Envoi Tech ("we," "us," or "our") develops and operates mobile applications for churches and faith-based organizations: congregation-facing apps used by church members (the "Congregation Apps") and an administration app used by authorized church staff (the "Admin App," together the "Apps"). This Privacy Policy explains what information is collected when you use our Apps, how it is used, and your choices regarding that information.
Envoi Tech is a multi-tenant platform: each church's data is stored under that church's own account and is accessible only to that church's authorized staff.
Push notifications. A unique device token is generated by OneSignal (our push-notification service) and stored on OneSignal's servers. It is used solely to deliver church announcements and other notifications to your device.
Small group messaging (where enabled by your church). If your church enables group messaging, the messages, photos, and prayer requests you post — along with your display name and an account identifier — are stored under your church's account so they can be shown to the other members of your group. Prayer requests may optionally be posted anonymously. If you report a message, the report (including your name, the reported message, and your reason) is shared with your church's administrators for review.
Connection cards (where enabled by your church). Information you choose to submit on a connection card (such as your name, contact details, and message) is stored under your church's account and shared with your church's staff so they can respond.
Livestream and video viewing. Video is delivered by Mux, which collects standard playback analytics (such as views and watch time). We use this information only in aggregate; we do not use it to identify individual viewers.
We do not collect your location, payment information, or device contacts through the Congregation Apps.
Account credentials. Your email address is used to authenticate you via Firebase Authentication (Google LLC). Passwords are never stored by us — authentication is handled entirely by Firebase.
Church content. Bulletins, sermon series, scripture readings, events, notification text, and related content and images you submit are stored in Firebase Firestore and Firebase Storage under your church's account.
Congregation contacts. Names, phone numbers, and group assignments that church staff enter in order to send SMS messages to their congregation are stored under the church's account.
Text messages. SMS messages sent and received through the platform (message content, phone numbers, timestamps, and delivery status) are stored under the church's account and transmitted via Twilio.
Attendance records. Where a church uses attendance tracking, member rosters and attendance history entered by church staff are stored under the church's account.
Moderation records. Member-filed reports of group messages, and the actions administrators take on them, are stored for safety and auditing purposes.
Notification records. A log of push notifications sent (title, body, timestamp, and sender email) is stored for auditing purposes.
Device token. A push-notification token (Firebase Cloud Messaging) is stored so staff can receive administrative notifications, such as incoming messages.
Photos and camera. If you use features that read information from a photo (for example, extracting bulletin details or attendance from a photo of a sign-in sheet), you either select the photo through the system photo picker or scan the printed bulletin with your camera. The Admin App receives only the photos you choose or scan, uses the camera only while you are scanning, and never reads your photo library.
Pastor's Minute recordings. If a church uses Pastor's Minute, staff can record a short video (camera and microphone) or voice message (microphone) in the Admin App. The recording is uploaded to the church's account and shown in its congregation app, like other church content.
Microphone (sermon prompter). If a church turns on the optional sermon prompter in the Admin App, it listens to the pastor's microphone on the computer running the church's presentation software so the sermon notes on the stage display can follow along. Speech is transcribed on that device by Apple's speech recognition and is not recorded, stored or sent to us or anyone else, and the prompter uses the microphone only while it is on.
Facebook / Meta integration. If your church chooses to connect a Facebook Page to the Admin App, we use Facebook Login for Business to obtain a Page access token from the Page administrator. We store: (a) the Facebook Page ID and Page name, and (b) a long-lived Page access token, which lets the Admin App publish sermons and short-form video clips your church creates through the platform to that Page's timeline. We do not store the administrator's personal Facebook profile, friend list, or any Facebook data unrelated to the connected Page. Content the Admin App publishes to Facebook is visible only to the audience your church has set for its Page. The Page administrator can disconnect the Page at any time from within the Admin App, which deletes the stored Page ID and access token from our systems. Additional data-deletion procedures are described in our Data Deletion Policy.
Some Admin App features use an AI service (Anthropic's Claude API) to save staff time — for example, extracting bulletin details or attendance from a photo the administrator submits, or generating a transcript of a recorded sermon. Before any of these features is used, the Admin App explains what is shared and asks for permission; staff can change that choice at any time in Settings › AI Features. Only the content the administrator explicitly submits is processed (which can include names written on a sign-in sheet or bulletin), it is used solely to provide the requested feature, and it is not used to train AI models.
Our Apps rely on the following service providers, each governed by its own privacy policy:
All data transmitted between our Apps and their servers is encrypted in transit using HTTPS/TLS. Each church's data is isolated under its own account with permission-scoped access, and messaging credentials are readable only by our server-side functions.
Your device token is retained by OneSignal for as long as the app is installed and push notifications are enabled. Uninstalling the app or disabling push notifications through your device settings will stop further notifications. Group messages, prayer requests, and connection cards are retained under your church's account until deleted by you (where the app allows) or by your church's administrators. Reported messages that administrators remove are taken down from the group.
Church content, contacts, attendance records, message logs, and notification history are retained until deleted by a church administrator. Account access may be revoked by a church administrator at any time.
To request access to or deletion of information your church holds about you, contact your church's administrators, or contact us at the address in Section 9.
Our Apps are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through our Apps, please contact us so we can take appropriate action.
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. Continued use of the Apps after changes are posted constitutes your acceptance of the revised policy.
If you have any questions about this Privacy Policy, or wish to request
access to or deletion of your information, please contact us:
Envoi Tech
john@envoitech.com