Privacy Statement

This statement explains what personal information the Three Angels Seventh-day Adventist Churchservice bulletin manager (the “Service”) collects, how it is used and the choices you have. The Service is operated by Three Angels Seventh-day Adventist Church(“the church”, “we”, “us”) for its own ministry.

The software and its hosting are provided to the church by Tompkins R&D (tompkinsrnd.com), which handles this information only to run the Service for the church.

1. Information we collect

• Account information: your email address, the name and phone number you give when you first sign in, and — only if you choose to set one — a password, which we keep as a one-way hash and cannot read.
• Whether you attend: if you tell us, on a card about yourself or when you first sign in, whether you actively attend the church. It is your own word, kept with the date you said it; it is not a record of official church membership, which the church clerk keeps. On the same card you may also say whether you are a member of the church; that too is kept as your own word, beside the clerk’s records and never in place of them.
• Sign-in provider information: if you sign in with Google or Microsoft, we receive your account identifier, email address, whether that address is verified and your name. We never receive your password.
• Church records: information entered by you or by other church members, such as service schedules and volunteer rosters, announcements, prayer requests, birthdays, membership business, event sign-ups and sign-ups to our email list from the bulletin (the name, email address and any phone number or birthday you give us); and, where the office records them, which household you belong to, family ties such as spouse or parent, and who brought you to church. A birth year, if the office holds one, is never printed.
• Checking in: if you check yourself in, your phone is asked once where it is, and we check that it is near the church; the location itself is not kept anywhere, not even in our activity log. What is kept is the attendance mark — that you were there, at which gathering and when — noted as your own, or as made by the adult of your household who checked you in.
• Achievements: the seals you earn are worked out from what you have done yourself — your welcome card, your picture, your household, the gifts survey — and from the attendance and roster the church already keeps. We keep which you earned and when. Only you and your household see them; nobody else, the church office included.
• Your household: if you start a household or join one — with its code, or by accepting an invitation — who is in it and how each person joined, and any children an adult of the household adds. Inviting someone sends one email to the address you give; nothing else is done with it until they accept. The church office sees every change to a household.
• Activity records: a log of changes made in the Service — who made them and when — kept for accountability and so mistakes can be undone. We do not record which pages you view.
• The welcome card: if you fill in our welcome card, we keep what you write on it — your name, how to reach you, any address or birthday you give, where you are in your walk with God, what you would like from us, and any prayer request, question or comment — and the notes the people who follow up visitors keep of their calls and visits. Only those people read it: it is not printed in the bulletin, not shown to other church staff, and not written into the change log (which records only that a card or note was added).
• Attendance: if the church takes attendance, we keep who was marked present at a gathering, who marked them and when, and any note made at the time. Only the people who take attendance and those the church allows to see it read it: it is not printed, not published, and never used to write to you. Marks are kept for 7 years and then removed.
• Church officers:the church keeps who holds each of its offices — an elder, a deaconess, the head of a ministry — for each year, with the dates a person began or stepped down, as its record of who served. Anyone the church lets use this Service may read it, as the printed roster in the church is read. While a nominating committee prepares the next year’s officers, it may note who it asked and what they answered; only the church clerk and the committee read those notes, and they are removed a short while after the committee’s work ends.
• The membership roll:the church clerk keeps the church’s record of who is a member — since when, and whether by baptism, profession of faith or transfer — with the date it was noted and by whom, and a note of the clerk’s own that only the clerk reads. It is kept beside anything you said about yourself, never in place of it. People the church lets read its directory may see whether a person is a member; it is never published, printed in the bulletin or put in a mailing.
• Voices for translations read aloud:where the church reads translated captions aloud, the office may record whether a person’s words should be read in a woman’s or a man’s voice, and a voice they prefer, so that when the caption desk names them as the speaker their words are read in a fitting voice. When nothing is recorded, the caption desk may guess woman or man from the pitch of the speaker’s voice: that is worked out on the desk’s own computer from the sound it already captions, the sound is not kept or sent anywhere for it, and only the guess is held, for that service alone. None of this is printed or shown to the congregation.
• Pastoral records:the church’s care team — the pastor and those the church names to it — keeps confidential pastoral records — a note of a visit or a call, a concern about somebody’s wellbeing, how people stand with one another as they perceive it, and an account of an incident and what was done about it. These are read by that small circle and nobody else, are never counted, printed or mailed, and are reviewed by the pastor on a set date rather than kept indefinitely. Somebody the church asks to pass concerns to the care team may raise one or report an incident; they see what they wrote and only what the care team chooses to share back with them. Whether you may see a pastoral record about yourself is the pastor’s to decide, case by case.
• Prayer requests:if you ask for prayer, we keep your request, who you chose to see it — the pastor alone, the church family, or the printed bulletin — and whether you asked for your name to be shown. A request for the church family is shown on the church’s Pray page, which anyone may open, signed in or not, as the printed bulletin is handed to anyone; it carries your first name only if you asked for it. A request for the church family or the bulletin is read by one of the church’s spiritual leaders before anybody else sees it — unless the spiritual leaders have chosen to share the church family’s requests as they are sent, or to share yours as they are sent; we keep that choice about you, and whether your requests are to be read first, and it is not shown to you. A spiritual leader may put the spelling or grammar right before sharing a request; we keep their words beside yours, and your own card shows both. A request for the pastor alone is kept with your care record, where only the pastor reads it. When somebody responds to a request or an update — I’m praying, Rejoicing and the like — we keep that they did so that we can show how many responded. Nobody is shown who, except those who chose Show my name: their first name beside the request on the Pray page anyone may open, and their full name to the church family signed in; the leaders see counts alone. A request you close, or that is answered, declined or taken down, is removed after 2 years, with its updates. Updates you add to your request, and the word you give when it is answered, are kept with it and read by a spiritual leader before the church family sees them (an update to a request for the pastor alone goes to the pastor alone). If you can sign in, we send you prayer mail — one email a day (or a week) with the church family’s requests, and, if you ask, an email at once when one is urgent or new. Whether or not you have signed in yet, we tell you when your own request is shared. Every prayer mail has a link to change it or stop it, and stopping it stops only prayer mail; we keep when each was sent, never what it said, for as long as we keep finished requests. Before a spiritual leader reads it, the words of the request are read by the church's AI provider, so that anything that may be hard to read reaches its reader with a note saying so; what it found is never shown to you.
• Bible study groups:if you lead or join one of the church’s Bible study groups, we keep that you do, since when, who invited you, and the group’s meetings — when and where it meets, or its online link. The group’s leaders, its members and the church’s Personal Ministries leaders see who is in it, by name; nobody in a group is shown another member’s email, phone or address. A leader may write to the group through the church's mailer; the letter goes to each member's own address without the leader ever seeing it, and every one carries a way to stop the church's mail. If you asked for Bible studies on a welcome card, someone on the church’s interest team may recommend you to a group: its leaders then see your name and what you asked for, never how to reach you, and an invitation is sent to you by the church. A note the interest team writes with a recommendation is read first by the church's AI provider, so that anything that may be hard to read reaches the leaders with a note saying so. When you leave a group, or it ends, the record that you were part of it is kept with the church’s records.
• Pictures:the church’s ministries may publish pictures of its gatherings on its website, in galleries a ministry’s leader puts together and the church’s communication leaders check before they are shown. Where children are in the pictures, they are published only once the consent forms are confirmed to be on file. A gallery may be kept to the signed-in church family, and is then never on the public website or a screen. Each picture is kept re-encoded, with what a camera records about it (its place, its device) removed. Anyone may ask for a picture, or a whole gallery, to come down from the gallery itself; it comes down, and nobody is asked why. A picture taken down is kept with its gallery and never shown again, until the gallery itself is deleted.
• Live captions: while captions are running, what is said in the service is turned into text. The words, the name the caption desk gives each speaker, and the passages of scripture heard are kept with that Sabbath’s record, where signed-in church staff can read them. The sound itself is not kept.
• Votes: when a motion is put to the church board, we keep who was asked, who voted and when, and what each voted — read by the church clerk and by the board members who were asked, and printed in the record of the vote; when a poll is sent to a mailing list or shared by a link, we keep who answered and what they chose, read by whoever ran the poll and, for a list, by those asked. A vote marked secret is different: the ballot is cast anonymously, so nobody — the clerk included — can see who voted for what, and the record says only whose ballot was issued. When the board meets, the secretary also keeps who was present and when they arrived and left.
• The spiritual gifts survey:your answers are your own: nobody else reads them, and you may delete them. The result worked out from them — the gifts as scored and the roles they point to, never your answers or your own words — may be read by the church’s spiritual leaders (the pastor and elders, and whoever else the church gives that level to), who help people find where to serve. Beyond that, only what you choose to share is shared — the roles you marked an interest in, with the church board and nominating committee, or your result with a group you name — and only for as long as you say. A report you ask for has an address only you hold.
• Activities: which exercises or surveys were assigned to you, by whom, and whether you started or finished them. Whoever assigns them sees that and nothing of what you answered.
• Mailing records: which mailings were sent to you and whether delivery succeeded, and, if you unsubscribe using a link in a mailing, which mailing that was. A copy of each mailing as it was sent is kept, including any files attached to it (such as the printed bulletin, which names who is serving that week). We do not record whether you open a mailing and our mailings carry no tracking image.
• Technical information: a session cookie that keeps you signed in, and a few preferences, such as table layouts, stored with your account.

2. How we use it

• to sign you in and decide what you may see and do;
• to plan services, schedule volunteers and produce the weekly bulletin and printed schedules;
• to keep the Service secure, and to investigate and correct errors;
• to contact you about the Service, such as sending sign-in links.

We do not sell personal information, use it for advertising, or share it with anyone for their own marketing.

Your name and contact details are kept in strict confidence. Three Angels Seventh-day Adventist Churchholds them in keeping with the Seventh-day Adventist Church’s practices for protecting personal information: they are used only for the church’s own ministry, care and communication, read only by the people whose work in the church needs them, and given to no one outside the church but the service providers below, who handle them only to run the Service. What the church itself chooses to publish is described in the next section.

3. What is published

The Service exists to prepare material the church shares. Names on service rosters, announcements, prayer requests and similar content may appear in printed or digital bulletins and schedules distributed to the congregation and visitors.

4. Service providers

We use a small number of third parties to run the Service. They receive only what is needed for the task:

• Hosting and email delivery, to run the Service and send sign-in links.
• Google and Microsoft, only if you choose to sign in with them.
• AI writing assistants (such as Anthropic, OpenAI or Google), which receive the text of an announcement or a mailing when someone asks for help writing it, and a flyer, poster or photo that someone uploads to start a mailing from it — the file itself, which may show whatever the picture shows; the church's directory is never sent with it, and the church's own published words — announcements, calendar entries, the order of service, prayer requests as the bulletin prints them — to translate them into the other languages the church offers, and the text of a motion when the clerk asks for a reading of it before it goes to the board, and a board meeting's agenda file when its text cannot be read any other way, and the words of a prayer request when a spiritual leader asks for its spelling and grammar to be put right before sharing it, and a page of the church's knowledge base about one of its offices, with the titles of the pages around it, when the person editing it asks for writing help, and the words someone writes for others to read — a prayer request, a welcome card's message, a concern or an incident written for the care team, a comment on a church board vote — before anybody else reads them, so that anything that may be hard to read reaches its reader with a note saying so; what it found is never shown to the writer.
• Bible, artwork and location lookup services, which receive search terms, verse references or a postal code — not your account information.
• Deepgram, which receives the sound of the service while live captions are running and turns it into text. It is sent from the caption desk’s own browser; this Service never receives or keeps the sound.
• Lara (Translated), which receives the captions’ words to translate them into the languages the church offers.
• Microsoft Azure, which receives translated captions to read them aloud for listeners who ask.
• YouTube, which receives the captions when the church sends them to its live stream, and — where the church has connected its YouTube account — each Sabbath's broadcast titles, descriptions and thumbnails, made from the bulletin, to schedule the broadcasts.
• Google Maps, which receives what is typed into an address or location box — the welcome card’s, and those the church’s staff fill in for its address and its gatherings — so it can suggest the address as it is typed. It is asked by this Service, not your browser, and receives nothing else from the form.

We may also disclose information if required by law, or to protect the safety of any person or the security of the Service.

5. Cookies

The Service uses a single essential cookie to keep you signed in. It does not use analytics, advertising or tracking cookies.

6. Security and retention

Information is sent over encrypted connections. Sign-in links, sessions, passwords and API keys are stored only as one-way hashes — a password salted and hashed so that nobody, the church’s administrators included, can read it — and third-party service keys are encrypted at rest. Failed password sign-ins are counted for a day to slow guessing, and you are emailed whenever a password on your account is set, changed or removed. No system is perfectly secure, but we take reasonable measures to protect what we hold.

We keep information for as long as it serves the church’s ministry and record keeping. Idle sessions expire. The change log is kept as a permanent record.

What you write on the welcome card is kept while the church is in touch with you, and for 7 yearsafter it closes the record, then removed. You stay in the church’s directory unless you ask to be removed. If you open your card from the personal link we send you, we note that you opened it, and which of our letters the link came in; we record nothing about ordinary links or whether you open a letter. If the church’s interest coordinator deletes the record sooner, a complete copy of it — including what you wrote and the notes kept about it — is placed in the church’s permanent change log, which only its administrators can read.

We also keep a permanent copy of each week’s bulletin as it was published. Once a bulletin is no longer the current one, a record of it is stored so the church can always see what was printed on a given Sabbath. That record includes whatever the bulletin showed — the names of those who served, birthdays, announcements and their contact details, and any special prayer requests printed that week. These records are kept indefinitely, are visible only to signed-in church staff, and are never published on the public bulletin page.

7. Your choices

You may ask to see, correct or remove personal information about you by contacting a church administrator. You may also check your own details yourself, from the personal link we send you or from your account: correct what has changed, and leave blank anything optional you would rather we didn’t keep. Some records, such as the change log, are kept where the church has a legitimate need to retain them. Where you ask to be removed from the stored copies of past bulletins, an administrator can do so: your name and details are taken out of those records, and the change itself is logged. Removing a name from a past bulletin does not change the bulletin that was printed and handed out at the time.

8. Children

The Service is intended for adults who help run the church. It is not directed at children, and children should not create accounts.

9. Changes to this statement

We may update this statement from time to time. The effective date above shows when it last changed. See also the Terms of Service.

10. Contact

Questions about this statement or your information can be directed to the church office.