Privacy policy

Last updated October 4, 2026

The short version: SmolGroup is free, has no ads, and never sells or shares your information. Each church's information is only visible to that church's approved members, and the most sensitive parts only to its leaders. Churches decide what goes into their directory, and we just keep it safe for them.

Who we are

SmolGroup is a free church management service run by an individual volunteer, not a company. When this policy says “we”, it means the person who runs SmolGroup. You can reach us at info@smolgroup.org.

Each church on SmolGroup decides what information to keep about its people and who in the church can see it. We store and protect that information on the church's behalf. For questions about what your church keeps about you, ask your church's admins first. We're also happy to help.

What we collect

Your account: your name, email address and password. Passwords are stored in scrambled (hashed) form by our sign-in provider, so nobody, including us, can read them.

What churches enter: church leaders and admins may add information about the people in their church, which can include:

names, email addresses, phone numbers, birthdays and household addresses
profile photos, added by a leader or by the person themselves. A photo is shown only to people in that church who can see that person in the directory, and location data from the camera is removed when it's uploaded
membership status, small groups, attendance and check-ins
volunteer schedules, whether someone accepted or declined, and dates people say they're away
care notes (for example prayer requests or follow-ups), which only that church's leaders and admins can see
allergies and medical notes, and children's check-ins and pickups (with a pickup code), which only that church's leaders and admins can see. A child's allergy notes are printed on their name tag
answers to forms a church asks people to fill in (such as a connect card or prayer request), with the name, email and phone given. Someone filling in a public form may be added to that church's directory if the church has chosen that
event registrations and sign-ups: the name, email, phone, number of people, any answer given, and any registration fee paid (through the church's Stripe account)
giving records: the amount, date, fund and method of each gift, and the name and email a giver used when giving online. Card and bank details go straight to Stripe and are never stored by us
songs, service plans, slides, files added to songs (such as chord charts and rehearsal recordings), and uploaded images such as slide backgrounds and church logos
emails that leaders send through the site, and a record of who sent them, when, and to how many people

Technical information: a small cookie that keeps you signed in, a notification token for each phone where you use the SmolGroup app and allow notifications, and basic logs kept by our hosting providers (such as IP address, browser type and the time of a request) to keep the service running and secure. We don't use advertising or analytics cookies, and we don't track you across other websites.

How we use it

Only to run SmolGroup:

to show each church its own directory, groups, calendar, services and slides
to sign you in, and to send account emails such as confirming your address or resetting your password
to email you when you're asked to serve, and a reminder a few days before, with links to accept or decline
to confirm event registrations and sign-ups, tell you if a waitlist spot opens, and remind you the day before
to email you your year-end giving statement, if your church sends them
to deliver emails your church's leaders send you. Every one has an unsubscribe link, and replies go straight to the leader who sent it
to keep the service secure, fix problems and prevent misuse

We never sell or rent your information, show ads, or use it for marketing. We don't share one church's information with another church.

Who can see your information

Your church: approved members can see the calendar, services and songs. By default they only see themselves, their own household and the groups they belong to (with those groups' members), and their own volunteer schedule. A church's admins can choose to open the full directory to all its members. Leaders and admins see everyone, plus attendance, care notes, allergy notes and kids check-ins, and can edit information. People waiting for approval can't see anything.
Other churches: nothing. Churches can only find each other by name when someone searches to join one.
Us: as the operator, we have technical access to the database. We only look at a church's information when that church asks us to help with a problem, to keep the service secure, or when required by law. Our admin page shows only a list of churches, their web addresses and how many accounts each has.
TV display links: anyone who has a presentation's private display link can see that presentation's slides, but nothing else. Churches can replace a link at any time.
Forms: responses are seen by the church's leaders. Responses to a form the church marks private (such as prayer requests) are seen only by its admins and the leaders looking after that form.
Group finder: anyone can see the groups a church chooses to list (name, description, when they meet and a general area, never the exact place or who's in them). If you ask to join, your name, email, phone and message go to that group's leaders and the church's leaders.
Event sign-ups: a church's leaders see who registered or signed up. Other people see only how many spots are left or taken, never names. Each registration has a private link for changing or cancelling it.
Giving: who gave what is visible only to a church's admins and the people they give its finance permission to (such as a treasurer). Everyone can see their own giving and print their own statement.
Public calendar: anyone can see the events a church's leaders choose to make public (their title, time, place and description) on that church's calendar page and calendar feed. It never shows anything about people.

Services we rely on

We use a few trusted providers to run SmolGroup. They handle information only to provide their service to us:

Supabase: database, sign-in, image storage and live slide sync
Vercel: hosting the website
Hostinger: sending account emails and church messages from info@smolgroup.org
Expo, Apple and Google: delivering notifications to the SmolGroup phone app. They receive the notification's text and a device token, nothing else
Stripe: processing online gifts. Each church has its own Stripe account, and gifts are paid to it directly; Stripe's own privacy policy covers the payment details it collects
Bible text services (the Free Use Bible API, Tyndale's NLT API, and the ESV API if enabled): these receive only the scripture reference being looked up, such as “John 3:16”, never personal information

These providers may store information on servers in the United States or other countries.

How long we keep it

A church's information is kept for as long as the church uses SmolGroup.
A church's admins can delete the church at any time from its Church settings page. Everything belonging to it is deleted right away: its people, groups, events, songs, slides, images and memberships.
If you leave a church, you lose access right away. Your entry in that church's directory stays unless the church removes it.
You can delete your account yourself at any time from your account page. It takes effect immediately. If you can't sign in, email info@smolgroup.org and we'll do it within 30 days.

Children

You must be at least 13 to create an account. Churches may list younger children in their directory, for example for kids' ministry or check-in. When they do, the church is responsible for having a parent or guardian's permission, and should keep children's information to what's needed. If you believe a child under 13 has created an account, email info@smolgroup.org and we'll remove it.

Keeping it safe

All connections are encrypted (HTTPS). The database enforces each church's access rules itself, so one church can't reach another's information even if the website had a bug. No system is perfectly secure, though. If we learn of a breach affecting your information, we'll tell the affected churches promptly.

Your choices and rights

See and correct: you can edit your own contact details on your church's My account page, and ask your church's admins to correct anything else.
Get a copy: use Download my data on your account page for your account, churches, directory entries, groups, volunteer assignments and attendance. Church admins can download everything their church holds from Church settings. Care notes are written by church leaders and aren't in your personal download. To ask for them, email info@smolgroup.org.
Stop church emails: use the unsubscribe link at the bottom of any church email. Leaders can see that you've unsubscribed, but can't sign you back up.
Delete: delete your account yourself from your account page, and ask your church's admins to remove your directory entry.

Depending on where you live (for example in the EU, the UK or California), you may have further rights, such as objecting to how your information is used or complaining to a data protection authority. Email info@smolgroup.org and we'll help.

Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll also let church admins know by email or on the site before the change takes effect.