Privacy Policy

1. Introduction

We operate the VAMCP mobile app (the “App”) so parish members and guests can read announcements, view Mass times and events, listen to parish radio, receive notifications, and—when signed in—manage a member profile, link to a household, respond to Mass sign-ups, and read a personal notification inbox.

Protecting your privacy matters to us. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices available to you. By using the App or providing information to us through it, you agree to the practices described in this policy. If you do not agree, please do not use the App.

2. Who we are

The data controller for personal information processed through the App and the parish administrative systems that support it is:

Vailakanni Arokiya Madha Catholic Community
Contact: https://vamcp.org/#contact

Questions about this policy or your personal information should be sent using the contact link above or through your usual parish office channels.

3. What this policy covers

This policy applies to:

The VAMCP mobile application for iOS and Android;
The parish API and servers that power the App (including sign-in, notifications, and member data);
Parish staff use of the administrative dashboard to manage content, households, and communications.

It does not govern third-party websites or services you open from the App—such as our main parish website, donation pages, or external ministry links. Those sites have their own privacy practices. This policy also does not cover information collected solely by Apple, Google, or your device manufacturer through their operating systems, except where we receive that information through the App as described below.

4. Information we collect

The amount of information we collect depends on how you use the App. Much of the App works without an account. When you sign in, we collect and store additional information so we can recognise you, link you to your household when appropriate, and deliver personalised features.

4.1 Information you provide

Email address: Required to sign in. We send a one-time numeric sign-in code to this address. We do not use passwords for member accounts.
Name and phone number: Optional during onboarding or in your profile. Your name helps parish staff identify you; phone number may be used for parish communication when you provide it.
Household and family directory information: When your account is linked to a household, you may see names, relationships, ages, email addresses, and phone numbers of other family members recorded in the parish directory. Parish staff maintain this directory in the administrative dashboard. You cannot assign yourself to a household without parish approval.
Family join requests: If you are not yet linked to a household, you may search for and request to join one. We store your request, the household you selected, review notes from administrators, and the outcome (approved, declined, or reassigned).
Mass and event sign-up responses: When you respond to an open Mass or event sign-up, we store your attendance intention (for example yes, maybe, or no), headcounts, which household members plan to attend, guest names you enter, service roles you volunteer for, and answers to any custom questions the parish configures for that event.
Notification preferences: Whether you allow push notifications on your device, and actions you take in the App such as marking notifications as read.

4.2 Information collected automatically

Push notification token and device details: When you allow notifications, the App registers an Expo push token with our servers, along with your device platform (iOS or Android), app version, and the time we last saw the device. Guests who allow notifications but do not sign in still receive a token so we can send general parish announcements.
Sign-in session data: After you verify your email code, we issue a secure bearer token stored on your device. We record when your account was last active. Sign-in codes expire after a short period, can be used only once, and are invalidated after repeated failed attempts.
Device name at sign-in: The App may send a descriptive device name (for example “Maria’s iPhone”) when you sign in so parish staff can distinguish active sessions if needed.
Server and security logs: Like most web services, our servers automatically record technical information such as IP address, request time, API route accessed, and error details. We use this for security, abuse prevention, rate limiting, and troubleshooting. API requests are rate limited per client address.
Administrative activity logs: Actions taken by authorised parish staff in the administrative dashboard (such as linking a member to a household or sending a notification) may be logged for accountability and audit purposes.

4.3 Information we do not collect through the App

We do not require a password for member accounts.
We do not sell advertising profiles or track you across unrelated apps for marketing.
We do not collect precise GPS location through the App.
We do not intentionally collect sensitive categories of data (such as health or biometric data) unless you voluntarily include similar information in a free-text Mass sign-up field.

4.4 Parish staff accounts (administrative dashboard)

Parish administrators sign in through a separate OpenID Connect (OIDC) identity provider, not through the member email-code flow. We receive your name and email address from that provider to operate the dashboard. Your use of the identity provider is also governed by that provider’s privacy policy.

5. How we use your information

We use personal information for legitimate parish purposes, including to:

Authenticate you and maintain your member account;
Display parish content such as events, announcements, Mass schedules, ministries, and radio;
Link your account to the correct household when approved by parish staff;
Let you and your household respond to Mass and event sign-ups and export responses for parish planning;
Deliver push notifications and in-app notification inbox messages you are eligible to receive;
Distinguish general parish broadcasts from personalised member notifications;
Respond to your requests, including family join requests reviewed by administrators;
Protect the security and integrity of our systems, prevent abuse, and enforce rate limits;
Comply with legal obligations and protect the rights of the parish and our members.

We do not use your information for unrelated commercial marketing. Parish communications sent through the App relate to parish life, events, Mass, and community matters.

6. Legal bases for processing

Where applicable privacy law requires a legal basis, we rely on:

Consent — for example when you allow push notifications or provide optional profile information;
Legitimate interests — to operate the App, maintain parish records, communicate with members, and keep our services secure, balanced against your rights;
Contractual necessity — to provide features you request when signed in;
Legal obligation — when we must retain or disclose information as required by law.

8. Third-party services

The App and our backend may interact with the following categories of third parties:

Expo / EAS — mobile build, update, and push notification services;
Google Firebase Cloud Messaging — Android push delivery (via Expo);
Apple Push Notification service — iOS push delivery (via Expo);
Email providers — delivery of sign-in codes and administrative notices;
OpenID Connect identity provider — parish staff authentication;
Hosting and infrastructure — servers and databases that store parish data;
External websites — donation, gallery, contact, and ministry links opened in your browser.

Each third party’s handling of data is governed by its own privacy policy. We encourage you to review those policies when you use linked external services.

9. How long we keep information

We retain personal information only as long as needed for the purposes described in this policy:

Sign-in codes — deleted or invalidated shortly after use or expiry (typically within minutes);
Member account data — kept while your account is active and as needed for parish records;
Push tokens — kept while notifications remain enabled; removed when you unregister, sign out with full opt-out, or when a token is reported invalid by the push service;
Mass sign-up responses — kept for parish planning and historical records unless deleted by administrators;
Server logs — kept for a limited period for security and troubleshooting, then rotated or deleted;
Administrative logs — kept as needed for accountability and audit.

We may retain certain information longer when required by law, to resolve disputes, or to enforce our agreements.

10. Security

We use administrative, technical, and organisational measures designed to protect personal information, including encrypted connections (HTTPS) for API communication, hashed storage for push token lookups, rate limiting on authentication endpoints, and access controls on the administrative dashboard.

No method of transmission or storage is completely secure. Please use a device you trust, keep your operating system updated, and contact us promptly if you believe your account has been compromised.

11. Your choices and rights

Depending on where you live, you may have rights regarding your personal information, such as:

Accessing the information we hold about you;
Correcting inaccurate or incomplete information;
Requesting deletion of your account or certain data, subject to parish record-keeping needs;
Withdrawing consent where processing is based on consent (for example push notifications);
Objecting to certain processing based on legitimate interests;
Receiving a copy of your data in a portable format where applicable.

You can take the following steps directly in the App:

Update your name and phone number in your profile;
Turn off push notifications in your device settings;
Sign out — which revokes your current session token;
Detach or unregister push tokens to stop some or all notifications.

For other requests — including account deletion or correction of household directory information maintained by the parish — contact us at https://vamcp.org/#contact. We will respond within a reasonable time and may need to verify your identity.

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect and the right to request deletion, subject to exceptions. We do not sell personal information as defined by California law.

12. Children’s privacy

The App is intended for parish community use. Household directory entries may include information about children as part of family records maintained by the parish (such as names and ages). Parents or guardians control whether minors appear in household records and Mass sign-up responses submitted on behalf of a family.

The App is not directed at children under 13 to create independent accounts without parental involvement. If you believe we have collected personal information from a child in error, please contact us so we can take appropriate steps.

13. International users

Our parish is based in United States. If you access the App from outside United States, your information may be processed and stored in United States or in locations where our service providers operate. Data protection laws in your country may differ from the laws that apply in United States. By using the App, you understand that your information may be transferred to and processed in United States.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes may also be communicated through the App or other parish channels. Continued use of the App after changes take effect means you accept the updated policy.

15. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact the parish office:

Vailakanni Arokiya Madha Catholic Community
https://vamcp.org/#contact
https://vamcp.org