This Privacy Policy explains how Firestarter Inc. ("we," "us," or "our") collects, uses, stores, and protects information when you use the Ekklesia PH mobile application and platform (the "App"). By using the App, you agree to the practices described in this policy.
1. Who We Are
Ekklesia PH is developed and operated by Firestarter Inc. The App is provided to church and ministry organizations and their members for managing events, giving, volunteering, announcements, and related activities.
This service is intended for adults. You must be at least 18 years old to hold an account, and it is not directed to children.
2. Information We Collect
2.1 Information you provide
| Category | Examples | Why we collect it |
|---|---|---|
| Account & Contact | First and last name, email address, phone number, password (stored hashed) | To create and authenticate your account, send transactional notifications, and identify you within your organization |
| Profile | Date of birth, gender, profile picture | To personalize your profile |
| Payment Account Info | GCash, Maya, or bank account details you choose to add | To receive disbursements or be reimbursed by your organization (you control this) |
| Financial / Transaction | Giving records, event registration payments, payment proof screenshots | To process and display your contribution and registration history, and for admins to verify manual payments |
| User-Submitted Content | Waitlist sign-up names, giving notes, form responses | To fulfill the action you submitted (e.g., joining a waitlist) |
| Photos | Profile picture and payment proof images you choose to upload | To display your profile and verify manual payments |
2.2 Information collected automatically
| Category | Details | Why we collect it |
|---|---|---|
| Device ID (Push Token) | Expo push notification token, device platform (iOS or Android), and a device identifier the App generates at install — a random value that identifies the installation, not you | Solely to deliver push notifications and to keep one device's registration from being confused with another's. Your device's registration is removed when you sign out or delete your account. |
| User ID | An internal account identifier assigned at sign-up | To associate your records (events, givings, etc.) with your account |
We do not collect: precise location, contacts, browsing history outside the App, advertising identifiers (IDFA/AAID), microphone audio, or biometric data.
When you register, sign in, or accept our terms, we also record the IP address the request came from and the browser or app you used. It is kept alongside the record of what you accepted and when, because that combination is what makes the record meaningful: it shows the agreement was made from your connection at that time rather than asserted on your behalf afterwards. We do not use it to follow you across other sites, and it is not shared beyond the purposes set out in section 4.
3. How We Use Your Information
All data we collect is used only for App functionality, including:
- Authenticating you and securing your account
- Enabling features such as event registration, giving, volunteering, and announcements
- Sending push notifications you have opted in to receive
- Processing and verifying payments you submit to your organization
- Providing customer support
- Preventing fraud and abuse, and ensuring service reliability and security
We do not use your data for advertising, marketing, analytics, profiling, behavioral tracking, or product personalization.
4. How We Share Your Information
We do not sell or rent your personal information. We share data only with:
- Your church/ministry organization administrators — within the App, organization admins can see member information necessary to manage the organization (e.g., attendance, giving records they administer).
- Service providers acting on our behalf — strictly to operate the App:
- Supabase — database and file storage hosting
- Railway — application hosting
- Resend — transactional email delivery
- Twilio — SMS delivery for phone verification and text notifications
- Expo — push notification delivery
- Apple Push Notification Service / Firebase Cloud Messaging — to deliver notifications to your device
- Other members of your organization — your member profile is public within your organization by default, so co-members can find you and see your profile and contact details. You can make it private at any time in the App's Settings; a private profile is visible only to your organization's administrators and to members you are linked with (for example a discipleship leader or partner).
- When required by law — to comply with a valid legal request, court order, or to protect rights, safety, or property.
Payments and in-app purchase. The App does not process payments, and offers no in-app purchase and no subscription. Nothing in the App can be bought, and we never receive card details through it. Contributions you give to your church are received by your church and are between you and your church; the App only lets a giving record note that a payment was made. Apple's App Store and Google Play are the storefronts the App is distributed through — they are not payment processors for anything you buy from us, because there is nothing to buy.
5. Data Tracking
The App does not track you across other companies' apps or websites, and does not share any data with data brokers or advertising networks.
6. Data Security
Data is encrypted in transit using HTTPS/TLS, and passwords are stored only as salted hashes (BCrypt) — we never store your password itself. The database and file storage we use run on managed infrastructure that encrypts data at rest. The API requires an authenticated JWT for every request, and access to production data is limited to people who need it. No system is perfectly secure, but we work to protect your information against unauthorized access, alteration, disclosure, or destruction.
7. Data Retention
We retain your account data for as long as your account is active. Financial records (giving, payments) may be retained longer where required for accounting, tax, or legal compliance. Records of your acceptance of our Terms of Service and Privacy Policy are kept for the same reason and on the same footing: they are the evidence of an agreement, and an agreement we cannot produce is not much of one. They therefore survive account deletion — what remains is anonymized, reading only that a particular version of a document was accepted on a particular date.
When you delete your account, your identifying profile fields are erased or replaced with anonymized values, and your organization memberships, registered devices, one-time verification codes, push notification registrations, notification preferences, and sign-in tokens are deleted. Records that belong to your church — a giving record or an event registration, for example — are kept, because they are the church's records, but they are no longer linked to you as a person, except where retention is required by law.
Some information is held on your own device rather than by us — recent searches and cached content, for example. Deleting your account does not clear that cache. You can remove it at any time by clearing the App's data or uninstalling the App.
8. Your Rights and Choices
Because we operate in the Philippines, the Data Privacy Act of 2012 (Republic Act No. 10173) applies to the personal information we hold. As a data subject you may exercise the rights it gives you — to be informed, to object, to access, to rectify, to erase or block, to claim damages, and to lodge a complaint with the National Privacy Commission.
Requests about the personal information held about you go to privacy@ekklesiaph.com. That is a different thing from deleting your account: if you want the account itself closed, use the account deletion page or the delete option in the App, and the member terms set out what happens to records your church keeps.
- Access and update — view and edit your profile, payment accounts, and notification preferences in the App's Settings.
- Delete your account — you can permanently delete your account from within the App (Settings → Delete Account). This removes your personal data subject to legally required retention.
- Push notifications — disable at any time in your device settings or by signing out.
- Camera — used to scan event QR codes when checking in. Photo library — used to attach images you choose to share, including a receipt or proof of payment against a giving record. Both can be reviewed or revoked at any time in your device settings; revoking camera or photo access stops those features working but does not stop you using the rest of the App.
- Data requests — contact us at the address below to request a copy of your data, correct inaccuracies, or restrict processing.
9. Children's Privacy
Accounts are intended for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal information from anyone under that age. If you believe someone under 18 has created an account, contact us at the address below and we will close the account and remove the data.
This is separate from information a church holds about a minor — a parent registering a child for an event, or a giving record made on a child's behalf, for example. There, the church is the organization that collected the record and is responsible for it, and we process it only to provide the App to that church. A parent or guardian can ask their church to correct or remove such a record, or contact us and we will help.
10. International Users
Your data may be stored or processed on servers located in jurisdictions different from your own (e.g., Supabase and Railway infrastructure). By using the App, you consent to such transfers in accordance with this policy.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy at this URL with a new "Last updated" date. Material changes will be communicated through the App where practicable.
12. Contact Us
If you have questions, requests, or complaints about this Privacy Policy or your data, contact us at:
Firestarter Inc.
Data protection contact: privacy@ekklesiaph.com