Privacy, updated 15 September 2026
What we keep, who sees it, and how you take it back.
Written in plain language by the people who built the product, from what it actually does. It has not yet been reviewed by a lawyer; when it has, that will be stated here with a date.
What we store
Only what your bulletin needs.
A church account holds the things your team puts into it and the things your calendars send us.
- Staff accounts: name, email address, role, and when each person last signed in.
- Your calendars: the events they publish (title, time, place, description, an image) and the feed address you connected.
- Your content: posts, drafts and their version history, photos, announcements, forms and site settings.
- An activity log of who changed what in the admin, kept so “who approved this?” always has an answer.
- Nothing about the people who read your bulletin. See “Visitors” below.
Who else touches it
Five services, each for one job.
We run on other companies’ infrastructure and say which. None of them receive more than their job needs.
- Vercel hosts the application and stores uploaded photos.
- Neon stores the database, in the United States.
- Anthropic writes the first draft of each bulletin. It receives your events, announcements, permanent content labels and form titles for that week, never staff accounts, passwords or billing details.
- Resend delivers our email: sign-up links, invitations, password resets and the weekly bulletin notices.
- Stripe handles payment. Card details are entered on Stripe’s pages and never pass through this product.
Visitors
Your congregation is not tracked.
Someone reading a bulletin site gets a web page and nothing else.
- No cookies are set for visitors, and no third-party scripts, pixels or fonts are loaded from other companies.
- If your church adds its own Google Analytics or Tag Manager ID in Settings, that runs under your own account and policy, not ours.
- Signed-in staff get one session cookie so the admin remembers who they are; it lasts about two weeks.
Your data is yours
Leaving takes your data with you.
A church can stop at any time. We do not lock content behind a subscription.
- Your public bulletin site keeps serving what you already published even if a payment fails; only staff access to the admin pauses, after a 7-day grace period.
- To export or delete a church account and everything in it, write to hello@nextsunday.app. We do it by hand today and confirm when it is done; a self-serve export is planned.
- Deleted content is removed from our database; backups held by our hosting providers age out on their own schedules.
Changes
When this page changes, the date at the top changes.
We will email every church’s owner before a change that gives a new company access to church data. The Terms page covers the rest of the relationship.
A question this page didn’t answer?
Write to hello@nextsunday.app. We’d rather say plainly what we do with your data than have you guess.