yourself unavailable and the positions you were tagged for; your notifications and notification settings; your personal calendar subscription link; and any unused invitation sent to your email address.

Some information is kept because it belongs to your church rather than to you. Your serving history — the record of who served on which date, including anything scheduled for that same day — is kept, as are the messages you sent in your team's chats and anything you wrote in prayer requests, so those conversations still read properly for the people still in them. Your name is replaced with "Former member" in rosters, chats, prayer requests and your church team's notifications at the churches you currently belong to. Your church's directory entry is the exception, below.

One exception is worth stating plainly: your church's own directory entry for you — the name your church typed into its member list, and any notes it wrote there — is kept, and is no longer linked to your account. That record belongs to the church, not to us, so we do not delete it on your behalf. At the churches you are currently a member of, we clear the contact details on that entry: email address, phone number and date of birth. A church you have already left, or been removed from, keeps the entry it holds, because deleting your account no longer gives us a reliable way to tell which entry is yours. In either case, ask an admin at that church if you would like the entry itself removed, or write to us and we will help.

If you are the only admin of a church, we will ask you to deal with that church first, so it is not left with nobody able to manage it. You will be shown two options in the app: make one of your other members an admin, in which case the church carries on without you; or close the church yourself, which you confirm by typing its name exactly. Closing a church permanently deletes it and everything in it — its services, rosters, chats, prayer requests and directory — for every member, and we cannot undo it; the other members keep their own accounts and any other church they belong to. If neither option is right for your situation, email hello@servantsheart.app and we will help.

You can also leave a single church without deleting your account, from the same screen. That removes you from that church only and leaves your account, and any other church you belong to, untouched. Your serving history and messages there are kept as the church's record, but they no longer show your name to the people still in that church; if you rejoin later, your name reappears on them.

If your church organises its teams into departments, the departments you belong to and any request you have made to join one are deleted when you leave that church, are removed from it, or delete your account.

If you are in a family in the app, deleting your account or leaving a church takes you out of that family's app features but does not delete the family, its address, or any children recorded in it: those records belong to the church and the other adults in the family. Deleting your account clears the email address, phone number and date of birth on your directory entry at churches you still belong to; leaving a church does not. If you delete your account, invitations sent to you are deleted, and the ones you sent are cancelled and no longer show your name. If you leave a church, invitations there are cancelled.

Deleting your account removes the link between your account and any kids check-in records and ends any guardian access you had, but the church keeps the names written on those records until its retention period ends, because they are part of how the church keeps children safe. That includes your name as a member of the kids team who checked a child in or out or changed guardians, pickups or restrictions, and your name as a guardian or other adult who brought a child, collected a child, or held a pickup code, and as a leader who changed a child's health details. At the churches you still belong to, a photo of you is deleted, whoever added it; a photo of you at a church you left earlier stays until it is removed, and a photo of you on a child's list of people allowed to collect them stays until the church removes it. Any pickup code you hold stops working at once. Photos you added of your children stay with your children's records until your family or the church removes them. Leaving a church ends your guardian access in that church in the same way, but a review hold on your account in that church stays until the church reviews it. A restriction a church recorded naming you, including your email address, stays in force; when you delete your account, any review hold on it is deleted, and the log entry that recorded the hold keeps the name it was written with until the church's retention period ends.

Step-by-step: how to delete your account

Security

We protect your data with industry-standard measures, including encryption in transit and database-level access controls that restrict each user to the data their role permits. Access to production data is limited to the founders. No system is perfectly secure, but we work to safeguard your information and limit access to it.

Children's privacy

We do not decide who downloads or uses Servant's Heart; for a young person, that decision belongs to their parents or guardians and their church. Servant's Heart is not designed for children, and we do not knowingly let children under 13 create an account or give us personal information themselves.

A parent or guardian in the child's family, or the church, may record a child's name and, if given, date of birth in the church directory so the church can serve that family, for example for children's ministry. The app treats anyone the church lists as a child as a child: they cannot start or join a family themselves. A child's record is never used for advertising and never sold.

A child's record is visible to the adults in the child's family, to anyone whose directory entry the church places in that family, and to the church's planners and admins. While a check-in session is open, the church's kids team can also see the child's name and family name, and whether the child is checked in, by name search, and the details listed under kids check-in once the child is on a session's list. The app's family notifications never include a child's name and are never emailed. An adult in the child's family can correct the child's name or date of birth in the app or on our website; to remove a child's record, ask your church (a planner or admin can remove it), or contact us.

Everything recorded about a child for kids check-in is entered by the church, except a child's photo, which an adult in the child's family may add or replace; a child's health details are entered by the church on its website. Kids check-in gives no access to any account that the church lists as a child: such an account cannot act as a guardian or as a member of the kids team. Health information about a child is used only to keep the child safe during the church's children's activities; it is never used for advertising, never sold, and never sent by email.

If you believe a child is using Servant's Heart, or a child's information is held, without a parent's or guardian's knowledge, tell a leader at the church first, then contact us at the address below. We will help remove the account or the information.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page. If we make a significant change, such as a new use of family or children's information, we will tell you in the app or by email before it takes effect. Continued use of the app after an update means you accept the revised policy.

Contact us

If you have any questions about this policy or your information, contact us at hello@servantsheart.app.