The Seventh Day Privacy Policy — effective October 21, 2026
The Seventh Day is the public name of this app and its companion website at thesd.app. The current church account service remains administered by Onalaska Seventh-day Adventist Church. A new product name does not transfer existing accounts or change the responsible church, and does not claim denominational ownership or endorsement. Privacy and deletion requests: [email protected]. By selecting Accept, you acknowledge this privacy notice and agree to the described account service practices. This does not waive your privacy rights. Optional device permissions and optional detailed crash-report sharing remain separate choices; accepting this notice does not enable them.
Support email is handled through Purelymail and the operator's support inbox. Messages you choose to send may include your email address, message content and normal email-delivery metadata. Never email your password, verification codes or private Directory information. Contacting support does not automatically delete an account; ownership must be verified before an external deletion request is fulfilled. Setting up this support mailbox does not enable automatic account-verification email or email self-signup.
We store account name, email, password hash, role, profile details/photos, community posts and prayers, comments, messages and attachments, study participation/progress, reading highlights, device notification tokens and technical error reports to provide and secure the app. Content can reveal religious beliefs or other sensitive information. Share only information you are comfortable providing. Public/member content is visible to its intended audience; private messages are accessible to intended participants and may be reviewed by Admins/Owner when reported or screened for safety. Messaging is not end-to-end encrypted. Reports, review reasons, confirmed strikes, restrictions, blocks and policy acceptance versions/timestamps support community safety. We do not sell personal data.
The app backend, website origin and PostgreSQL databases run on Contabo infrastructure. Cloudflare provides DNS, HTTPS edge protection and outbound origin tunnels. These infrastructure providers process network and technical request information to deliver and secure the service. The companion website uses a Secure, HttpOnly, host-only session cookie. Its private workspace is kept in page memory, not browser local/session storage; signing out or restoring an old page clears and revalidates it. Your app permissions also limit website access, and the server rechecks every protected action. Passwords are verified by the account service, not saved by website JavaScript. Browsers may offer their own password-saving features, which you control separately.
External content/services may include KWJD-LP 92.1FM Onalaska, WA, weather/sunset data, the E. G. White library, YouTube, GIPHY, phone verification and Apple/Google device platform and push services. Requests to external providers can disclose network/device information and searches or interactions needed for their service. Church coordinates, not an account identifier, are used for church weather. GIPHY use is subject to its privacy policy at https://support.giphy.com/hc/en-us/articles/360032872931-GIPHY-Privacy-Policy. App Store privacy and Google Play Data safety disclosures describe collected data categories. Do not assume that third-party services receive no data. Google/Apple sign-in, email self-signup, additional church activation and live subscription billing are not enabled merely by this website migration.
Authorized church administrators can store their church's logo, directions address or coordinates, radio-tile preference, weekly bulletin drafts, source settings, appearance, reusable layout labels and print profile. These are church-owned records, not a private personal notebook. Account Holder identity and billing-sharing preferences are restricted to the audiences described in the app; being the billing contact does not itself grant administrator privileges. External bulletin sources are fetched by the server during explicit authorized test/refresh actions; provider credentials stay server-side.
When booklet PDF generation is enabled, an authorized administrator must explicitly confirm public distribution. Only explicitly public bulletin sections/items and separately print-approved contacts and notices are included. Private Directory contacts are not copied automatically. A bounded server process temporarily composes the PDF and removes its temporary files after success or failure; the server does not save, email, publish or mass print the generated file. You choose where to save or share the PDF on your device. Downloaded, emailed or printed copies are outside the app's deletion controls. Do not include anyone's contact information without permission for public printing. Weekly nature covers are generated artwork, not photographs documenting the specific church or a member. The operator prepares nature-only artwork without sending account records or bulletin contents to the image-generation provider. Each stored cover is tied to one church and service date; generating a cover does not approve the booklet's personal information or enable printing.
Optional Sabbath attendance uses device location to verify presence near the church during service hours. Raw coordinates are checked and discarded by the attendance service; the database retains account, service/date and attendance timestamps. Turning attendance off stops new observations and removes unconfirmed observations; confirmed records remain until account deletion. Device location and notification permissions can also be changed in Settings. Visitor check-in details are stored separately; contact us for deletion of visitor records that were never linked to an account.
Direct-message file bytes expire after 12 calendar months; the conversation can retain an expired-file marker. Permanently delete your account in Account Deletion. After password confirmation, the service removes the live account and associated personal data, including profile media, authored posts/comments/messages, study data, attendance, notification tokens and linked visitor records. Other participants’ contributions remain in shared posts, conversations, events and Bible studies. Church-owned settings, bulletin documents, reusable layouts and approved print profiles remain for the church; actor-account references are removed where applicable. Administrators must correct or remove personal details they entered in church-owned/public print content when appropriate. We remove the departing person’s memberships, attribution, text and attachments, leaving neutral discussion containers where needed. Another remaining study participant can manage the shared study. No Admin approval or support email is required for in-app deletion. If you cannot access the app, the external deletion instructions at https://thesd.app/account-deletion.html explain how to contact support. The app confirms completion and clears its account session and caches. Deletion cannot retract copies that other people previously saved independently. Operational backups are isolated from normal app use; a minimal irreversible account-ID digest and deletion timestamp prevent deleted accounts being restored. Backups must be processed for these deletion records before restored data serves users. No content is retained in that deletion ledger.
Optional detailed crash diagnostics are off by default. If you turn sharing on, the church server receives technical stack frames/binary identifiers, exception class or system error codes, app/build and OS versions, device model, crash time, memory/resource measurements and limited technical lifecycle events. Reports are linked to your account for access control and erasure and are available only to active Admins/Owner for app reliability. Reports exclude passwords, message text, photos, location, advertising identifiers, arbitrary application logs, exception messages and raw memory dumps. We do not use these reports for advertising or cross-app tracking. Native Apple/Google diagnostic availability and delivery vary. Your platform analytics settings remain separate. Pending reports stay in private app storage, excluded from backup. Reports expire after 30 days. Turning sharing off stops collection, clears pending reports and deletes your server crash reports; account deletion and termination also erase them.
Termination for a policy violation uses the same permanent data erasure as voluntary deletion. Suspension alone does not erase data. We retain account data while the account exists to provide the service, subject to deletion requests and any applicable legal obligations. We restrict administrative access and use encrypted network connections; no system can promise absolute security. Ask [email protected] about access, correction, deletion or this notice. The public notice is available at https://thesd.app/privacy.html. Material policy updates require each account holder to read and respond to the new versions before normal account use continues; you may decline, sign out or delete your account.