DRAFT, for attorney review. Not in force. Prepared for counsel by the Propius build; every bracketed item is for counsel or the owner to fill.
Effective date: [EFFECTIVE DATE] · Version: 2026-10-draft-1
Who we are
Propius is operated by [OPERATOR LEGAL NAME], [OPERATOR ADDRESS] (“we”, “us”, “the operator”). Your parish uses Propius to welcome you and help you meet people. Your parish decides why your information is used; we run the software that holds it, under a written agreement with your parish.
This policy explains what we keep, who can see it, how long we keep it, and what you can do about it.
What we collect
When you sign up:
- your first and last name;
- your email address (to send you sign-in links);
- your mobile phone number (kept for your parish; never shown to other members);
- that you confirmed you are 18 or older, that you accepted the code of conduct, and that you gave the consent below;
- your life stage, if you choose to give it;
- the interests you tick (for example dinners, events, volunteering, letters);
- whether you are returning to the faith or curious about it, only if you choose to tell us (see Sensitive information);
- if you arrived by scanning a QR card, which kind of card it was (pew, bulletin, entrance or poster), so your parish can see which cards work.
As you use Propius:
- what you write: letters, messages in a dinner group, event descriptions, reports;
- if a coordinator types in a handwritten letter for you, a photo of the letter and its transcription;
- what you choose to take part in: event replies, volunteer sign-ups, and your answers after a dinner (“Did you go? See this group again?”);
- if you join dinners: when you are free, who you would like to meet, your budget, your language, your ZIP code if you choose to give it (to seat neighbors together), and any food notes you add, such as allergies (stored encrypted);
- whether you chose to share your email with your welcome host or with someone from your dinner;
- if you host an event, the address you enter for it (stored encrypted);
- your language and notification choices;
- when you last signed in, and the sign-in sessions on your devices;
- a record of which coordinator opened your private information, and when (the audit log).
At sign-up, the bot check (Cloudflare Turnstile) uses your device’s internet (IP) address to tell people from bots.
What we do not collect: your birthday, your home address (unless you enter it to host an event), any ID document, passwords (Propius has none), your precise location (GPS), or advertising identifiers.
Sensitive information
Joining a parish says something about your religious beliefs. We treat everything in Propius with that in mind. At sign-up, you are asked to agree to this:
“Because this is a parish, joining tells us something about your faith. We keep it private, never sell it, and you can delete it any time.”
The answer to “returning to the faith or curious” is optional. It is encrypted. Only your pastor and your parish’s OCIA coordinator can see it, and every time one of them views it, that view is recorded in the audit log. You are never named with it in any count, summary, email or web address. The pastor and the OCIA coordinator get at most one nameless note a day saying that someone at the parish chose it.
We never sell your information. We never use it for advertising, and we never share it with advertisers.
Who sees what
| Who | What they can see |
|---|---|
| Other members | Your first name, in shared spaces (dinner groups, events, letters). Never your last name, email or phone. |
| Welcome coordinator | Newcomers to the parish, the interests they ticked, their status (new, contacted, connected), welcome-host pairings and follow-ups. Also runs dinners: dinner preferences and food notes, who went, and reports made in dinner groups. |
| OCIA coordinator and pastor | The “returning to the faith or curious” answer. Every view is logged. The OCIA coordinator also sees the newcomer list. |
| Letters coordinator | Letters from your own parish that the filter flagged for review, and handwritten letters they type in for a member. Every view is logged. |
| The sister parish’s letters coordinator | A letter delivered to one of their members who does not use Propius, so they can print it for that person. Every print is logged. |
| Events coordinator | Member events waiting for approval, reports about events, and a member host’s home address (every view of an address is logged). |
| Volunteer coordinator | Volunteer needs and who signed up. |
| Pastor | Everything the coordinators see, staff roles, and a summary of counts. |
| Platform owner (the operator) | Counts only, across parishes. No names and no private words. One exception: if your pastor asks the operator to pause or close a particular account, the operator sees that account’s name and email to do it. |
In shared spaces, people see first names only. Your phone number is never shown to any member. Your email is shared with another member only if you tick to share it: with your welcome host, or with one person at a time after a dinner.
The address of an event in the parish hall or a public place is shown to members of the parish. A home address is shown only to the host, to guests who said they are going (starting 24 hours before the event), and to the parish’s event approvers and pastor, whose every view is logged.
Letters with a sister parish
If you join letters, your letters travel to a sister parish in [PARTNER COUNTRY].
Before a letter is delivered:
- the filter removes phone numbers, emails, links and social media handles;
- mentions of money or gifts are flagged, and a named reviewer from the writer’s parish reads the letter before it goes;
- it is translated by machine, using our hosting provider’s AI service, and the translation is labelled as machine-translated.
If the person you write to does not use Propius, their parish’s letters coordinator may print your letter and hand it to them. Handwritten letters are photographed and typed in by your own parish’s letters coordinator.
Your original words are always kept beside the translation. Letter bodies are stored encrypted. Every time a coordinator opens a letter, the view is logged.
Service providers
We use a small number of providers to run Propius:
- Cloudflare: hosting, database, file storage (such as the parish photo), bot checks at sign-up (Turnstile), and machine translation of letters.
- Email provider:
[EMAIL PROVIDER], once real email is turned on.
There are no ad networks, no analytics trackers, and no third-party scripts other than Turnstile. Fonts are served from Propius itself.
How long we keep it
- Inactive accounts: if you haven’t signed in for about 23 months, we email you. If you still haven’t signed in 30 days later (two years in all), we delete the account. As with deleting it yourself, your name, email, phone and private answers are wiped; letters and messages you wrote stay, signed “a former member”.
- Letters: removed 30 days after a letter circle ends, unless the writer or the person it was written to chose to keep it.
- Copies of emails we send you: deleted after 30 days.
- Sign-ups never confirmed: if nobody opens the sign-in link, the sign-up is deleted after 30 days.
- Expired sign-in links and sessions: deleted after they expire.
Your choices and rights
- Download everything: Settings → Download my data gives you a file of everything Propius holds about you. Other people in it appear only as “another member”.
- Delete your account: in Settings, any time. Your name, email, phone and private answers are wiped straight away. You choose whether letters and messages you wrote stay, signed “a former member”, or are removed.
- Change your language and notifications in Settings.
- Sign out everywhere from Settings.
- For anything else, write to
[CONTACT EMAIL].
Depending on where you live (for example under [STATE PRIVACY LAW]), you may have further rights, such as to correct your information or appeal a decision. [COUNSEL: confirm the state-law rights that apply and how to request them.]
Children
Propius is for adults only. We do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we delete it.
Security
- Sensitive fields (the faith answer, letter bodies, home addresses for events, food notes) are encrypted.
- Sign-in uses single-use email links or codes that expire in 15 minutes. There are no passwords to steal.
- Every coordinator view of the faith answer, a flagged letter, a report or a host’s home address is recorded in an audit log.
- Each parish is walled off: one parish’s coordinators cannot see another parish’s members.
No system is perfect. If a breach affects your information, we will tell you and the authorities as the law requires.
Changes and contact
If we change this policy, we will tell you inside Propius before the new version applies to you.
Questions or requests: [CONTACT EMAIL], or [OPERATOR LEGAL NAME], [OPERATOR ADDRESS].