Privacy Policy

1. What We Collect

Church & Account Information

When you create an account, we collect information about your church and the administrators who manage it: church name, address, website, and the name and email address of account administrators.

Staff & Team Member Information

When you add ministry leaders or staff members to your account, we collect their names and email addresses (and optionally phone numbers for SMS notifications).

Volunteer & Guest Information

When your volunteers or guests fill out intake forms, we collect the information they submit — typically name, email, phone number, and whatever fields your church has configured. This data belongs to your church (see Section 6).

Usage Data

We collect basic usage information — pages visited, actions taken, error logs — to help us improve the product and diagnose issues. This data is not sold or shared with advertisers.

Launch Waitlist

If you join our launch waitlist on this website, we collect the details described in Section 15.

2. Cookies

We use session cookies to keep you logged in while you use Shepherds Inbox.

Google Analytics on our website. Our marketing website (shepherdsinbox.com) uses Google Analytics to understand, in total, how people find and use the site. It records which pages you view, how you arrived (for example from a search or a link), your device and browser type, your approximate location (country or city), and when you visit. To do this, Google Analytics sets cookies in your browser (named _ga and _ga_<ID>) that tell repeat visits apart from new ones. Google receives your IP address to provide the service but Google Analytics does not store it. We see only totals, not who you are. We don’t send Google your name, email address or anything you type into the waitlist form, and we have turned off Google’s advertising features for our website.

Opting out. You can block or delete these cookies in your browser settings, or install Google’s Google Analytics opt-out browser add-on. The website works the same either way. Learn more about how Google uses information from sites that use its services.

The spam check on the waitlist form (Cloudflare Turnstile) may use similar technologies only to tell people from bots. We do not sell your data, and we do not use your church’s volunteer or guest information for advertising.

3. How We Use Your Data

We use the information we collect to:

• Operate and improve Shepherds Inbox
• Send email and SMS notifications you or your church have requested
• Process payments and manage your subscription
• Provide customer support
• Comply with legal obligations

We do not sell your data. We do not use your church’s volunteer or guest information for any purpose other than delivering the service to you.

4. Email Communications

We send transactional emails related to your account — signup confirmations, volunteer and guest notifications, password resets, and subscription receipts. We may occasionally send product announcements or updates. You can opt out of non-transactional emails at any time via the unsubscribe link included in every email.

5. SMS / Text Messages

Shepherds Inbox can send SMS notifications to church staff and ministry leaders. These messages are strictly operational — new volunteer applications, new guest submissions, follow-up reminders.

Consent & opt-out: Users or their church administrators opt in to receive SMS notifications through their account notification preferences. Users can opt out at any time by changing their notification preference to email-only in their account settings, or by replying STOP to any text message.

SMS messaging is provided via Twilio. Standard message and data rates from your carrier may apply. We do not send marketing texts.

No sharing of SMS consent or phone numbers. Mobile phone numbers and SMS opt-in consent are not shared with third parties or affiliates for marketing or promotional purposes. Phone numbers collected for SMS notifications are used solely to deliver the messages described above, via Twilio as our delivery provider. This restriction applies in addition to the general data-sharing limits described in Section 8.

6. Data Ownership

Your church owns its data. Volunteer records, guest records, ministry configurations, and communication history belong to you. We are a processor acting on your behalf — not an owner of your congregation’s information. You can export or delete your data at any time (see Section 9).

7. Data Storage & Infrastructure

Shepherds Inbox is hosted on the following infrastructure:

• Application servers: Fly.io (Dallas, TX region). Your data stays within the United States.
• Database: Supabase (PostgreSQL). Data is encrypted at rest and in transit.
• CDN / DDoS protection: Cloudflare. Traffic to shepherdsinbox.com routes through Cloudflare’s network for performance and security.
• Website and launch waitlist: Cloudflare hosts this marketing website, and waitlist sign-ups are stored in a Cloudflare database (see Section 15).

8. Third-Party Services

Note: SMS opt-in data and phone numbers are never shared with third parties for marketing purposes, including with the providers listed below.

We work with a small number of trusted third-party providers to deliver the service:

Resend

Transactional email delivery (volunteer notifications, welcome emails, account emails, and waitlist emails). Resend receives recipient email addresses and message content only as necessary to deliver messages.

Twilio

SMS delivery for staff notification messages. Twilio receives phone numbers and message content only as needed to deliver those messages.

Stripe

Payment processing for subscriptions. Stripe handles all credit card data — we never store payment card details ourselves. Stripe’s privacy policy governs your payment information.

Google Analytics

Website analytics for shepherdsinbox.com only (see Section 2). Google receives the page visit details described there. It is not used in the Shepherds Inbox app and never receives your church’s data.

Cloudflare

CDN, DDoS protection, and DNS; hosting for this website and the waitlist list; and the Turnstile spam check on the waitlist form. Web traffic passes through Cloudflare’s network. Cloudflare may log IP addresses and request metadata per their privacy policy.

We do not share your data with these providers beyond what is required to deliver the service, and we do not permit them to use your data for their own marketing purposes.

9. Your Rights

You have the right to:

• Access the data we hold about you or your church’s account
• Correct inaccurate information in your account
• Export your church’s data at any time from your account settings
• Delete your account and all associated data by contacting us at [email protected]
• Opt out of non-transactional email communications at any time
• Opt out of SMS by replying STOP to any text or changing your notification preferences

To exercise any of these rights, contact us at [email protected]. We’ll respond within 30 days.

10. Data Retention

We retain your account data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days in case you want to reactivate, then permanently delete it. You can request immediate deletion at any time by contacting support. Anonymized usage statistics may be retained indefinitely.

11. Security

We use industry-standard practices to protect your data: TLS encryption for all data in transit, encryption at rest in our database, access controls limiting who on our team can access production data, and regular security reviews. No system is perfectly secure, but we take these responsibilities seriously.

12. Children’s Privacy

Shepherds Inbox is a platform for church administrators, staff, and adult volunteers. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has submitted personal information to us, please contact us at [email protected] and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll notify account administrators via email at least 14 days before the changes take effect. Continued use of Shepherds Inbox after that date constitutes acceptance of the updated policy. The current version is always available at shepherdsinbox.com/privacy.

14. Contact

Questions about this policy? Reach us at:

Steward HQ LLC
San Antonio, TX
[email protected]
shepherdsinbox.com

15. Launch Waitlist

Before Shepherds Inbox opens to new churches, you can join a waitlist on this website. Joining doesn’t create an account.

What we collect

• Your name, email address and church name, and your church’s size if you choose to give it
• Which page or website you came from, the date you joined, and your browser type
• A scrambled (one-way hashed) form of your IP address, used only to spot spam. We don’t store the IP address itself.

The form uses Cloudflare Turnstile to check that you’re a person, not a bot. Cloudflare processes the signals it needs for that check under its own privacy policy; we only receive a pass or fail.

Why

We use your details only to tell you about our launch: a confirmation that you’re on the list, then emails about Shepherds Inbox opening to new churches. Our team gets an email when someone joins so we can see who is interested. Every email has an unsubscribe link.

Where it’s stored

Waitlist sign-ups are stored in a database hosted by Cloudflare. Emails are sent through Resend. Only our team at Steward HQ LLC can see the list.

How long we keep it, and deleting your details

We keep your waitlist details until you unsubscribe or ask us to delete them, and we delete the whole waitlist 12 months after Shepherds Inbox opens to new churches. Unsubscribing from any waitlist email removes you from the list right away. You can also ask us to delete your details at any time by emailing [email protected]; we’ll do it within 30 days and confirm.

No selling

We never sell your details or share them with anyone for their own marketing.