Privacy Policy

Youthible is a platform for church youth leaders to build, run, and share Bible study sessions with young people. It is currently operated by [legal entity name to be confirmed] ("we", "us"), a body distinct from any individual church using the platform. Our contact address for privacy queries is [registered address to be confirmed], and you can reach us at [privacy contact email to be confirmed].

This policy explains what we collect, why, and what rights you have — both for adult users (church leaders and admins) and for young people using the student app. Because Youthible is used with under-18s, we've written the young-person section separately and kept what we collect about them to the minimum needed to run a session.

• Name and email address, when you create an account (directly, or via Google sign-in).
• Your church's name and, if you complete verification, the charity registration number you provide — we check this against the Charity Commission for England and Wales register to confirm it's real; we don't store anything else from that lookup.
• Content you create — Bible studies, series, images, and any text you ask our AI features to help write or research.
• Billing details, if your church subscribes to a paid plan. Card numbers are entered directly into Stripe, our payment processor — we never see or store full card details ourselves.
• Basic usage data (pages visited, actions taken) so we can fix bugs and keep the service reliable.

Students join using a code or QR link shared by their leader — not by giving us their email address. We deliberately collect as little as possible:

• A first name and school year, entered when they set up their profile.
• A username and PIN they choose, used only to log back in.
• A cartoon avatar they pick from a fixed set of options — never a real photo.
• Points, streaks, and quiz/poll answers from sessions they take part in.

We do not collect a young person's email address, phone number, home address, exact location, or any photo of them through the student app.

Before a young person can use the student app, we ask a parent or guardian to confirm the sign-up by email. We only ask for the parent's email address for this one purpose — to send that confirmation link — and it is not used for anything else.

To run the core service (creating accounts, saving studies, running live sessions), to operate billing through Stripe, to verify a church's charity status, to keep the platform secure, and — for students — to get a parent's confirmation before a young person's profile becomes active. Where AI features are used (image generation, content drafting, research), the leader's prompt or request is sent to our AI providers (Anthropic and/or OpenAI) to generate a result; we don't send student data to these providers.

• Supabase — our database and authentication provider, which stores all the data described above.
• Stripe — for processing payments on paid church plans.
• Resend — for sending transactional emails (parent confirmation, password resets).
• Anthropic and OpenAI — for AI-assisted content and image generation, when a leader uses those features.

We do not sell personal data, and we do not use it for third-party advertising.

Data is hosted with our infrastructure providers (Supabase and Vercel). We keep account data for as long as an account is active. If you delete your account, or a church admin permanently deletes a study, series, or student profile, that data is removed from our live database. We're still finalising a formal retention and backup-deletion schedule as part of going through legal review — get in touch if you'd like something removed sooner.

Under UK data protection law, you (or, for a young person, their parent/guardian) can ask us to: tell you what data we hold, correct it, delete it, or export it. To make a request, contact us at [privacy contact email to be confirmed]. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've handled your data incorrectly.

We use a small number of strictly necessary cookies to keep you signed in. We don't use advertising or third-party tracking cookies.

Because we're in a limited testing period, this policy may change as we finalise our legal setup. We'll update the date at the top of this page whenever it changes, and let testers know about any significant change directly.