True Disciple Privacy Policy

Last updated: November 6, 2026

This policy describes how the operator of True Disciple (“True Disciple,” “we,” “us”) handles personal information when you use the True Disciple mobile app, the church admin website, and the related services (together, the “Service”).

The operator’s legal name, mailing address, and privacy contact are:

• Operator: Joshua Sullivan
• Address: 1004 Long Street, Dixon, Illinois 61021
• Privacy contact: support@truedisciple.net

If a church invited you, that church decides why its ministry uses the Service. We process member accounts, lesson progress, and questions for that church. We decide how the Service itself runs, including accounts we issue, security, billing, and this policy.

Information we collect

Account. Email address, display name, a hash of your password, whether your email is confirmed, church connections, admin role, avatar choice, text-size preference, scripture-translation preference, and session tokens. If you use Sign in with Apple, Apple gives us the name and email you authorize. There is no separate username. The display name you set is the name church staff see.

Learning. Lessons you start, spaced-repetition state, medals, practice answers you submit, reward-fact settings, and which fact cards you have earned, hidden, or flagged.

Questions. The text of a question you send about a lesson, whether you allowed a pastor to share it with the church, the pastor’s reply, and the display name of the person who answered.

Church content. Manuscripts, audio files, and video links a church admin uploads or submits, transcripts of those recordings, and the outlines and practice questions generated from them. A recording can contain the speaker’s voice and anything said or played during the service.

Spoken practice. If you choose to speak a verse answer, the app asks for microphone access and uses the speech recognizer built into your phone. On Apple devices that is Apple’s speech recognition. On Android devices it is the device speech recognizer, which is usually Google’s. We do not receive the audio. The text you submit as your answer can be stored with your lesson progress.

Billing. For a church plan, Stripe processes the card payment. We store the church’s plan, subscription status, and Stripe customer and subscription ids. We do not store full card numbers. For a lesson unlocked inside the app, Apple or Google charges you, and RevenueCat sends us a validated receipt so we can record the unlock.

Device and safety. Expo push tokens, if you turn notifications on. Cloudflare Turnstile results when you sign up. Rate-limit counters, password-reset and email-confirmation tokens, records of webhook events from Stripe and RevenueCat, model-usage counts (not the sermon text), and an audit log of actions our operators take on a church account, such as a suspension or a plan change.

We do not ask your age, precise location, contacts, photos, or advertising id.

How we use information

We use this information to:

• create and secure accounts, keep one church’s data separate from another’s, and enforce plan limits;
• show you lessons, record progress, deliver reward facts, and deliver questions to church staff;
• transcribe and draft learning material from church content, as described below;
• show scripture text from copies we host ourselves;
• send transactional email through Resend, including email confirmation, password reset, and co-admin invitations;
• send push notifications you have enabled, through Expo to Apple Push Notification service and Firebase Cloud Messaging;
• charge for church plans and record in-app unlocks;
• detect abuse, scan uploads for malware, and keep billing and security records.

We do not use personal information for advertising. We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not allow anyone else to do so.

Sermon drafts and Google Gemini

Before a pastor publishes a lesson, our servers send the church’s manuscript or transcript, and our instructions for that job, to the Gemini API through Google AI Studio. We call that API from a paid service Google Cloud project.

Under Google’s Gemini API terms for paid services, Google does not use those prompts or responses to improve Google’s products. Google does log prompts and responses for a limited time to detect violations of its prohibited-use policy and for any legal or regulatory disclosure it must make. Google’s abuse-monitoring documentation describes that period as 55 days. Google may store that data transiently in any country where Google or its agents have facilities. This is not zero retention. We do not turn on Grounding with Google Search, and we do not share AI Studio logs or datasets with Google for model training.

Member questions, practice answers, display names, and email addresses are not included in those requests. Reward-fact cards are written by us from our own source material. Your choices about those cards are not sent to Gemini.

The pastor reviews a draft before it is published. Generated text can be wrong.

Transcription and AssemblyAI

When a church submits audio, or a video link instead of a manuscript, our servers send that recording to AssemblyAI’s paid asynchronous transcription API. The recording can include the speaker’s voice.

We use a paid AssemblyAI account, and that account is opted out of AssemblyAI’s model-improvement program. AssemblyAI states that, for requests sent while the opt-out is on, it does not use that customer data to train its models, to benchmark, or to train on de-identified data.

On that same account the retention window for audio and transcripts is 7 days. Under AssemblyAI’s published rules for the asynchronous API, a window longer than 24 hours does not keep the uploaded audio for the full window. Their schedule for this setting is:

• deletion of the uploaded audio file begins at 24 hours and is completed within 48 hours;
• deletion of the transcript begins when the 7-day window ends;
• a video link we submit is kept on the same schedule as the transcript;
• AssemblyAI may keep metadata for logging and billing.

AssemblyAI has said that deletion through its host can lag, sometimes by hours and in some cases by days, after the clock above starts. We keep our own copy of the transcript and the church’s file in our storage until the church deletes the content or we delete it under “Retention” below. AssemblyAI’s copy is separate from ours.

Scripture

Passage text in the app is served from copies we host: the Berean Standard Bible, the World English Bible, and the King James Version. The app shows which translation you are reading. We do not send your identity to a scripture publisher to resolve a verse.

Who can see information

You can see your account, progress, and your own questions and replies.

Church staff for a church you have joined can see your display name, your email address, your role, and questions you ask about that church’s lessons, including your display name on those questions. They can see church-wide totals: connected members, lessons started, average medals, questions waiting or answered, and reviews due. This is dependent upon the "anonymous aggregate progress setting" mentioned below.

A switch in onboarding and Settings, “Anonymous aggregate progress,” is stored on your account. If enabled, it allows for your lesson access and review progress to contribute to aggregate metrics viewable by church staff. This allows them to see how many people have opened particular lessons and the average progress on reviews for each lesson. This information is anonymous and church staff are unable to see your individual usage of the app.

Our operators can see information they need to run the Service, including church billing status and the audit log of operator actions. They can suspend a church, change a plan override, or remove a person’s access.

Church members and external subscribers see published lessons for a church they belong to. They do not see your email address or your progress. They cannot read your questions unless you allowed a particular question to be shared and a pastor marked the reply public. Other members then see the question and reply without your name. They see the display name of the church staff who answered.

Processors below see the information required for the service they provide. They may not use it for their own advertising.

Processors

The malware scan runs on our own systems. We do not send the file to a separate antivirus vendor.

This table is the list of subprocessors for the church agreement. We will update it before we start using a new subprocessor for church or member information, and we will email the church’s billing admin when we do.

Retention

We keep account information, progress, questions, and church content while the account or the church’s subscription is active and the content has not been deleted.

You can delete your account in the app (Settings → Danger zone → Delete account). That deletion removes the account, sessions, progress, push tokens, and private questions you asked. If you allowed a question and answer to be shared publicly with your church group, we keep that thread for the group but remove your personal details and replace the question text with a short notice so the answer still makes sense in context. Lessons the church published stay with the church. A church admin can export that church’s content from the admin tools before the content is deleted. We may keep invoices, tax records, and fraud-prevention records for as long as the law requires. If you cannot use the in-app deletion, email the privacy contact and we will delete the account.

When a paid church subscription ends, we keep that church’s manuscripts, audio, drafts, lessons, and member connections for 120 days so the church can resubscribe without losing its work, and so a billing dispute can be checked against the account. That applies whether the subscription lapsed (for example unpaid) or was voluntarily canceled in Stripe. After 120 days we delete them. If the subscription lapsed for non-payment, we may email reminders on a schedule leading up to deletion. If the church canceled a paid plan (Stripe subscription canceled while it was still active), we use a lighter notice: one email about one week before deletion and one after deletion (no long ladder of reminders). A church can delete its own drafts and uploads sooner. An admin should export content before then if the church wants a copy. Billing, tax, and fraud-prevention records are not part of that deletion.

Operator audit logs and webhook records are kept for security and billing disputes, then deleted when they are no longer needed for those purposes.

AssemblyAI’s and Google’s retention of copies they hold is described above and is not extended by our retention of our own copies.

Security

We use access controls, encrypted transport, hashed passwords, and httpOnly session cookies on the church admin site (`ss_session`) and the operator site (`ss_ops_session`). No method of storage or transmission is perfectly secure.

Children

The Service is a church study app. We do not direct it to children under 13, we do not ask for age, and we do not knowingly collect personal information from a child under 13. A person under 13 may not create an account. If we learn that an account belongs to a child under 13, we will delete it. This is to comply with various app distribution laws.

We do not bar teenagers 13 and older from ordinary accounts. A church decides whom it invites and is responsible for any parental permission that church wants to obtain before a minor uses the Service. We do not screen those invitations.

Your requests

You may ask us to:

• give you a copy of the personal information we hold about you;
• correct your display name or email (you can also change these in the app);
• delete your account in the app, or by email if you cannot use the app;
• tell you what we have disclosed, which this policy does.

Email the privacy contact above. We may need to confirm that the request comes from you. If a church controls the ministry record, we may refer the request to that church or fulfill it for them.

We do not sell or share personal information as those words are used in US state privacy laws, and we do not use it for targeted advertising, so there is no sale or share to opt out of.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the church is the controller of member ministry information (membership, progress, and questions), and we are its processor. We are the controller of account security, our own billing records, and operator logs. Our bases for processing information we control are the contract with you, our legitimate interest in securing the Service, and your consent where we ask for it (push notifications, and microphone access, which you can refuse). You may lodge a complaint with your local data-protection authority. You may also object to processing based on legitimate interests, and you may ask us to restrict processing, subject to the limits in those laws.

Changes

We will change the “Last updated” date when we change this policy. If a change materially reduces what we promise a church or a member, we will say so in the app or by email before it takes effect.

Contact

For privacy questions, email support@truedisciple.net.