Privacy Policy

Who we are

Sunday Everywhere is made and run by LifeScribeAI LLC, 8605 Santa Monica Blvd #467856, West Hollywood, CA 90069-4109. For anything in this policy, write to legal@lifescribeai.com.

This policy covers the website, the app, each church’s public page, and the email we send you. It does not cover the platforms a church connects (YouTube, Facebook, Instagram, TikTok, X), the email and texting tools it pastes into, or its own website; each of those has a policy of its own.

What we hold

• Your account. Your email address, the name you give, and when you sign in. Sign-in runs on Supabase Auth on our behalf; there is no password anywhere.
• Your church’s settings. Its name, address and phone, its service times and time zone, its mission and vision, how it wants to sound, its image style, its hashtags, and the safeguard policies it chose. From its address we read public census figures for its ZIP code area (ages, backgrounds and the languages spoken at home, never income, poverty or crime) to picture its community: figures about an area, never about any person.
• Credentials. A church enters no vendor key. Its social accounts are connected by signing in on each platform’s own page into a profile held for that church; we never see or hold those passwords.
• Sermon recordings. The recording the church uploads, or fetches once from a share link to its own Google Drive, Dropbox or OneDrive. We never download anything from YouTube or any other video platform. A cached copy of the recording is kept for thirty days after the week reaches review and then released; the church’s own copy stays where it was.
• The church’s photos. The photos a church adds to its library in Settings (its building, its people, its events), each with its attestation record: who confirmed that the photo is the church’s own or used with permission and that the people shown agreed to its use, when, and the version of the words they confirmed. Each photo is written again without its camera, place or time details, and described once so it can be matched to a post. A church’s photos are never shown to another church and never used to train any model. A photo the church removes is deleted then; the photos and their attestation records are kept until the account is deleted.
• Transcripts and products. The transcript, what was drawn from it (themes, quotes, scripture, the events announced from the front), the drafts made from it (posts, the blog post, the email, the text, reel moments and their captions), the pictures and the music beds, and the record of who approved, edited, scheduled and posted each one. With them, the safeguard findings: the words a screen quoted, why, and who resolved each and how. With the week too, the checks of what the church uploaded (the recording’s frames and each picture it added), any hold on the week or pause on the account, why, and who cleared it and when.
• The approval record. Each time a person at the church approves a piece or a reel: who, when, the IP address and browser of the request, the version of the Terms, and a fingerprint of the exact words (a number from which the words cannot be read back). It is the church’s record that it approved what went out, read by the church’s Admins and by our operators, kept with the week’s record, and included in the record we produce for the church if who approved or posted something is ever disputed. With it, each approval the screen refused: the church, the piece, the category and who asked.
• Fingerprints of what went out. A fingerprint of each post and reel that went out, a set of numbers that cannot be turned back into its words, kept to warn the church before it repeats itself and to stop the same post going to the same account twice within thirty days, and a fingerprint of each reel approved or posted, so a reel goes out once; both until the account is deleted.
• Likes. When someone taps the heart on a church’s page we set a cookie (se_fan) holding a random number, and keep a hash of it with the item and the time, so a like counts once and can be taken back. The cookie is not tied to a name, an email or an account, and we cannot tell who it is from the hash.
• Links. When someone taps one of this site’s own links in a post, an email or a text, we count the tap, once for each network in an hour, with no cookie and nothing stored about the person.
• Reports. When someone reports an item or a page we keep the reason they chose from a fixed list, the item, the church, the time, the email address if they give one (to tell them what we did), and a hash of their network address that lets us see one source repeating itself and never the address itself. A report has no text and no file.
• What a church publishes. The blog posts and events a church approves and publishes on its page, as they were approved, with their pictures. They are the church’s words, shown to anyone. The page also links to the church’s own website and its own sign-up page; both are the church’s, not ours, and we keep no list of the people who use them.
• A church’s own lists. The weekly email and text are copied from the app and pasted into the church’s own email and texting tools, or, where the church connects such a tool, sent through it on the church’s instruction. Those tools hold the lists the church keeps there, their consent records and their unsubscribes. When a church connects one, we hold its key sealed, read the names of the groups the church chooses, and send nothing to anyone the church has not chosen there. We keep no list of a church’s congregation, and no spreadsheet is imported anywhere.
• Usage records. One record for every paid call the platform makes on a church’s behalf (a model, a transcription or music service, an image, a post): the vendor, the kind of work, what it cost us, and the person who caused it when one is known. The church sees this as points against its plan, never as a price.
• Messages to us. Feedback sent from the app, with its type, any screenshot you add, and what the page saw around it: its address, your browser, screen size, the app’s version, your role and the page’s last errors. Reports a page files by itself when it fails to load, with the browser and the network address it came from. Questions asked of the help panel and their answers, a conversation you pass to a person, messages sent through the contact page, and our replies, which we email to you.
• Talking it through with Selah. When you talk with Selah, ElevenLabs hears your voice to hold the conversation, records none of it and keeps the words for a day; we keep the words for thirty days and then delete them, and nothing you say is saved to your settings until you choose Use these settings.
• Technical records. Server logs with the address and browser a request came from, kept for security, and the addresses the limits on sign-in, the contact form, the preview lock, likes, reports and missed addresses on a church’s page keep for an hour and clear after thirty days. A network that abuses a church’s page may be blocked, for a day or longer, by a record of its address, kept until the block ends. Each time one of our operators opens a church’s pages: who, which page and when. We run no analytics and set no advertising cookies (see Cookies).

Why we hold it

• To run the service for your church: to transcribe, draft, screen, render, schedule and post what a person at the church approves, within the posting policy that keeps every church’s sends spaced and within each platform’s limits.
• To keep it secure: to sign you in, to keep one church’s rows apart from another’s, and to see when something goes wrong.
• To bill the account for its plan (Stripe processes the card at checkout), and to show the church its usage as points.
• To answer you when you write, to email a church’s Owner and Admins about its work (a week ready to review, a pause, a piece that cannot go out, someone who joined its team), to email someone a church adds to its team an invitation to sign in, and to tell account owners about changes that matter.
• To keep the service safe and lawful: to screen what is drafted, painted and uploaded, to hold a week or pause an account while a person reviews it, and to report and preserve what the law requires.
• To meet the law, and to keep the records tax and accounting law require.

We use it for nothing else. We do not sell it, we do not share it for advertising, and we do not use your church’s content to train models.

How AI is used

Transcripts, the understanding of a sermon, drafts, pictures and music are produced by models we pay for on the church’s behalf: every text, vision, picture and short-audio model is reached through OpenRouter (today Anthropic’s Claude, Google’s Gemini, Meta’s Llama and OpenAI’s GPT models), only on providers that keep nothing and train on nothing we send; the transcript and the music through ElevenLabs (which receives the service recording, and any video a church uploads as a reel, to transcribe it); when ElevenLabs cannot transcribe, a second speech model runs on our own machines. What is sent to them is the church’s own content, as it was said; the transcript and every draft are then screened for hate or derogatory speech and for profanity under the policies the church chose in its Settings, and in every church for four hard limits: a threat or call to harm a real person or group, encouragement of suicide or self-harm, sexual content involving a minor, and the exploitation of a minor. The exact words are screened again whenever they change and once more at approval; if the screen cannot be reached, nothing is approved. To frame each reel on the person speaking, a small model finds where faces are in the recording and a vision model checks the finished reel shows the speaker whole; nobody is identified, and no face, template or likeness is kept. Every draft waits for a person at the church to read and approve it; nothing is published or sent by a model. Our providers process content to answer the request and are bound by their own terms; we send a provider nothing but what the request needs, and we do not use the church’s content to train models of our own. How AI is used says more in plain words.

To keep the service safe, some of what a church gives us also goes to safety models, which look for what must never be published and answer only with what they found. The words of the transcript and of every draft go to a text safety model, which reads them a second time for the hard limits and, in public pieces only (social posts, reel captions and the blog post), looks for private details about a named person. A frame from every thirty seconds of each recording, each picture a church uploads (its photos, its leader’s picture and its logo) and every picture we paint go to a picture safety model, which looks for sexual, violent, self-harm and hateful content. They are reached through OpenRouter like every other model, only on providers that keep nothing and train on nothing we send. What they find is a finding, kept with the week and its record; a hold or a pause is reviewed by a person. Material that appears to show sexual content involving a minor is sent to no model again.

Who else touches it

• Supabase, for the database, the files and sign-in, in the United States.
• Google Workspace, which carries our email from noreply@sundayeverywhere.com: sign-in, the invitation to someone a church adds, the notices to a church’s Owner and Admins, and our replies to you; and whose storage holds our nightly copy of the database, encrypted with a key Google does not have, for our own recovery.
• Cloudflare, whose Turnstile check guards sign-in, the Report on a church’s pages and the contact form against scripts, and receives the address of the browser it checks.
• Vercel, which runs the website, the app, and the machines that process each church’s recordings, and which serves a church’s public page to anyone who asks for it. Search engines may index a church’s page after launch; a page its church has turned off, or whose account has ended, is not shown. A church’s own website may show its blog, reels and calendar from sundayeverywhere.com, which sees that visit as it sees a visit to the church’s page.
• OpenRouter, through which every model is reached (today Anthropic’s Claude, Google’s Gemini and OpenAI’s GPT models, for reading, writing, screening, safety checks of words and pictures, pictures, short audio clips and Help), only on providers that keep nothing and train on nothing; and ElevenLabs, which transcribes the service recording and any video a church uploads as a reel, composes the music, and holds the conversation when you talk with Selah.
• The church’s own sending tool, where the church connects it (Text In Church today): the approved email or text, sent through the church’s account to the group it chose; we hold the church’s key for that tool sealed.
• A church’s own photos go to a vision model once, to be described, and to the picture model as a style reference for its AI pictures only when the church chooses so in Settings; both are reached through OpenRouter, only from providers that keep nothing and train on nothing. Every picture a church uploads, and a frame from every thirty seconds of each recording, also goes once to a picture safety model to be checked, the same way.
• PostPeer, which carries an approved post to the social accounts the church connected, in a profile held for that church alone.
• Stripe, which processes the card at checkout and each payment after it. Card details go to Stripe and never to us.
• The platforms the church posts to, under their own terms.
• The cloud drive a church shares a recording from (Google Drive, Dropbox or OneDrive), which we fetch from once.

Each of these receives what its job needs and nothing more. We do not share personal information with anyone else unless the law requires it, you ask us to, or a church’s content shows that a person is in danger of serious harm, when we may tell the authorities what they need to protect that person, as the law allows. Where the law requires us to report material or to keep it, we do, and it is not deleted on the usual schedule.

In particular, where the law requires, we report apparent sexual material involving a minor, and facts that indicate the apparent sex trafficking or enticement of a minor, whether found in a picture, a recording or words, to the CyberTipline of the National Center for Missing & Exploited Children, with the information the law asks for about the account it came from. The center may share a report with law enforcement, and we report to law enforcement where the law requires. We preserve what we report, and that information, for one year, or longer where the law or law enforcement asks. Where the law keeps a report confidential, we do not tell the church of it.

How long we keep it

• A cached sermon recording: thirty days after the week reaches review, then released. The church’s own copy stays where it was.
• What the church approved or sent (its reels, posts, blog, email, text, pictures, notes and transcript): kept, and stored at a reduced size after thirty days, until the church removes it or leaves.
• What was not approved, and the recording: deleted thirty days from the day the week is made. The church can download each week at any time, and in full quality within those thirty days.
• The week’s record (what was made, who approved it and when, where it went and what it reached), the findings and any hold, usage records, the audit log, the church’s library, feedback and help threads: until ninety days after its plan ends, then deleted.
• Billing records: kept by Stripe, our payment processor, for as long as tax and accounting law require.
• Each person’s own sign-in: until the person asks us to delete it.
• Likes: with the item they are on. Reports: a year, and after that without the email address. What a church publishes: until the church takes it off its page or leaves, and hidden while its plan has ended, when the whole page closes.
• Messages to us with no church (the contact page, a page’s own error report): two years. The network address on an error report: ninety days.
• Server logs, and the addresses the limits keep: up to ninety days.
• Backups of the database, made by our database provider and by us on Google’s storage, encrypted, for our own recovery: never more than thirty days.
• Material we report under the law, and the information that goes with it: one year from the report, or longer where the law or law enforcement asks.
• Material the law requires us to keep: for as long as it requires, whatever the schedule above.

When a church leaves, its social connections are closed after thirty days, and ninety days after its plan ends its rows and its files are deleted. A church can ask for deletion sooner, and for its record at any time.

We keep content to make and deliver your church’s work, not to store it for you. The times above are the longest we keep each kind; content can be lost sooner, by an accidental deletion or another cause, and our backups are for our own recovery, not a copy kept for you. Keep your own copies: the original of each recording, and each week’s download while it is available. The Terms (sections 4 and 13) say who bears the risk of a loss.

Your rights in California, and everywhere

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over their personal information. We honor them for everyone, wherever they live:

• To know what personal information we hold about you, where it came from, why we hold it and who we share it with.
• To delete it, subject to what we must keep by law or to finish work you asked for.
• To correct anything inaccurate.
• To opt out of sale or sharing. We sell no personal information and share none for cross-context advertising, and have not in the twelve months before this version. There is nothing to opt out of; and because we do not track you across other sites, a Global Privacy Control signal changes nothing.
• To limit the use of sensitive personal information. We use none beyond what running the service needs, and never to infer anything about you.
• Not to be discriminated against for using any of these rights.

How to ask. Write to legal@lifescribeai.com, or ask your church’s account owner, who can ask us for you. How we check it is you. We reply to the email address on your account and may ask for something only its holder would know; we never ask for a password, because there is none. An agent may ask on your behalf with your written permission, and we verify both of you. When you hear back. Within forty-five days; if a request needs longer we say so and take up to forty-five more. There is no charge.

Much of what we hold is held for a church and not for you as a person: a sermon, the drafts made from it, an approval. A request about those goes to the church, which decides, and we carry out what the church asks.

Children

Church staff must be eighteen or older; we do not knowingly hold information from anyone under thirteen, and we delete it when we learn of it. A church’s page is not directed at children, and a like collects no name or address. Children appear in sermons and stories; the church decides what may be said about the children in its care, and a person at the church reads every draft before it goes out. Recordings, uploaded pictures and drafts are checked for sexual material involving a minor and for the exploitation of a minor, which we report as the law requires (see Who else touches it).

Security

Every person signs in with a link or a code sent to their email; the operators who run the service also use an authenticator app. A church enters no credential of its own; the keys the platform uses are sealed under a key held apart from the database. Each church’s rows are separated by the database itself, not by convention. Everything travels over encrypted connections. The operators who run the service may open any church’s pages, read-only, to keep the service running and to fix problems, and may read the help panel’s conversations and the feedback sent to us; each look, and every page it reads, is recorded. Operators cannot approve, edit or send anything for a church. After review they may clear a finding made in error, a hold on a week or a pause on an account, and each of those is recorded. If a breach touches your personal information we tell you, and the authorities the law names, as the law requires.

Where it is processed

In the United States. If you use the service from elsewhere, your information is processed there under this policy.

Changes

A new version carries a new date at the top. A change that matters is sent to account owners by email thirty days before it takes effect. The version you agreed to is recorded when you sign in.

Contact

LifeScribeAI LLC, 8605 Santa Monica Blvd #467856, West Hollywood, CA 90069-4109. legal@lifescribeai.com.