My Holy Journey

Scope. Covers holyjourney.app (the member portal). The holyrenewal.com website, including its Scorecard, has its own notice. The portal holds no Scorecard or marketing-lead data (PORTAL-PLAN §4.11).
What we collect.
Account: name, email, optional password (stored only as a secure hash), sign-in codes (hashed, short-lived).
Your 18+ confirmation and your consents (Terms, auto-renewal), with the version and date.
Parish membership and role (participant, leader, mentor, parish administrator).
Learning: lesson progress, notes and your private journal (encrypted).
Purchases: what you bought, dates and amounts. Card details are collected and held by Stripe, not by us.
Technical and security: session data, a hashed IP address for rate limits and abuse prevention, and audit logs (which hold IDs, not journal text).
How we use it. To run your account and access, show your progress, process payments and renewals, send service emails (sign-in codes, receipts, renewal reminders, account notices), keep the service secure, and meet legal and tax duties. No third-party advertising pixels on holyjourney.app. [TBD: Kevin/Mark — confirm whether any analytics run.]
Who can see what.
Your parish: your parish's administrators, leaders and mentors see your name and progress only, never your journal.
Holy Renewal staff: may see account and progress data to support you; the system is built so staff can't read journal text. [COUNSEL: wording of this assurance.]
Service providers (processors) that run the service for us: Neon (database hosting), Vercel (app hosting), Resend (email delivery), Stripe (payments). [TBD: Mark — US data locations; Neon region is iad1.]
Legal: when required by law or to protect someone's safety.
Each parish's data is kept separate; one parish never sees another's.
We don't sell your information. We don't sell or rent personal information, or share it for targeted advertising. [COUNSEL: state-law definitions of "sell"/"share".]
Sensitive information. "Your journal, notes and the faith-formation content you engage with may reveal religious beliefs. We encrypt journals, never show them to your parish or use them for marketing, and process this information only to provide the service you asked for." [COUNSEL FLAG] Religious beliefs are "sensitive data" under the Virginia (VCDPA), Colorado (CPA) and Connecticut (CTDPA) privacy laws and several similar state laws, which may require opt-in consent and data protection assessments. Counsel to confirm whether these laws apply to Holy Renewal (thresholds), and whether a separate sensitive-data consent at sign-up is needed. No conclusion drawn here. Same open question as the Scorecard entry (line 544).
How long we keep it (retention). *Source: RAYMOND-INPUT §3 and PORTAL-PLAN §4.11. These are proposals; the PRICING-DECISIONS retention entry (line 544, 2:52 PM) covers Scorecard leads only, not the portal. Kevin to confirm.*
Accounts with active or lifetime access: kept while access lasts; never purged for inactivity.
Accounts with no active access: deleted after 24 months of inactivity, after a 30-day warning email that offers an export. [Kevin to confirm]
Journal and notes: deleted when you delete your account (the encryption key is destroyed).
When you leave a parish or its license ends: you keep your account, progress and journal; the parish loses its view of you. Parish rosters: deleted 12 months after the license term ends.
Purchase and billing records: 7 years (tax and accounting).
Audit and security logs: 2 years.
Backups: deleted data rolls off backups within about 35 days. [Mark: true only once the nightly backup is built with ≤35-day retention; Neon Free history is 6 hours today.]
Consent records (18+, terms, auto-renewal): [TBD: Kevin/counsel — Scorecard uses "life of the contact plus 3 years" (line 544, Raymond's proposal, not separately confirmed).]
Your choices and rights. Download your data (Account → export); correct your name; delete your account; turn off auto-renewal. Requests by email to [TBD: privacy/support email]. We'll respond to deletion requests within 30 days [COUNSEL to confirm the period and the state-law rights to list (access, correction, deletion, portability, appeal)].
Security. Encryption in transit and at rest, encrypted journals, hashed codes and passwords, staff two-step sign-in, access limited by role. [COUNSEL: avoid guarantees.]
Adults only. "Holy Journey accounts are for adults 18 and older. We don't knowingly collect information from children under 13 (or minors under 18). If we learn we have, we delete it." [COUNSEL: COPPA wording.]
Changes and contact. Version date; email notice of material changes; Holy Renewal, LLC, [TBD: address and email].

Holy Journey Privacy Policy