Privacy Policy

1. Introduction

Steward ("we," "us," or "our") is a web application operated by Crowned Light Studio, based in New Jersey, USA. This Privacy Policy explains how we collect, use, store, and share information when you use Steward at steward.crownedlightstudio.com (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Who We Are

Steward is a ministry coordination tool for church leaders. It connects to Planning Center Online ("PCO"), Gmail, and Google Calendar to help ministry leaders manage volunteer scheduling and outreach.

Contact: hello@crownedlightstudio.com

3. Information We Collect

3.1 Information You Provide

• Account information — your name and email address, provided via Google Sign-In
• Organization information — your church name entered during onboarding
• Volunteer notes — pastoral notes you write about volunteers within the app
• Email templates — message templates you create and save in the app

3.2 Information From Third-Party Services

When you connect your Google account, we receive and store:

• Your Google account name and email address
• A Google OAuth refresh token (used to access Gmail and Google Calendar on your behalf)
• Gmail thread metadata (sender, subject, date, snippet) for inbox display
• Google Calendar event data (title, date, time) for dashboard display

When you connect Planning Center Online, we receive and store:

• Your PCO account access and refresh tokens
• Volunteer names, email addresses, roles, and team assignments from PCO
• Upcoming service plans and plan assignment data from PCO
• Volunteer blockout dates from PCO

3.3 Usage Data

We may collect standard server logs including IP addresses, browser type, pages accessed, and timestamps. This data is used for security monitoring and service improvement.

4. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service (scheduling, outreach, volunteer management)
• Display your Gmail inbox and Google Calendar events within the app
• Generate AI-powered scheduling drafts and email reply suggestions
• Send emails on your behalf via Gmail when you approve and initiate a send
• Push approved schedule assignments to Planning Center Online
• Personalize your experience (e.g., greeting with your name, detecting timezone)
• Respond to support requests
• Maintain the security and integrity of the Service

We do not use your data to train AI models. Your volunteer notes, email content, and PCO data are used only to generate outputs within your own account session.

5. Artificial Intelligence

Steward uses the Anthropic Claude API to power scheduling suggestions and email drafts. When you use these features, relevant context (volunteer names, roles, notes, blockout dates, and email content) is sent to Anthropic's API to generate a response.

• AI-generated outputs are drafts only — nothing is sent to PCO or Gmail without your explicit approval
• Anthropic's data usage policies apply to data processed through their API. See Anthropic's Privacy Policy
• We do not store AI responses beyond the current session unless you explicitly approve them

6. Third-Party Services

7. Data Storage and Security

• Your data is stored in a Supabase-hosted PostgreSQL database with row-level security (RLS) policies that ensure each user can only access their own organization's data
• OAuth tokens (Google and PCO) are stored encrypted in the database and never exposed to the client browser
• All data is transmitted over HTTPS
• We implement reasonable technical and organizational measures to protect your data, but no method of transmission or storage is 100% secure

8. Data Retention

Your account data is retained for as long as your account is active. You may delete your account at any time from Settings → Account → Delete account. Deleting your account immediately revokes and deletes the Google user data (Gmail and Calendar access) we obtained via OAuth, and removes your personal account data. Volunteer notes and other shared organization records you authored are kept for your team's continuity, but are stripped of any link identifying you as the author. Some data may be retained longer if required by law or for legitimate business purposes.

You may also request deletion of your data at any time by contacting us at hello@crownedlightstudio.com.

9. Data Sharing

We do not sell your personal information. We share data only in the following circumstances:

• With third-party services listed in Section 6, to the extent necessary to provide the Service
• With law enforcement or regulators if required by applicable law or legal process
• In connection with a business transfer — if Crowned Light Studio is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you before your data is transferred to a new privacy policy

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability — receive a copy of your data in a machine-readable format
• Withdraw consent at any time (including by disconnecting Google or PCO integrations)

To exercise any of these rights, contact us at hello@crownedlightstudio.com. We will respond within 30 days.

11. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

12. Google API Services Disclosure

• We use Gmail access only to display your inbox within the app and to send emails you explicitly compose and approve
• We use Google Calendar access only to display your upcoming events on the dashboard
• We do not use Google user data to serve advertising
• We do not allow humans to read your Google data except when required for security investigation, to comply with law, or with your explicit permission

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice in the app. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

14. Contact

Crowned Light Studio
New Jersey, USA
hello@crownedlightstudio.com