Privacy & Your Information

Who we are

This policy covers saintlukecolumbia.org and the Saint Luke Columbia parish app published by Newrome Press, LLC. St. Luke the Evangelist Greek Orthodox Church administers parish services and giving. Newrome Press publishes the app and provides authorized technical support.

This policy does not replace the separate privacy policies of Subsplash or other websites and services you choose to use. You can browse public parish information without an account. One-time gifts can be made without a parish account; new recurring gifts require a verified giving account.

Information we use and why

• Giving accounts: your name, email address, password hash, account dates, email-verification status, and payment-service identifiers. We use these to provide secure sign-in, verify email ownership, recover access, show giving history, and manage payments. We do not store your password in readable form.
• Donations: donor name and email, amount, date, fund, optional note, payment-method category, status, recurring frequency, transaction references, and any contribution toward fees. We use these for giving history, receipts, accounting, reconciliation, and parish reporting. Historical records imported from Subsplash may contain the donor and transaction information supplied in that export.
• Payment details: Stripe processes credit-card and bank payments. Card and bank details are entered through Stripe’s payment services. Our donation database stores payment references and gift information, not full card or bank-account numbers.
• Contact messages: your name, email, subject, and message, used to respond and follow up. Messages may be forwarded to the parish mailbox. Please avoid including passwords, full payment details, or unnecessary sensitive information.
• App information: downloaded bulletins, cached parish content, reminder preferences, and announcement read status are stored on your device. When remote notifications are available and you enable them, the service uses an app-generated device identifier and notification token to deliver announcements. Recent delivery records help prevent duplicate alerts.
• Technical information: service providers receive information such as IP addresses, device/browser details, request information, and operational logs when you connect to them. We use necessary storage and technical information to operate, secure, and troubleshoot the services. Optional website analytics is described below.

After you verify your account email, unclaimed historical gifts with the same email address are connected to your giving history. This does not transfer payment details or create, change, or cancel Subsplash recurring gifts. Contact the parish if historical gifts used a different email address.

Who can access information

Access to donor information is limited to authorized Newrome Press staff and the currently serving, elected parish treasurer for giving administration and technical support. Service providers process information needed to deliver their services.

We do not sell donor or contact information or provide it to outside entities for their unrelated marketing. We may disclose information when required by law or reasonably necessary to address fraud, security incidents, or protect legal rights.

• Stripe processes donations, stores payment methods, and provides payment-management services. Stripe privacy policy.
• Hostinger hosts the website and application services. Hostinger privacy policy.
• Supabase hosts the database and uploaded public media. Supabase privacy policy.
• Resend delivers contact notifications, email verification, and password-reset messages. It receives recipient addresses and message content, including time-limited account links when needed. Resend privacy policy.
• Google provides optional Analytics, fonts, the contact-page map, and the public calendar feed retrieved by our server. Declining Analytics does not disable fonts or an embedded map. Google privacy policy and how Google uses information from sites that use its services.
• Crossway / ESV supplies Scripture audio when you play it. Crossway privacy policy.
• Adobe and media hosts may serve bulletins or other requested publications. Adobe privacy policy.
• Apple provides app distribution, TestFlight, and push delivery when enabled. Apple privacy policy.

Providers apply their own privacy, security, and retention practices. Information may be processed in the United States or other locations where providers operate. Opening a website, payment page, or publication inside the app can still communicate with those providers.

Cookies, local storage, and optional analytics

Sign-in, payment, and security features use necessary cookies or similar storage. The giving form temporarily saves fund, amount, frequency, payment-method choice, and fee-coverage selection in the current browser tab for up to 24 hours. This saved draft does not include your name, email, note, or card/bank details.

Google Analytics loads only after you select Allow analytics. You may decline and continue using the site, or change your choice using Privacy choices on public information pages. Your preference is remembered in that browser for up to 180 days. Clearing browser storage may remove the preference. Withdrawal stops future Analytics collection in that browser and removes its first-party Analytics cookies; it does not erase previously collected information.

When allowed, Analytics helps us understand public-page visits, general device/browser characteristics, and approximate location. Giving, account, admin, and contact pages are excluded. We omit query strings, URL fragments, and page referrers from reported page views; email and specified sensitive URL-parameter redaction provide additional protection. Advertising personalization and Google signals are disabled. Optional form-interaction, download, video, scroll, search, and outbound-click measurements are off.

The property’s event-data retention is two months; user-data retention is fourteen months, reset on new activity. These settings do not control most standard aggregated reports. Google’s processing and retention policies also apply. We do not send donor-account identifiers or payment details as Analytics identifiers.

Retention and account deletion

• Donation records: the parish retains records for seven years after the end of the donation’s calendar year. For example, a 2020 gift is retained through December 31, 2027. Records may be kept longer for an unresolved transaction, dispute, or legal preservation requirement. Deleting a giving account does not erase retained accounting records.
• Giving profile: you may delete your giving account from My Giving on the website or inside the app. Confirm using your current password and the deletion confirmation. Successful deletion removes your login/profile and associated sign-in records, removes saved payment details on its Stripe customer, and cancels future Stripe recurring gifts on that customer. Completed gifts are not refunded; payments already processing may still settle. The page confirms completion. If a service error interrupts deletion, follow the displayed retry instructions.
• Subsplash: deleting this account does not cancel gifts in Subsplash. Manage those separately through Subsplash.
• Contact messages: routine inquiries are retained for up to twelve months after resolution, unless an ongoing matter or legal/recordkeeping obligation requires longer retention. Website cleanup runs daily for resolved, unheld messages. Copies in parish email and provider systems have separate deletion and backup processes; they are not erased by the website cleanup.
• Account links: verification links expire after 24 hours and password-reset links after one hour. Used or replaced links are removed or invalidated. Expiration does not mean every related service log is immediately erased.
• Device data: saved bulletins and preferences remain until you remove them, clear app data, or uninstall, subject to your device’s backup/restore settings. Where remote alerts are supported, disabling them through the app removes the active registration after the request succeeds. Delivery history may retain identifiers for the latest 100 announcements.
• Logs, email delivery, and backups: these have separate operational and provider retention schedules. The website server journal is limited to seven days; forwarded system logs rotate weekly with four rotated files plus the current file. Deleting an account does not immediately remove copies from backups, delivery records, or provider systems. Provider schedules and any necessary legal or security preservation may extend retention beyond the live account’s lifetime.

Contact us about retained copies or information you believe should be removed. We assess the request against accounting obligations, ongoing matters, and the information held by the relevant service. We do not promise that every provider copy is erased immediately or on one universal schedule.

Your choices and requests

You can ask the parish to help you access or correct your information, obtain your giving records, or request deletion of information not needed for accounting, an ongoing matter, or another applicable obligation. We may ask for information needed to verify that the request is yours. Do not send passwords or full payment details.

You can cancel or update new-system recurring gifts through My Giving, remove saved bulletins in the app, and manage reminders or notification permissions in your device settings. Turning off system notification permission alone does not send a deletion request to our server. Signing out or uninstalling the app does not delete your giving account or cancel recurring gifts.

Protecting information

We use HTTPS for production website/app connections, password hashing, verified-email checks for giving history and payment management, and restricted administrative access. Stripe handles payment details. No online service can guarantee complete security. Contact the parish promptly if you suspect unauthorized account use.

Adult giving accounts

Giving accounts are for adults age 18 and older. Registration asks you to confirm eligibility by selecting Create Account; we do not collect a birth date or identity document for independent age verification. Public parish information is available without a giving account.

If you believe a minor created a giving account, contact the parish so we can review and close the account and remove unnecessary profile information while retaining required donation records. Parents and guardians should avoid including unnecessary information about children in donation notes or general contact messages.

Contact and policy updates

Parish and donor-account matters:
St. Luke the Evangelist Greek Orthodox Church
1510 Audubon Drive, Columbia, Missouri 65201
info@saintlukecolumbia.org

App publisher matters:
Newrome Press, LLC
info@newromepress.com

We will post policy updates on this page with a revised effective date. Material changes will be highlighted on the website or in the app as appropriate.