Legal

Privacy Policy

Last updated: October 5, 2026

1. Who is responsible for your data

The controller ("responsável" / "controlador") of the personal data described here is Willian Gutnik, trading as FaithFlow, contact hello@getfaithflow.com. Where a church uses FaithFlow, the church decides what content it keeps; FaithFlow does not hold that content (see section 4).

In short: we collect what is needed to run your account, plan and licence; we use a few well-known providers to do it; we do not sell your data, we show no advertising and we use no analytics cookies or tracking on the website or account pages; the desktop app sends anonymous usage statistics only if you turn them on (they are off until you say yes); your church's services, songs, slides and media stay on your computers and in your own Google Drive.

2. What we collect and why

  • Account: your name, email address and sign-in details (a salted password hash, or your Google identity if you sign in with Google), your language, and optional organization and ministry names. Why: to create and secure your account and sign you in. Basis: contract (providing the Service) and our legitimate interest in security.
  • Plan and licensing: your plan and its status, the dates of the paid period, and the computers you activate (a device name you give, the platform such as macOS or Windows, a hashed device fingerprint, when it was activated, last seen and revoked). Why: to apply your plan and enforce computer limits, and to sign the entitlement the app uses offline. Basis: contract and legitimate interest (preventing misuse).
  • Billing: handled by Stripe. We receive and keep your Stripe customer and subscription identifiers, plan, status, period dates and refund or failed-payment markers; we never receive your full card number. Why: to bill you and apply the plan. Basis: contract; legal obligation for invoices and tax records.
  • Team members: if you invite people, the invited person's email address, the role and the church or campus the role applies to, and when they were invited and joined. Why: to send the invitation and let them sign in. Basis: contract with the inviting organization and legitimate interest. See the Team members section.
  • Security and technical data: your account's sign-in sessions (device, browser and approximate location as reported by our authentication provider, used for sign-in alerts), and short-lived rate-limit counters. Our own functions run with request logging off. Why: security and abuse prevention. Basis: legitimate interest.
  • Google data if you use Google features: see Google user data below.
  • Updates and downloads: the app checks our update feed for new versions; the request carries the app version, operating system and architecture, and no account information or tracking identifier. We do not keep a log of who downloaded or updated.
  • Anonymous usage statistics (only if you turn them on): see Usage statistics below. Off until you say yes; you can turn them off, reset the random install number or delete what was sent at any time in the app (Settings → Privacy).
  • Email preferences and support: product-news choice and the time you made it, and the messages you send us for support.
  • Early-access sign-ups on our website: the email (and any note) you submit to join the list.

We do not run advertising or behavioural tracking, and we use no analytics cookies on the website or the account pages; we set only the cookies and storage needed to keep you signed in and remember your language. The desktop app has one optional, opt-in feature that sends anonymous usage counts, described in Usage statistics below; it is off until you choose to turn it on.

Usage statistics

The desktop app asks once (and you can change it any time in Settings → Privacy) whether to share anonymous usage statistics. It is off until you say yes; "Ask me later" or closing the question keeps it off. If you turn it on, the app sends one small report per day, never while a service is live, containing only:

  • a random install number created on your computer when you say yes (not tied to your account, email, computer hardware or licence; you can replace it with a new one at any time; reports already sent under the old number are then no longer linked to you and expire after 400 days, so use Delete my usage data first if you want them removed);
  • the date (UTC) the counts belong to, the app version, the operating system (macOS, Windows or Linux) and your plan (Free, Starter, Plus, Pro or Developer, or none, never your email);
  • counts only: how many times the app was opened, how many times a service went live and for how many minutes, how many slides were shown by type (song, Scripture, presentation, media, other), the most screens open at once, and how many times a few features were used (stage display, phone remote, backup, Companion autopilot, Companion voice, timers, import, sync folder).

It never contains song, slide or sermon text, titles, file or folder names, people's or church names, email addresses, account identifiers, audio, recordings or transcripts. The app shows the exact report before it is sent ("View what would be sent"). Our server refuses any report with other fields and never stores your IP address with a report; our hosting provider records the IP address of each request in a short technical record, which we delete automatically within about an hour. We keep each report for 400 days, after which it is deleted automatically. Purpose: to understand how FaithFlow is used (for example how many installs are active and which features matter) so we can improve it. Basis: your consent, which you can withdraw at any time by turning the switch off; Delete my usage data in Settings → Privacy deletes every report sent under your current install number from our server. Reports are stored with our backend provider (Appwrite Cloud, United States).

3. What we do not collect

We do not collect your church's services, songs, lyrics, slides, media, Library, notes or files. We do not receive your microphone audio or your voice. We do not sell personal data, we do not use it for advertising, and we do not use it to train artificial-intelligence models.

4. What stays on your computers and in your Google Drive

  • Your services, songs, slides, media, settings and the local database live on your computers. The app works without an internet connection.
  • Backups are created locally on your computer (and, if you choose, in a folder you pick; protected backups use a password you set). We never receive them.
  • CCLI and other reports are generated on your computer from your local data. We do not receive them.
  • Companion voice control (wake word and spoken commands) is processed locally on your computer by a speech model that runs on the device; audio is not sent to us or to any cloud. If you turn on optional AI help by adding your own OpenRouter key, the app sends only the text you or the Companion choose to your own OpenRouter account, which handles it under OpenRouter's terms; FaithFlow never sees the key's traffic or its content, and the feature is off by default.
  • Cloud sync and Google Drive folders: content moves directly between your computers and your own Google Drive; it does not pass through or get stored on our servers. We keep only the registry needed to find the folder (folder identifier, label, who connected it).

5. Service providers and who sees your data

We share data only with the providers that run the Service, under contracts that limit their use of it:

  • Appwrite Cloud (Appwrite Ltd. and its infrastructure): hosts accounts, authentication and our backend functions and database. Data region: United States (San Francisco, "sfo").
  • Stripe, Inc. / Stripe Payments Europe: payments, invoices and receipts. Stripe is an independent controller for payment and fraud data.
  • Resend: delivers our emails (sign-in codes, verification, password resets, security alerts, invitations, notices and, only if you opt in, product news).
  • Google: if you sign in with Google or connect Google Drive. Google's own terms and privacy policy apply to your Google account and Drive.
  • OpenRouter: only if you add your own key to the optional AI help, as your own account and not ours.
  • Hosting for the website and the update feed, and the code host for releases, as our infrastructure providers.
  • Professional advisers, authorities and courts where the law requires, and a successor if the business is sold (we will tell you).

Members of the same organization can see each other's name, email address, role and place (see Team members). We do not show them to other organizations.

6. International transfers

We and our providers process data in the United States and possibly other countries, which may differ from the data-protection laws where you live. Where required we rely on appropriate safeguards, such as the EU Standard Contractual Clauses and the UK addendum, adequacy decisions or provider certifications, and for Brazil the mechanisms in LGPD art. 33.

7. Legal bases (GDPR) and purposes (LGPD)

We process data to perform our contract with you (account, plan, licensing, billing, support), for our legitimate interests (security, fraud and abuse prevention, improving reliability), to comply with legal obligations (tax and accounting records), and on your consent where we ask for it (product-news emails, optional AI help with your own key, opt-in usage statistics). You can withdraw consent at any time.

8. Retention

  • Account and plan data: kept while your account is active. When you delete your account we remove it as described in section 9 within a reasonable period.
  • Billing records: the subscription record and invoices are kept for the period tax and accounting law requires (commonly 5 to 10 years).
  • Team members removed from an organization: their email address is deleted from our team records within 90 days; their own FaithFlow account stays theirs.
  • Audit records (account identifiers and actions, never tokens, files or emails): kept for security for a reasonable period.
  • Computer activation history stays as a record after a computer is removed, without content, until the account is deleted.
  • Product-news consent and the date you chose it are kept as long as the subscription or the proof of consent is needed.
  • Usage statistics (only if you turned them on): each daily report is deleted automatically 400 days after we receive it, or at once when you use Delete my usage data in the app.
  • Backups of our own database by our provider are overwritten on its normal schedule.

9. Deleting your account

Ask for deletion at hello@getfaithflow.com from the email on the account (the portal explains the steps; self-service deletion is planned). When an account is deleted: your FaithFlow Google service account and the folder registry are removed and your computers lose the paid plan; if you were the only owner of an organization, its team, members, structure and keys are deleted and the members are told that access ended; if another owner remains, only you are removed. We never delete anything in your Google Drive. The billing record is kept for the legal period in section 8. Google keeps a deleted service account recoverable for 30 days under its own rules. We send you a confirmation email.

10. Your rights

Depending on where you live (including under the Brazilian LGPD and the EU/UK GDPR) you may have the right to: confirm that we process your data and access it; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; be informed of who we share it with; and not be subject to decisions based solely on automated processing. You can see and edit your profile in your account, switch product news on or off, and write to hello@getfaithflow.com for anything else; we will answer within the legal time limits (15 days under LGPD, one month under GDPR). You may complain to your data-protection authority: in Brazil the ANPD, in the EU your national authority, in the UK the ICO.

11. Children and minors

FaithFlow is for adults who run church services. We do not knowingly collect personal data from children under 13 (or under the age set by your country, such as 16 in parts of the EU) and we do not offer accounts to people under 18 without a parent or guardian's permission. If you think a child gave us data, contact us and we will delete it. Churches may show pictures of or content about minors in services; that content stays on the church's computers and is the church's responsibility.

12. Security

Data is encrypted in transit; Google refresh tokens we store are encrypted at rest; the entitlement your computer caches is digitally signed by our server so it cannot be edited locally; our database tables holding licensing and team data are not readable from the internet and are accessed only by our server functions, which check who is calling on every request; and we log no request bodies. No system is perfectly secure. If a breach affects your personal data we will notify you and the authorities as the law requires (ANPD and affected people under LGPD art. 48; supervisory authority within 72 hours under GDPR art. 33).

13. Email, CAN-SPAM and product news

Product news (new releases and occasional updates) is opt-in and unchecked by default: we send it only if you turn on "Product news" on your account page, we record when you chose, and every news email has a one-click unsubscribe link and our postal address. If you opt in, your email address and language are added to our news list at Resend; if you opt out or unsubscribe you stop receiving news, and a sync never re-subscribes you. We honour unsubscribes immediately; the law allows up to 10 business days (CAN-SPAM). Our emails do not advertise other companies.

Team members

If your church invites people to its FaithFlow team, we store each invited person's email address, the role and the church or campus their role applies to, and when they were invited and joined. We use the email address only to send the invitation (through our email provider) and to let that person sign in. Members of the same organization can see each other's name, email address, role and place; this is never shown to other organizations. Activity records of team changes hold account identifiers and the action, not email addresses. When someone is removed or leaves, their email address is deleted from our team records within 90 days; their own FaithFlow account stays theirs. Church and campus names you enter are stored so your computers agree on them; your services and media are not.

Email

Email is described in section 13 above.

Google user data

FaithFlow uses Google in two ways. This section describes exactly what Google user data we access, why, and how it is protected.

Google sign-in

If you sign in with Google, we request the openid, email and profile scopes. We use your name and email address only to create your FaithFlow account and sign you in.

Google Drive (optional, Starter and above)

If your church is on Starter or a higher plan and you choose to connect Google Drive, we request only the https://www.googleapis.com/auth/drive.file scope. This scope limits access to the specific files you pick in the Google Picker; FaithFlow cannot see or list the rest of your Drive.

  • Use: the files you pick are used solely to import them into your church's FaithFlow app (pictures, videos and presentations). We do not use them for any other purpose.
  • Storage: the Google refresh token is stored encrypted on our server. Short-lived access tokens are used only while an import runs.
  • No sale, ads or AI training: we do not sell Google user data, do not use it for advertising, and do not use it to develop, improve or train artificial intelligence or machine learning models.
  • Sharing: we do not share Google user data with anyone except as needed to provide the import feature, or where the law requires it.
  • Disconnect and revoke: you can disconnect Google Drive at any time in your account at /app/integrations, and revoke FaithFlow's access at myaccount.google.com/permissions.
  • Deletion: deleting your FaithFlow account removes the Google tokens we store.

Google Drive folders shared with your FaithFlow address

FaithFlow only reads Google Drive folders that you share with your FaithFlow address or set to "Anyone with the link". Files go directly between Google and your computers. FaithFlow servers keep only the folder's identifier and who connected it, never your files. You can revoke access at any time by un-sharing the folder (or turning off link sharing). In a shared drive where you give the address editor access and turn on two-way sync, FaithFlow's sync package is written there by your computers, again directly. This use also adheres to the Google API Services User Data Policy, including the Limited Use requirements.

FaithFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14. Cookies and local storage

The website and portal use only what is strictly necessary: a sign-in session and a remembered language. No advertising or analytics cookies. The desktop app stores its data and settings on your computer.

15. Changes to this policy

We will update this policy when our practices change and show the date at the top. For material changes we will tell you by email or in the app before they take effect.

16. Complaints

Write to us first at hello@getfaithflow.com and we will try to resolve it. You also have the right to complain to a data-protection authority.

Contact

Questions about this document: hello@getfaithflow.com.