Privacy Policy

📋 What We Collect

We collect only what's necessary to operate the app:

• Church name and administrator contact information provided at signup
• Staff user accounts (name, email, role) created by your church administrator
• Member records entered manually or imported via CSV by your church staff
• Engagement data (attendance, group participation, serving, giving status) entered by your staff
• Support tickets and messages submitted through the app
• Waitlist details submitted on our website (your name, email, church name, role, and optional church size), used only to email you when the app launches

🔒 How We Use Your Data

Your data is used solely to provide the NextStep Metrics service:

• To display engagement tracking and discipleship insights within the app
• To authenticate users and enforce role-based access controls
• To process subscription billing via Stripe
• To respond to support requests

🏛️ Data Storage & Security

All data is stored securely using Google Firebase (Firestore), with the following protections:

• All data is encrypted in transit using TLS
• Access is restricted by church ID — no church can access another church's data
• Role-based permissions limit what each staff member can view or edit
• Firebase Authentication handles all user credentials — we never store passwords in plaintext

💳 Billing & Payments

Subscription payments are processed by Stripe. NextStep Metrics does not store your credit card information. All payment data is handled directly by Stripe in accordance with their PCI-compliant infrastructure.

You can view Stripe's privacy policy at stripe.com/privacy.

👥 Member Data & Your Church

Your church owns its member data. The congregation records, attendance history, and engagement scores stored in NextStep Metrics belong to you.

• You can export or delete your data at any time by contacting support
• If you cancel your subscription, your data is retained for 30 days before deletion
• Giving data is visible to church administrators only — not staff or read-only users

🍪 Cookies & Analytics

The NextStep Metrics iOS app does not use cookies. Our website does not use advertising cookies or third-party tracking or advertising technologies. The site uses only the essential storage required for core functionality (for example, our hosting and database provider, Google Firebase).

Security (reCAPTCHA). To protect our forms and services from automated abuse, spam, and fraud, our website uses Google reCAPTCHA Enterprise. reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google to tell real visitors apart from automated traffic. We carry out this processing for our legitimate interest in keeping the service secure. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service. We do not use reCAPTCHA for advertising, and it is not used to track you across other sites.

If we ever introduce basic, privacy-respecting analytics, we will update this policy and, where the law requires it, ask for your consent before any non-essential cookies are set.

👶 Children's Privacy

NextStep Metrics is intended for use by church staff and administrators. The app is not directed at children under 13. We do not knowingly collect personal information from children under 13.

🌍 Your Rights (GDPR & EU/UK Users)

If you are located in the European Economic Area (EEA), the United Kingdom, or another region with similar data-protection laws, you have the following rights over your personal data. To exercise any of them, email support@nextstepmetrics.app and we will respond within the timeframe the law requires (generally within one month).

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct data that is inaccurate or incomplete
• Erasure — ask us to delete your personal data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a portable, machine-readable format
• Objection — object to our processing of your data
• Withdraw consent — where we rely on consent, withdraw it at any time

✈️ International Data Transfers

NextStep Metrics is operated from the United States, and our infrastructure provider, Google Firebase, stores data on servers in the United States. If you access the service from outside the U.S., your data will be transferred to and processed in the U.S. We rely on the safeguards provided by our processors (including Google and Stripe), such as Standard Contractual Clauses, to protect data transferred internationally.

⚖️ Data Retention & Complaints

We keep your data only as long as needed to provide the service. If your church cancels, member data is retained for 30 days and then deleted. Waitlist details are kept until the app launches (or until you ask us to remove them) and are not used for any other purpose.

If you believe we have mishandled your data, you have the right to lodge a complaint with your local data-protection supervisory authority. We ask that you contact us first so we can try to resolve your concern directly.

✏️ Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes via email or an in-app notice. Continued use of the app after changes constitutes acceptance of the updated policy.