Privacy Policy

• Contact & identity: Full name, email, phone number (for WhatsApp OTP verification), date of birth, gender, address. Provided by you during registration or profile update.
• Religious data (sensitive): Baptism status, previous denomination, marital status, prayer requests, child dedication info. Collected when you submit member-care forms. Handled with high confidentiality.
• Biometric data: Face embeddings (mathematical representation of your face photo, NOT the photo itself) for fast kiosk check-in. Stored encrypted on our servers. Deletable at any time via Settings > Privacy > Delete Biometric Data.
• Audio data: Voice recordings (transient) when you use Faith Assistant voice mode. Audio sent to third-party transcription services (Anthropic Claude, Groq) and NOT retained after processing.
• Photos: Profile photo, child photo (for dedication), check-in photos. Stored with restricted access.
• Financial data: Donation/giving history (amount, date, fund), bank account numbers saved for auto-fill. Payments processed by iPaymu (third party); we do NOT store credit card information.
• AI conversation data: Questions and answers exchanged with Faith Assistant (AI assistant powered by Anthropic Claude). Stored for conversation context and service improvement. Deletable via Settings > Faith Assistant > Clear Conversation History.
• App activity: Events attended, RSVPs, groups joined, articles read, bible study progress.
• Push notification token: Device identifier from Expo Push Service for sending event/prayer/announcement notifications.
• Crash & error reports: Technical stack traces (WITHOUT personal data) sent to our self-hosted GlitchTip (errors.gkbj.org) for bug fixing. Not shared with any third party.
• Website usage data: IP address, browser type, pages visited (gerejaku.org).
• Social media data: Public profile information when interacting with our social media accounts.
• Cookies (web): Small files for improved user experience on the website.

• Provide and maintain our mobile app and website services.
• Verify identity on login (WhatsApp OTP) and kiosk check-in (biometric).
• Process event registrations, prayer requests, member-care services (baptism, dedication, matrimony, counseling, accepting Christ).
• Process donations via iPaymu and send payment confirmations.
• Answer your questions via Faith Assistant (AI assistant powered by Anthropic Claude).
• Send notifications about events, prayer, and church announcements.
• Communicate with you about church activities, events, and services.
• Improve service quality through anonymous crash reports.
• Run limited advertising on Meta (Facebook/Instagram) — ONLY for the website, NEVER using mobile app data.
• Comply with legal and financial obligations (annual donation reports, audits).

We NEVER sell your personal data to third parties.

• Each of your messages is sent to Anthropic servers (outside Indonesia) to generate the response.
• AI responses may contain errors, bias, or inaccurate information. AI is NOT a substitute for spiritual guidance from qualified pastors or pastoral staff.
• You can report inappropriate, offensive, or harmful AI responses via the long-press context menu on a message, or through Settings > Faith Assistant > Report a Problem.
• Conversation history is stored on our servers for context. You can clear all history at any time.
• We do not use your conversations to train AI models.

• You MUST give explicit consent before face data is enrolled for the first time.
• We store embeddings (mathematical representations), NOT your face photos. Embeddings cannot be reversed back to photos.
• Embeddings are encrypted at rest and transmitted only over HTTPS.
• Biometric data is NEVER shared with any third party.
• You can delete biometric data at any time via Settings > Privacy > Delete Biometric Data. After deletion, check-in reverts to manual.

• Camera: Profile photos, child dedication photos, and face-recognition check-in.
• Microphone: Faith Assistant voice mode + LiveKit voice calls for remote counseling.
• Media storage (photos/videos/audio): Select a profile photo from your gallery.
• Notifications: Push notifications for events, prayer, and announcements.
• Device biometric (fingerprint/face): Quick login with device biometric (optional, stored ONLY on your device — never sent to our servers).
• Phone & phone state (LiveKit Telecom): Required for voice calls with pastoral staff.

Each permission can be denied or revoked at any time via Android Settings. Related features will be disabled but the app remains functional.

• Payment details (card numbers, virtual accounts, e-wallets) are entered directly into iPaymu's system, NOT into our app.
• We only receive transaction success confirmation (status, amount, transaction ID) from iPaymu.
• Donation history is stored on our servers for tax reporting and church financial transparency.
• iPaymu's privacy policy is available at ipaymu.com/privacy-policy.

• Anthropic Claude (USA): Faith Assistant generative AI.
• Groq (USA): Fast voice transcription for Faith Assistant voice mode.
• Expo Push Service (USA): Push notification delivery.
• iPaymu (Indonesia): Donation payment processing.
• LiveKit (USA): Real-time voice/video calls for counseling.
• Google Play Services (USA): Android requirement — auth, notifications.
• Google Analytics & Meta Pixel (USA): WEBSITE-ONLY (gerejaku.org), NEVER the mobile app.
• YouTube (USA): Sermon video embeds.
• GlitchTip (self-hosted at errors.gkbj.org): Anonymous crash reports. Self-hosted by us in Indonesia.

Each service has its own privacy policy. We choose partners that comply with international privacy standards (GDPR, CCPA).

• All data transmission uses HTTPS/TLS.
• Passwords stored using bcrypt hashing (irreversible).
• Authentication tokens stored in Android Keystore (hardware-encrypted).
• Biometric data (face embeddings) is encrypted.
• Access limited to authorized church staff with multi-factor authentication.
• Retention: Active member data retained throughout your membership. After account deletion, all personal data is permanently deleted within 14 days (except items required for legal compliance, such as donation records retained 7 years for tax audit).

• Access all personal data we hold about you — data export available at Settings > Privacy > Download My Data.
• Update your data at any time via the Profile menu in the app.
• Delete your account and all personal data — Settings > Account > Delete Account. Permanent deletion within 14 days.
• Revoke specific permissions (biometric, notifications, camera, etc.) — Android Settings > Apps > FaithFlow.
• Opt out of marketing communications at any time.
• File a complaint with a data protection authority if you believe your rights have been violated.

• GKBJ Taman Kencana
• Perumahan Taman Kencana Blok A1 No. 16
• Cengkareng, Jakarta Barat 11730
• Email: privacy@gerejaku.org
• WhatsApp: +62 811-9913-3666
• Instagram: @gkbj.tamankencana