Privacy Policy
Bwenzi LLC · Effective [DATE] · Last updated [DATE]
The short version
We're Bwenzi, a software company in Charlotte, North Carolina. Here's how we handle your information.
- We collect the minimum we need to run our products, and nothing more.
- We do not sell your personal information, and we never use it for advertising. There are no ads in our apps, on any plan.
- We do not use third-party ad or cross-site trackers.
- Analytics are privacy-respecting and anonymized wherever we can manage it. We see the patterns, not the people.
- You can access, correct, export, or delete your information, including deleting your account and its data, whenever you choose.
- We're a U.S. company and our services are intended for use in the United States.
1. Who we are
Bwenzi LLC ("Bwenzi," "we," "us," or "our") is a North Carolina limited liability company based in Charlotte, North Carolina. We build software for churches, families, and communities, published under our name on the Apple App Store and Google Play and on the web.
This policy covers bwenzi.com and the apps and services we offer (together, the "Services"). Where a specific app handles data differently, we'll say so in that app's listing or in an app-specific addendum linked from this page.
Contact: support [at] bwenzi.com · Bwenzi LLC, Charlotte, North Carolina.
2. Scope and audience
Our Services are designed for and directed to users in the United States. We do not currently offer our Services in the European Union or European Economic Area, and this policy is written to U.S. law. If you use our Services from outside the U.S., you do so on your own initiative and are responsible for local law.
Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. See Section 9.
3. The information we collect
We collect only what a given product needs. Depending on how you interact with us, this may include:
a. Information you give us
- Account information: your email address (which we verify), and basic profile details. We prefer passwordless sign-in (a one-time code or magic link sent to your email). If a password is ever used, it is stored only as a secure cryptographic hash, never in plain text.
- Content you create: the titles, descriptions, schedules, entries, and notes you enter while using a product.
- Information about other people you invite: where a product lets you collect responses from others, we collect only the fields you chose to ask for. By default that's a name only. You may optionally enable phone or email. Those people usually don't need an account.
- Access lists: where you restrict something you created to an invited group, the email addresses you add to that list, used only to control access.
- Sensitive details: where a product handles sensitive details (such as a person's needs or a location), we minimize them, treat them as sensitive, and disclose them only to the people who need them for the task at hand. Addresses can be masked to an approximate area.
- Support and communications: if you email us or contact support, we keep that correspondence.
b. Information we collect automatically
- Analytics and product usage: which features are used and how the product performs. Analytics for people who aren't signed in are anonymized. No personal information in events, no durable cross-session identifier, and no device fingerprinting. Our analytics are cookieless with truncated IP addresses where feasible. Analytics for signed-in accounts may be associated with that account, subject to this policy.
- Crash and error diagnostics: if something breaks, we collect technical diagnostics to fix it. Personal information is scrubbed on your device before a crash report leaves it.
- Basic security and operational logs: the limited technical data needed to keep the Services running and safe. One-time codes and access tokens are transient and are not kept in logs, analytics, or long-term backups.
c. Payment information
If you buy a premium plan, payment is handled by our payment processor (Stripe) through web checkout. We never receive or store your full card number. We keep only your subscription and entitlement status.
d. What we do not collect or do
- No advertising identifiers, ad SDKs, or cross-site tracking.
- No selling or renting of personal information.
- No use of your content or personal information to build advertising profiles.
- We do not use Google reCAPTCHA on public, no-account pages. Where bot protection is needed we use a privacy-preserving alternative (Cloudflare Turnstile).
4. How we use information
- Provide and operate the Services, including delivering confirmations and reminders and controlling access to what you create.
- Send transactional messages you'd expect: confirmations, edit and cancel links, one-time sign-in codes, reminders, and billing notices.
- Maintain security, prevent fraud and abuse, and debug problems.
- Understand product usage in aggregate to improve the Services.
- Process payments and manage subscriptions.
- Comply with law and enforce our Terms.
We honor your platform privacy controls, including Do Not Track signals and iOS App Tracking Transparency, though we don't do the cross-app tracking those controls are designed to limit in the first place. We send non-transactional email only where permitted, always with a working unsubscribe link, consistent with CAN-SPAM. Unsubscribing never affects transactional messages you need.
5. How information is shared
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only:
- To service providers who process data on our behalf under contract, only to run the Services (see Section 6).
- Between the people using a product, as it intends: whoever created something sees the entries on it. Other participants do not see each other's contact details by default.
- For legal reasons: to comply with law, respond to lawful requests, or protect the rights, safety, and property of Bwenzi, our customers, or the public.
- In a business transfer: if Bwenzi is ever involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We'll post notice here and your rights under this policy will continue to apply.
6. Our service providers
We use a small set of reputable providers, each under a data-processing agreement, chosen to keep data in the U.S. where possible:
| Provider | Purpose | Notes |
|---|---|---|
| Supabase | Application database, authentication, storage | Hosted in a U.S. region |
| Resend | Transactional email | Sign-in codes, confirmations, reminders, billing |
| Stripe | Payment processing for premium plans | PCI-compliant. We never store full card data |
| Cloudflare | Website hosting, security, bot protection (Turnstile) | |
| PostHog | Privacy-respecting product analytics | Anonymized. Self-hosted or U.S. cloud, under a data-processing agreement |
| [Crash provider] | Crash and error diagnostics | Personal data scrubbed on-device before sending |
7. Data retention
We keep personal information only as long as needed for the purposes above, then delete or anonymize it.
- Account and content: kept while your account is active. When you delete your account, we delete your personal information and content, except limited records we're required to keep (for example, basic transaction records for tax or legal reasons), which are then deleted on our normal schedule.
- Analytics: retained for a limited window, then deleted or aggregated. Anonymized analytics may be kept longer because they no longer identify you.
- Transient secrets (one-time codes, access tokens): expire quickly and are not retained.
8. Your choices and rights
Wherever you live in the U.S., we extend these controls to everyone:
- Access a copy of the personal information we hold about you.
- Correct inaccurate information.
- Export your information in a portable format.
- Delete your information and your account. See the Delete your account and data page.
- Opt out of non-transactional email at any time.
To make a request, email support [at] bwenzi.com. We'll verify your request (usually by confirming control of the account email) and respond within the time the applicable law requires. We won't discriminate against you for exercising these rights.
California residents (CCPA/CPRA)
If you're a California resident, you have the rights above, plus the right to know the categories of information we collect, the purposes, and the categories of third parties we share it with. Importantly, we do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we don't sell or share in that sense, there's no "Do Not Sell or Share My Personal Information" transaction to process, but you may still contact us with any request and we'll honor it. We do not use or disclose sensitive personal information for purposes that would require an opt-out under the CPRA.
Other state privacy laws
Residents of states with comprehensive privacy laws (for example, Virginia, Colorado, Connecticut, Utah, Texas, and others as they take effect) have similar rights to access, correct, delete, and obtain a copy of their information, and to opt out of targeted advertising and sale, which we don't do. Contact us to exercise them. If we ever deny a request, you may appeal by replying to our response.
9. Children's privacy (COPPA)
Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Our products are designed for adults.
Some contexts involve information about a minor that an adult enters. We minimize this, don't require it, and treat it carefully. If we ever offer a product intended for children or families, it will carry its own clear, kid-appropriate disclosures and be built to be COPPA-compliant.
If you believe a child under 13 has given us personal information, contact support [at] bwenzi.com and we will delete it promptly.
10. Security
We protect personal information with encryption in transit and at rest, access controls (including database row-level security), passwordless authentication by default, and the practice of collecting as little as possible in the first place. The data we never collect can never be breached. No system is perfectly secure, but we take reasonable, current safeguards and keep improving them.
11. Changes to this policy
If we make material changes, we'll update the "Last updated" date and, for significant changes, provide a more prominent notice (such as an in-app or email notice). Your continued use after an update means you accept the revised policy.
12. Contact us
Questions, requests, or concerns:
Bwenzi LLC
Email: support [at] bwenzi.com
Charlotte, North Carolina
We read every message and aim to respond quickly.