Data Safety
Last updated: April 6, 2026
Overview
This page describes what data the Apostolic Path app collects, shares, and how it is handled. This information is provided in accordance with Google Play's Data Safety requirements. For the complete details of our data practices, please see our Privacy Policy.
Data Collection Summary
- Data is encrypted in transit using TLS/HTTPS.
- Data is encrypted at rest on our servers.
- You can request that your data be deleted.
- No data is sold to third parties.
- No data is used for advertising, profiling, or credit determination purposes.
1. Personal Information
Name & Email Address
Collected: Yes — required to create your account and identify you within your church.
Purpose: Account functionality, church membership, and transactional email delivery (e.g., password resets, verification codes).
Shared: Transmitted to our email service provider (Amazon SES) solely for delivering transactional emails. Shared with your church leadership as part of the discipleship platform.
Phone Number
Collected: Yes — provided during registration.
Purpose: Church contact records. We do not send SMS messages or make automated calls.
Shared: Visible to authorized church leadership only.
Address
Collected: Only for church organizations (not individual users). Churches may optionally provide their physical address.
Purpose: Church profile information.
2. Financial Information
Purchase History
Collected: Yes — subscription tier and billing event history (e.g., plan upgrades or downgrades) are logged for church accounts.
Purpose: Subscription management and billing records.
Shared: Transmitted to Stripe for payment processing.
Payment Card & Bank Information
Collected: No — we never collect, store, or process raw credit card numbers or bank account details. All payment entry is handled directly by Stripe.
3. Religious Beliefs
Collected: Yes — as a discipleship platform, the app records spiritual milestones including repentance, water baptism, and receiving the Holy Ghost, as well as discipleship progress, Bible study participation, prayer requests, and pastoral care notes.
Purpose: Core app functionality — tracking and supporting each person's spiritual journey within their local church.
Shared: Visible to authorized church leadership only (pastors, leaders, and teachers as configured by each church). Confidential records (e.g., pastoral care flags) have additional access restrictions. This data is never shared with third parties for any purpose other than data storage and hosting.
4. Photos & Files
Collected: Optional — users may upload a profile photo and churches may upload a logo. Documents and study materials may also be uploaded.
Purpose: Profile personalization, church branding, and study resources.
Shared: Stored in Amazon S3 (encrypted at rest). Accessible only to members of the associated church.
5. App Activity
Collected: Yes — records of study sessions, lesson completions, class enrollments, attendance, and discipleship step completions.
Purpose: Core app functionality — providing pastors and leaders with insights into discipleship progress within their church.
Shared: Visible to authorized church leadership only. Aggregate analytics (e.g., retention rates) are shown to church admins but never shared externally.
6. Device & Account Identifiers
Push Notification Tokens
Collected: Yes — Firebase Cloud Messaging (FCM) device tokens are stored to deliver push notifications.
Purpose: Delivering push notifications for study reminders, class updates, and other church-related alerts.
Shared: Transmitted to Firebase Cloud Messaging (Google) for notification delivery only. Tokens automatically expire after 90 days.
Authentication Tokens
Collected: Yes — JWT access and refresh tokens are stored as secure, HTTP-only cookies (web) or in the device secure storage (mobile).
Purpose: Keeping you signed in securely.
Shared: Not shared with any third party.
Biometric Authentication
Collected: No biometric data leaves the device. The app may prompt for Face ID or fingerprint authentication, but this is handled entirely by your device's operating system. We only store a preference flag indicating whether you have enabled biometric login.
7. Technical & Diagnostics
Collected: Yes — IP addresses, HTTP request metadata (URL, method, request ID), and API performance traces.
Purpose: Security (rate limiting, abuse prevention), error diagnosis, and performance monitoring.
Shared: Performance traces are transmitted to Dynatrace (our application performance monitoring provider). IP addresses are not stored in our database but may appear transiently in server logs and monitoring traces.
8. Third-Party Services
We use the following third-party services to operate the app. Data is shared with these services only as necessary to provide the described functionality:
| Service | Data Shared | Purpose |
|---|---|---|
| MongoDB Atlas | All app data | Cloud database hosting |
| Amazon Web Services | Emails, uploaded files, authentication credentials | Email delivery (SES), file storage (S3), authentication (Cognito) |
| Stripe | Church name, email, subscription details | Payment processing |
| Firebase Cloud Messaging | Device tokens, notification content | Push notifications |
| Google OAuth | Google account ID, email | Social sign-in (optional) |
| Apple Sign-In | Apple account ID, email | Social sign-in (optional) |
| Dynatrace | API performance traces, request metadata | Application performance monitoring |
| Vercel | All request/response traffic | Application hosting |
9. Data We Do Not Collect
The Apostolic Path app does not collect the following:
- Precise or approximate location
- Contacts or call logs
- SMS or chat messages
- Audio, music, or video files
- Health or fitness data
- Browsing history or search history
- Calendar events
- Advertising identifiers
- Crash logs or diagnostics from third-party analytics SDKs
10. Security Practices
- All data is transmitted over encrypted connections (TLS/HTTPS).
- All stored data is encrypted at rest on our servers.
- Passwords are hashed using bcrypt and are never stored in plain text.
- Authentication tokens are stored in HTTP-only, secure cookies (web) or in the device's secure storage (mobile).
- Multi-factor authentication (TOTP and passkeys/WebAuthn) is available for additional account security.
- All data access is scoped to the authenticated user's church — multi-tenant isolation is enforced at every level.
11. Data Retention & Deletion
- Push notification device tokens are automatically deleted after 90 days of inactivity.
- Notifications are automatically deleted after 90 days.
- Student invite codes expire and are automatically cleaned up.
- You may request deletion of your personal data at any time by contacting us at support@apostolicpath.com.
- Church administrators can archive or remove student records and user accounts within the platform.
12. Contact Us
If you have questions about this data safety disclosure or our privacy practices, please contact us at support@apostolicpath.com or visit our Contact page.