Privacy Policy

Effective date: July 10, 2026 · Last updated: July 10, 2026

1. Introduction

This Privacy Policy explains how Theodoxia LLC (“GospelGram,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use GospelGram (the “Service”).

We’ve tried to write this Policy in plain language. We care about your privacy and want to be transparent about what we do with your data and why. By using the Service, you agree to the practices described in this Policy.

2. Information we collect

2.1 Information you provide directly

Account information: name, email address, username, password, profile photo, bio, and similar details you enter when creating or updating an account.
Verification information (missionaries and organizations only): affiliation details, organizational documentation, and verification-related information.
Payment information: when you donate or receive donations, your payment details (including card information, bank account details, and government identification for recipients) are collected by and stored with Stripe, our payment processor. We do not receive or store full card numbers or bank account numbers ourselves.
Content you post: photos, videos, text posts, updates, comments, and other content you share on the Service — including any location label you choose to attach to content, which may be shown publicly (for example on the Explore map) if your content is public.
Communications: messages you send through the Service, support emails, and feedback.
Donation information: recipient, amount, frequency, optional message, and related metadata for donations you make or receive.

2.2 Information collected automatically

Device and usage data: device type, operating system, app version, IP address, language, timestamps, and interactions with the Service.
Log and diagnostic data: crash reports, error logs, and performance metrics.
Usage events: in-app actions (e.g., screens viewed, posts created, donations initiated) used to understand how the Service is used. This analysis happens inside our own systems.
Approximate location: we may infer general location from your IP address. We do not collect precise GPS location without explicit permission.

2.3 Information from third parties

Stripe: payment status, payout status, KYC verification status for recipients, and transaction metadata.
Organizations: if you are verified as a missionary, your verifying organization provides information confirming your affiliation.

2.4 Information we do NOT collect

We want to be explicit about what we do not collect:

We do not collect biometric data.
We do not track you across other websites or apps for advertising purposes.
We do not share your data with data brokers.
We do not sell your personal information.

3. How we use your information

We use your information to:

Operate the Service — create and maintain your account, display content, process donations, handle verifications, and enable social features.
Process payments — facilitate donations through Stripe and associated recordkeeping.
Protect the Service — detect and prevent fraud, abuse, impersonation, and violations of our Terms, including automated safety screening of content (see Section 4.2).
Communicate with you — send transactional emails (donation receipts, recurring donation notices, account notifications) and, if you opt in, occasional product updates.
Improve the Service — analyze usage patterns, diagnose bugs, and prioritize features.
Comply with legal obligations — respond to lawful requests, meet tax and accounting requirements, and satisfy recordkeeping laws.

We do not use your data for third-party advertising.

4. How we share your information

We share information only as described below.

4.1 With other users

Your profile information, posts, and publicly displayed verification status are visible to other Users according to the visibility setting you choose (Public, Private, or Under His Shadow).
Your donation amount and identity are visible only to you and the recipient missionary. Donations are not publicly displayed by default.
Recipients see: your name (or chosen display name), your profile link, the donation amount, and any message you include.

4.2 With service providers

We share limited data with third-party service providers who help us operate the Service. They are contractually bound by their data processing terms to protect your information. Current providers:

Supabase — database hosting and authentication (stores your account credentials securely, handles password hashing, manages your session).
Cloudflare — hosting, content delivery, image storage and delivery, and security protection.
Mux — video processing, storage, and streaming for videos you upload.
Vercel — hosting for our website.
Stripe, Inc. — processes all donations and handles Know Your Customer (KYC) verification for recipient missionaries.
Apple / Google — if you use Sign in with Apple or Google, they share a verified email (or, for Apple, optionally a privacy-preserving relay address) and basic profile details with us.
Sentry — crash reporting and error monitoring.
Resend — transactional email delivery (welcome emails, donation receipts).
Content-safety providers (Sightengine; OpenAI moderation) — uploaded images, videos, and text may be automatically screened for safety-policy violations before or after publishing.

This list is updated here when providers change; check this page for the current list.

4.3 With verifying organizations

If you are verified as a missionary, your verifying organization receives information about your account status, fundraising activity summaries, and relevant updates required to maintain verification.

4.4 For legal reasons

We may disclose information to:

Comply with applicable law, legal process, or lawful government request;
Enforce our Terms;
Protect the rights, property, or safety of GospelGram, our Users, or others;
Investigate suspected fraud, abuse, or security issues.

4.5 Business transfers

If GospelGram or Theodoxia LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer that changes how your data is handled.

4.6 With your consent

For any purpose not described above, we will share your data only with your explicit consent.

5. Your rights and choices

5.1 Universal rights

Regardless of where you live, you can:

Access and edit your profile information from in-app settings.
Delete your account through the in-app account deletion flow (see how deletion works), which will remove your profile, posts, and associated data (subject to retention obligations in Section 7).
Export your data by emailing support@theodoxia.com. We will provide a copy of your personal data in a portable format within 30 days.
Stop receiving non-essential emails using the unsubscribe link in the email. Transactional emails (donation receipts, account notifications) cannot be disabled while your account is active.

5.2 Rights for EU / UK / EEA residents (GDPR)

If you are in the European Union, United Kingdom, or European Economic Area, you additionally have the right to:

Request access to your personal data;
Request correction of inaccurate data;
Request deletion (“right to be forgotten”);
Object to or restrict certain processing;
Request data portability;
Withdraw consent at any time (where processing is based on consent);
Lodge a complaint with your national data protection authority.

To exercise these rights, email support@theodoxia.com. We will respond within 30 days.

Legal bases for processing: we process your data under the following lawful bases: contract — to provide the Service you signed up for; legitimate interest — to operate, secure, and improve the Service; consent — for optional features (e.g., marketing emails, if you opt in); and legal obligation — to comply with laws such as tax and anti-fraud regulations.

5.3 Rights for California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect, use, and share;
Delete your personal information (subject to certain exceptions);
Correct inaccurate personal information;
Limit use and disclosure of sensitive personal information;
Opt out of the “sale” or “sharing” of personal information (we do not sell or share personal information as defined by the CCPA, but you may still submit a request for confirmation);
Not be discriminated against for exercising these rights.

To exercise these rights, email support@theodoxia.com. You may designate an authorized agent to act on your behalf.

5.4 Other jurisdictions

If you live in a jurisdiction with additional privacy rights (e.g., Brazil under LGPD, Canada under PIPEDA, Virginia under VCDPA, Colorado under CPA), you may also have rights under those laws. Email support@theodoxia.com with your request and we will comply with applicable law.

6. Cookies and similar technologies

Our website uses only essential cookies and similar technologies (such as local storage) to keep you signed in, remember your preferences, and detect and prevent fraud. We do not use advertising or cross-site tracking cookies. You can manage cookies through your browser settings; blocking essential cookies may prevent parts of the website (such as sign-in) from working.

7. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. After account deletion:

Profile, posts, and user content — deleted within 30 days, except where retention is required by law.
Donation and transaction records — retained for up to 7 years for tax, accounting, and legal compliance purposes.
Fraud, safety, and abuse records — retained as necessary to protect the Service and its Users.
Aggregated or anonymized data — may be retained indefinitely, as it cannot be associated with you.

8. International data transfers

GospelGram operates from the United States. If you use the Service from outside the U.S., your data will be transferred to and processed in the U.S. For transfers from the EU, UK, or Switzerland, we rely on Standard Contractual Clauses or other approved mechanisms to protect your data.

9. Security

We take reasonable administrative, technical, and physical safeguards to protect your information, including:

Encryption of data in transit (TLS);
Encryption of data at rest where supported by our providers;
Access controls and least-privilege authentication for our team;
Routine security reviews and monitoring.

No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential. If you suspect unauthorized access to your account, contact us immediately at support@theodoxia.com.

10. Children’s privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will delete it promptly. If you believe a child has provided us with personal information, contact us at support@theodoxia.com. Users between 13 and 18 should have parental or legal guardian consent to use the Service.

11. Third-party links and services

The Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of those parties. Their policies govern their use of your data.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least 14 days before they take effect. The “Last updated” date above indicates the most recent revision.

13. Contact us

For privacy questions, data access requests, or to exercise your rights:

Email: support@theodoxia.com
Mail: Theodoxia LLC, Attn: Privacy, 212 W. Main St., Middletown, DE 19709

For EU/UK representatives, a designated representative will be appointed if required by law. Contact details will be listed here upon appointment.

We write this Policy in a way we hope feels honest and human. If anything is unclear, ask us.