Summary
Narthx is an internal staff operations tool for churches. We collect only the information necessary to operate the service — primarily your work email address for authentication via Google OAuth, and the operational data your church enters (meetings, requests, projects). We do not sell data, serve ads, or share information across church tenants. Each church's data is isolated at the database layer and never accessible to another church's users.
What Information We Collect
We collect information you provide directly and information generated by your use of the service.
Information you provide
- Account information: Name and email address via Google OAuth sign-in. We do not store passwords.
- Operational data: Meeting agendas, decisions, action items, approval requests, project tasks, and other content you create within Narthx.
- Communications: If you contact us by email, we retain that correspondence.
Information collected automatically
- Usage data: Pages visited, features used, and actions taken within the app.
- Device information: Browser type, operating system, and IP address for security and diagnostic purposes.
- Cookies: Session tokens required for authentication. No advertising or cross-site tracking cookies.
Information from Google integrations
Sign-in uses Google OAuth. If your church administrator also connects Google Workspace, we request the following OAuth scopes — only when explicitly authorized by the account holder:
- openid, email, profile — your name and email address, used solely for account authentication and identifying you within your church's workspace.
- calendar.events — read and write calendar events, used solely to create and update meetings you initiate in Narthx. We do not read events you did not create through Narthx.
- drive.file — access files you select via the Google Picker or create through Narthx. We never access files you have not explicitly selected or uploaded.
- directory.readonly — read your Google Workspace directory, used solely to suggest staff members when inviting them to Narthx. Directory data is never stored beyond the current request.
Google data accessed through these scopes is used only for the purposes described above. It is never used for advertising, AI model training, credit determination, or shared with data brokers. See Section 3 — Google API Services — Limited Use for our full compliance statement.
Information from Planning Center
If your church administrator connects Planning Center Online (PCO), we access staff names and email addresses — cached locally for task assignment. PCO remains the system of record for people data.
How We Process Your Information
We process your information to:
- Operate and maintain the Narthx service
- Authenticate users and enforce access controls
- Send transactional emails (meeting recaps, approval notifications, weekly digests)
- Sync with connected integrations per your church administrator's configuration
- Diagnose errors and improve reliability
- Comply with legal obligations
We do not use your information for advertising, profiling, or any purpose unrelated to operating the service. Specifically, we never use Google user data for: targeted or interest-based advertising; selling to data brokers or information resellers; determining creditworthiness or lending decisions; or training AI or machine learning models.
Google API Services — Limited Use
Narthx's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms, this means:
- Google user data is used only to provide and improve Narthx features directly requested by the user.
- Google user data is never transferred to third parties except as necessary to provide the service (e.g., storing encrypted OAuth tokens in our database), or as required by law.
- Google user data is never used or transferred for serving advertisements.
- Google user data is never used or transferred for determining creditworthiness or for lending purposes.
- Humans at Narthx do not read Google user data unless you have explicitly granted permission, it is necessary for security purposes, or required by law.
Your use of Google sign-in and integrations is also subject to Google's Privacy Policy.
Who We Share Information With
We do not sell your information. We share it only in these circumstances:
Service providers
We use third-party providers to operate Narthx. Each receives only the data necessary for their function:
- Supabase — database and authentication hosting
- Vercel — application hosting and deployment
- Resend — transactional email delivery
- Google — OAuth authentication and optional Calendar/Drive integration
Legal requirements
We may disclose information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Narthx, our users, or others.
Business transfers
If Narthx is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify affected users beforehand.
Cookies and Tracking Technologies
We use cookies solely for authentication and session management. Specifically:
- Session cookies: Required to keep you logged in. Expire when you sign out or your session expires.
- No advertising cookies. We do not use Google Analytics, Facebook Pixel, or any cross-site tracking.
You can disable cookies in your browser, but doing so will prevent you from signing in.
How Long We Keep Information
We retain your information for as long as your church's account is active. Specifically:
- Operational data (meetings, tasks, requests): Retained indefinitely while the tenant is active, to support historical reference and debrief use cases.
- Authentication data: Retained while your account is active.
- Integration tokens: Encrypted and retained while the integration is connected. Deleted when disconnected.
- Deleted data: We use soft deletes by default. Hard deletion is available upon request.
Any tenant may request a full data export or complete deletion at any time.
How We Keep Information Safe
We implement standard security practices appropriate for an internal business tool:
- HTTPS for all data in transit
- Encrypted database at rest (Supabase default)
- Row-level security policies ensuring tenant isolation at the database layer
- OAuth tokens encrypted using AES-256-GCM before storage
- Service role credentials never exposed to client-side code
No security system is perfect. If you discover a vulnerability, please report it to security@narthx.io.
Information of Minors
Narthx is designed for church staff and adult volunteers. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us at hello@narthx.io and we will delete it promptly.
Your Privacy Rights
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Export your data in a portable format
- Object to certain processing activities
To exercise any of these rights, contact your church administrator (who can manage tenant data) or email us directly at hello@narthx.io.
Do-Not-Track Features
Some browsers transmit "Do Not Track" signals. Because we do not track users across third-party sites, we do not alter our behavior in response to these signals — our data practices are the same regardless.
US Residents — Specific Rights
Depending on your state, you may have additional rights under laws such as the CCPA (California), CPA (Colorado), VCDPA (Virginia), and similar statutes. These generally include the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell data), and to non-discrimination for exercising your rights.
To submit a data request, email hello@narthx.io with the subject "Data Request." We will respond within 45 days.
Updates to This Policy
We may update this policy as Narthx evolves. When we do, we will update the "Last updated" date above. For material changes, we will notify active users via email at least 30 days before the change takes effect.
How to Contact Us
For privacy questions, data requests, or concerns:
Narthx
hello@narthx.io
narthx.io