Synodo · Features · Compare · Guides · Walkthrough · Sign up

Privacy Policy

Effective August 1, 2026

This explains what Synodo collects, why, and what control you have. Synodo is operated by
Sky Web Management LLC.

Roles. Your church decides what information to put into Synodo and who may see it —
your church is the controller. We store and process that information on your church's
behalf — we are the processor. If you're a group member with a question about your
information, your church administrator is the right first contact.

What we collect

Information your church enters

• Names, email addresses, and optional phone numbers
• Optional profile details: photo, short bio, gender
• Optional "About you" details a member chooses to share with their groups:

birthday and anniversary, spouse's and children's names, pets, allergies, favorite
foods, and how the group can help in a hard week

• Group membership and role (leader or participant)
• Intake information, where used: life stage, marital status, whether someone has

children, availability, who nominated them, and notes from outreach calls

Content created in the app

• Group messages, replies, reactions, photos, and polls
• Prayer requests, including any marked answered
• Homework submissions, comments, and check-offs
• Attendance records and leader check-in notes
• Curriculum, leader guides, announcements, and uploaded files

Information we collect automatically

• A session cookie so you stay signed in
• Your IP address, used to rate-limit sign-in attempts and to protect against abuse
• Push notification subscriptions, or the iPhone or Android app's device token, if you

enable notifications

• Which steps of the welcome tour you've seen, so it isn't shown twice and so we can

improve it

Payment information

• Handled entirely by Stripe. We receive a customer and subscription identifier and your

subscription status. We never see or store card numbers.

Visitor measurement

• We use Cloudflare Web Analytics on our public pages to count visits and see

which pages people read. It is cookieless: it sets nothing on your device, does
not follow you to other sites, and does not build a profile of you. It records
the page, the referring site, and coarse details like browser and country.

We do not use tracking or advertising cookies, and we run no advertising
networks or cross-site trackers.

Sensitive information

Prayer requests, check-in notes, and similar content can reveal deeply personal
things — health, family circumstances, or religious belief. We treat all church content
as confidential. Churches should be thoughtful about what they record and who they give
leader access to, and should tell members what's visible to whom.

How we use it

Only to provide the service: to run your church's program, show content to the right
people, send notifications and reminders you've enabled, process payment, keep the
service secure, and provide support.

**We do not sell your information. We do not share it with advertisers. We do not use
your content to train AI models.**

Who we share it with

We use a small number of providers to run Synodo:

• Cloudflare — hosting, database, file storage, the email we send you such as

invitations and password resets, and cookieless visitor analytics on our public
pages (United States)

• Stripe — payment processing (United States)
• Sentry — error reports, so we find out when something breaks (United States)
• Apple, Google, Mozilla — delivering push notifications you've enabled

When something goes wrong in the app, we send an error report containing the
fault, the page or route it happened on, and anonymous identifiers for the church
and account involved. Request contents are never included — no message
bodies, prayer requests, notes, names, or email addresses.

We may also disclose information if legally required, or to protect someone's safety —
and we'll tell you unless legally prevented.

If Synodo is ever sold or merged, your information may transfer with it. You'll be
notified before that happens and can export or delete beforehand.

How it's separated and protected

• Each church's data is isolated; one church cannot read another's.
• Passwords are stored using PBKDF2 hashing — never in readable form.
• All traffic is encrypted with HTTPS.
• Session cookies are HttpOnly, Secure, and SameSite-limited.
• Repeated failed sign-ins are rate-limited.
• Uploaded files are restricted to the church that owns them.

No system is perfectly secure. If a breach affects your information, we'll notify
affected churches promptly and as required by law.

How long we keep it

We keep information while your account is active. Administrators can delete a person or
the whole church at any time, which removes their content and files. A lapsed
subscription does not trigger deletion; after 12 months of inactivity we may delete
an account, with at least 30 days' email notice first. Backups are retained briefly and
overwritten on a rolling basis.

Your choices

• See and export your data — any member: Account → Download my data. Administrators

can export the whole church from Settings.

• Correct it — edit your profile, or ask your administrator.
• Delete it — any member: Account → You → Delete my account, on the website or in

the app. It removes your account, messages, notes and uploads. Your church
administrator can also remove you. If your church's only administrator wants to
leave, they hand the church to someone else or close it first.

• Notifications — turn push on or off per device in Account; mute individual groups.

Depending on where you live, you may have additional rights (access, correction,
deletion, portability, objection, or to lodge a complaint with a supervisory authority).
Because your church controls the data, we'll usually direct requests to them and help
them respond.

Children

Synodo is intended for use by adults. Churches running youth programs are responsible for
obtaining verifiable parental consent before entering a minor's information, and for
complying with laws such as COPPA. If we learn we hold a child's information without
required consent, we'll delete it.

Where data is stored

Synodo is hosted on Cloudflare's infrastructure and data is processed in the United
States. If you use Synodo from elsewhere, you understand your information is transferred
to and processed in the U.S.

Changes

We'll post updates here and change the effective date. For material changes we'll notify
administrators by email or in the app.

Contact

Sky Web Management LLC
10731 Copper Ridge Dr
Louisville, KY 40241
hello@synodo.app