Church Abandoned privacy notice Version CA-PRIVACY-2026-10-20-v1 Who operates the app Church Abandoned operates this app for the church’s use. Soli Deo Software handles app support and privacy inquiries at support@solideosoftware.com. Church Administration handles chat-abuse reports through the administration dashboard. This notice covers the app and its supporting services; the SDS website has a separate privacy notice. Church parent-rights contact: Church Abandoned, Mountain View Elementary School, 145 Co Rd 627, Etowah, TN 37331; (423) 404-1772; ChurchAbandoned@ChurchAbdanoned.org. Church Administration handles authenticated requests for the child’s records, consent copies, withdrawal and deletion. Do not email consent records to SDS. Information and purposes Accounts and church activities. Firebase Authentication handles sign-in credentials. The service uses email, account identifier, names, verification status, birthday and derived age/permission information for access. Family features hold links, relationships, invitations and names of relatives without accounts. Group membership and event registrations identify participants. Attendance tools record counts and optional notes that may identify people. Church involvement can reveal religious affiliation. Adding a relative or a “Guardian” label does not verify parental authority. Chats and files. The service processes submitted messages, sender information, room membership, timestamps, read/unread state and uploaded photos/PDFs. Conversation participants and authorized dashboard readers can access content according to their permissions; dashboard access may extend beyond individual room membership. Recipients may save or share copies outside the app. Do not treat chat as confidential pastoral counseling. Notifications. Device notification tokens and preferences support alerts. Apple APNs or Google FCM processes tokens and notification payloads. Device settings and preview preferences affect what appears in notifications. Problem reports and local diagnostics. In this release, problem reports are submitted only when you choose Send report or Retry report. A report includes your description and diagnostic information such as app/build/platform/OS, attempted device model, display/locale/timezone, permission/grant information and bounded screen/request/error history. A hashed account reference remains linkable. Redaction does not remove everything you might type. Do not include private chat content, consent forms, passwords or identity documents. Diagnostic report access is restricted to Developer users. The app keeps limited diagnostic history locally in memory to help prepare a report you may choose to send. Local error recording does not itself submit a problem report. This history uses fixed diagnostic labels and source locations rather than raw exception text, URLs or request contents. The report contains at most 40 history entries, including selected recent failures. A failed manual submission can be saved securely on the device for you to retry or discard. The app does not automatically send chat-error problem reports in this release. If a separate automatic-report queue remains from an older app, the new app discards it when its cleanup handler runs rather than submitting it. This does not erase reports already held on the server. Providers and external features Google Firebase Authentication, Firestore and Cloud Functions support accounts and backend processing; chat files use private Google Cloud Storage. The administration dashboard at caappadmin.org uses Firebase App Hosting. The SDS policy website is hosted on GitHub Pages; its security logging is covered by the separate website notice. Ordinary support/privacy email uses Zoho. The app uses Resend to deliver generic administrative alerts with protected-dashboard links. Alerts contain no report, chat or consent content. Recipients follow current permissions and notification preferences; problem-report alerts go only to actual Developer-group members. Resend processes recipient addresses and delivery metadata. Local quota metadata can remain up to31days; Resend’s own retention remains to be verified. Email acceptance does not guarantee inbox delivery. YouTube players connect to YouTube inside the app. Giving opens the church’s Church Center destination; the inspected app does not collect payment-card details. Map/social/scripture links connect to their destination services. Backend scripture and administrator sermon-analysis features include Crossway ESV and Google Gemini integrations. Chat word and phrase filtering. In this release, the server checks submitted and edited message text and captions against configured words and phrases. This is rule-based matching, not AI interpretation of a conversation. A configured match can be blocked even when it appears in a quotation. It does not inspect the contents of image, video or other binary attachments. The filter can miss harmful content or block harmless text; a match is not a finding that a person has confirmed abuse. You can report concerns and request review through the app. A blocked message is not delivered and creates a restricted moderation incident for authorized administrator review. Five distinct blocked messages within 30 minutes restrict chat until an authorized administrator lifts the restriction. A request for review is not itself a block or strike. Checking failures preserve the draft and do not count as violations. These controls apply to the server's covered message and caption submission paths; older app versions may require an update. AI chat classification and the optional message-improvement workflow are disabled for this release. Chat text is not sent to the former AI classifier for screening or improvement. The prior adult opt-in does not authorize continued reuse while that workflow is disabled. We do not collect new improvement opt-ins or use messages to generate or evaluate learning proposals in this release. Existing preference, incident and review records remain subject to the purposes and retention limits below. Disabling this workflow does not assert that historical records or provider metadata have been immediately erased, and does not mean that unrelated provider features described above have been removed. Retention and deletion Active chat messages and attached photos/PDFs have a server-side 90-day retention rule measured from original message creation. Access ends at the cutoff; physical cleanup runs asynchronously and may retry. Rooms and memberships are preserved. For eligible messages still unexpired when an event/standalone room is archived, the separate archive window runs for 90 days from archival; already-expired content cannot revive. This is not a universal 90-day maximum across archived records. Restricted automated-moderation incidents, including blocked text and decision information needed for administrator review, follow the separate approved 90-day incident schedule. After incident text and details expire, minimal room/restriction associations can remain so an authorized administrator can review and lift an existing restriction; this does not extend retention of the expired text. Moderation debugging metadata is available for 30 days and then expires into cleanup. It records message/room references, edit versions, filter or historical model decisions, timing and error/status information, without copying message or conversation bodies into those debugging records or general logs. These references can remain linkable to source records. Developer access to debugging metadata does not by itself authorize access to chat content: viewing original text or context also requires the applicable review permissions and remains subject to source retention, removal and edit-version checks. The 30-day debugging period does not extend the source content’s retention. User-filed abuse-report evidence has a separate 90-day-from-report schedule. Problem reports have a 30-day availability cutoff and scheduled cleanup. Manually saved pending report attempts expire on access after seven days. This release does not create or transmit automatic chat-error reports. Any older separate automatic-report queue is discarded when its cleanup handler runs; cleanup is not a promise of immediate device-wide erasure. Existing server reports keep their original retention deadlines. The inventoried global cloud-log buckets have 30-day and 400-day retention settings. These provider and administrative metadata schedules are separate from application-content schedules. Active profiles, family/membership/registration/attendance records do not have a universal age-based expiry established by the audit. Account deletion locks access and initiates resumable cleanup of account/profile, membership/family links, registrations, device/notification records, owned files and associated reports. Other people’s shared records can remain. Own messages are removed or reduced to technical remnants as the applicable cleanup runs. A nonidentifying completion receipt lasts 30 days. Cleanup is not guaranteed to finish in one worker interval, and cannot erase recipients’ exports or screenshots. Historical optional-improvement records remain subject to their original limits; disabling the workflow does not restart a message or incident's retention period. Source-linked improvement records expire no later than 30 days after first selection and earlier if the source expires, is deleted, permission is withdrawn, or eligibility ends. Candidate and evaluation records have a maximum 30-day period from creation, shortened by applicable source deadlines. We stop access at the cutoff and remove records through scheduled cleanup. We do not keep copied message text, private review details or message embeddings for improvement. We keep your current optional-use preference and the version and time of that choice while needed to honor it for your account. Turning the feature off keeps it off; it does not extend retention or use of messages. Account deletion removes the preference through the account-deletion process. Temporary withdrawal markers expire after 30 days; their expiry does not change your choice or permit reuse. Historical approved general rules and minimal administrator approval records may remain only while needed for an authorized retained version; we remove them within 30 days after that need ends. Retained aggregate results must not identify or single out members and follow the corresponding candidate or active-rule schedule. We do not promise immediate physical erasure from every system. Age eligibility and existing child records Accounts for this release are limited to people age 13 and older. We use date of birth and server-side eligibility checks to enforce this limit. People under 13 cannot create or activate an account or use an existing account for ordinary app activity in this release. If age information is missing or inconsistent, account activity may be limited until eligibility is resolved. Correcting age information does not automatically reactivate an account that is suspended, withdrawn or being deleted. People age 13–17 are minors, not adults. Permission to use this app does not override the age limits or parent-permission requirements of YouTube, giving services or other external providers. YouTube requires users under 18 to have parent or guardian permission. Those provider requirements still apply when features are available through the app. The under-13 enrollment and parent-consent process is unavailable for this release. Existing requests, unused approvals or historical parent signatures cannot activate an under-13 account. The child-account implementation is retained for possible future use, but there is no promise of availability or automatic enrollment later. A future reopening would require applicable notices, verified permission and access controls at that time. This age limit does not mean the church holds no information about children. Existing family, event, attendance, consent, account or historical communication records may include child information. Authenticated parent access, consent-copy, withdrawal and deletion requests remain available through Church Administration. Historical signed notices retain their exact text, versions and original scope. Existing unlinked child requests expire 24 hours from original creation; linked unfinished requests, including unused approvals, expire 30 days from original first linking. Closing enrollment, recovery, replacement QR codes and activity do not reset those clocks. Records are not kept indefinitely for a possible future release. Necessary consent evidence follows its existing lifecycle: when its purpose closes, only necessary minimal evidence may remain for up to 90 days from original closure, with valid earlier deletion. This does not extend retention of profiles, messages or files. The church continues scheduled cleanup and authenticates rights requests before securely providing information. For a person who reaches age 13, existing parent-management and recovery rules remain separate from age eligibility. Parent reset, suspend and delete authority ends when the account holder is also server-verified as owning their recovery email; removing the email later does not restore that authority. An age transition does not restore suspended, withdrawn or deleted accounts. Contact Church Administration to resolve existing account or age-record issues. Contact and changes Soli Deo Software handles ordinary app support/privacy inquiries at support@solideosoftware.com. Do not email consent forms or verification records to SDS. Use the Church Administration contact above for authenticated child-record and parent-rights requests. We will post revisions to this notice and update its effective date.