Privacy Policy

Last updated: October 19, 2026

This policy explains what personal information Strong Steeple collects, why, who sees it, and the rights you have under South Africa's Protection of Personal Information Act, 2013 (POPIA). It covers the website at strongsteeple.co.za and our iOS and Android apps (together, "the Service").

1. Who we are

Strong Steeple is a sole proprietorship owned and run by Jaco Louw in South Africa. Strong Steeple is the responsible party under POPIA for your account and the platform, and your church is the responsible party for its member records (see section 2). Jaco Louw is Strong Steeple's Information Officer.

• Email: support@strongsteeple.co.za
• Address: 15A Dovehouse Road, Gillitts, Durban, 3625

2. Your church and us

Strong Steeple is a platform that churches use to keep in touch with their members. Two parties are responsible for your information:

• Your church is responsible for its member records: whether you belong and in what role, your groups and serving teams, rosters and the availability you give, the profile details its admins see and manage, birthday reminders, what's posted in its chats, and the tickets and RSVPs for its events. Strong Steeple processes this information on the church's behalf, as its operator, and only on its instructions. If a church admin adds your details for you, the church is responsible for having a good reason to do so.
• Strong Steeple is responsible for everything else in this policy: your account and sign-in, your devices and notification settings, your consent, and requests, reports and enquiries you send us.

For anything about your church's records, you can contact your church or us. We'll help either way.

3. What we collect

• Account details. Your name, email address and password. We store only a scrambled (hashed) version of your password, never the password itself.
• Sign in with Google or Apple. If you use these, we receive your name, email address, profile photo and an account identifier from Google or Apple. We never see your Google or Apple password. Apple lets you hide your email address behind a private relay address, which we then use instead.
• Profile details you choose to add. Profile photo, mobile number, date of birth and gender. These are optional. Leaving them out only means features like birthday greetings won't work for you.
• Church life. The church you belong to and whether you're approved, your role (member or admin), the groups and serving teams you're in, roster duties, the availability you give for events (including any notes), event reminders, poll votes, reactions, the churches you pin, and your notification settings.
• Event tickets. When you book a ticket or RSVP for an event, or a church gives you one: the event, the ticket type, any names you enter for the people attending, when you booked, and when each ticket was checked in at the door.
• Things you post. Messages in church, group and event chats, and anything you upload. Church admins also post sermons, notices and files.
• Worship team tools. If your church gives you access to song charts, we keep your song preferences and notes.
• Sign-in and device information. When you sign in, we record your IP address and device or browser type, to keep your account secure. Our servers also keep short-lived technical logs of requests.
• Push notification tokens. If you allow notifications, we store a token that lets Apple or Google deliver notifications to your device.
• Location, only when you ask. If you tap "use my location" to find nearby churches, your device sends us your approximate location for that search, and your browser's session remembers it for your next search. We don't save it to your account or track where you are.
• Requests and reports. If you ask us by email or our request form to delete your account, we receive your email address, any reason you give, and technical details (account number, IP address and device type) so we can confirm the request is really from you. If you report content, we keep your report.
• Website enquiries. If you fill in the interest form on our website, we receive your church's name and your name, email address, phone number and comments.

We don't use advertising or analytics tools, and we don't build profiles of you for marketing.

4. Sensitive information: your religious beliefs

Belonging to a church on Strong Steeple shows something about your religious beliefs, which POPIA treats as special personal information. We process it only to run the Service for you and your church, and only with your explicit consent, which we ask for when you create your account. Your church, as a religious organisation, may also process it for its own members under POPIA section 28. We don't share it with anyone outside your church except the service providers listed below, who handle it only on our instructions.

5. Why we use your information

• To run the Service you signed up for: your account, church membership, groups, events, rosters, messages and notifications. This is necessary to provide the Service to you, and for the religious information above, we rely on your consent.
• To keep the Service safe: securing accounts, stopping abuse and spam, and handling reports. This is in our and our users' legitimate interest.
• To answer you: support questions, deletion requests and website enquiries.
• To meet legal duties where the law requires it.

We don't use your information for anything unrelated to these purposes, and we don't send direct marketing. If that ever changes, we'll ask for your permission first.

6. Who can see your information

• Your church's admins can see your name, email address, photo, mobile number, date of birth, gender, groups and availability, and can update your church details. They're also told about members' birthdays.
• A church whose event you book: its admins see your name, email address and the tickets you booked (including any attendee names), even if you aren't a member there. Whoever checks tickets at the door sees the name on each ticket.
• Other members of your church can see your name and photo, the messages and reactions you post, and your group memberships and roster duties where these are shown in the app.
• The public can see what churches choose to publish, such as their address, public events, sermons and notices. Your profile is never public.
• Our service providers (below), and authorities where the law requires us to share information.

We do not sell your personal information.

7. Service providers and where your information goes

We use a small number of providers to run the Service. They act only on our instructions and are bound by their own data protection terms. Most are outside South Africa:

• DigitalOcean: hosts the app, database and uploaded files, in Amsterdam, the Netherlands.
• Brevo: sends our emails (for example password resets and notifications), in the European Union.
• Google: delivers notifications to Android devices (Firebase Cloud Messaging), provides Google sign-in, and hosts our support inbox (Gmail). Mainly in the United States.
• Apple: delivers notifications to iPhones and iPads (Apple Push Notification service) and provides Sign in with Apple, in the United States.

Notifications and emails can include your church's name and part of a message, so these providers handle that content when they deliver it.

We send information outside South Africa only to providers that are bound by data protection laws or agreements giving protection similar to POPIA's (POPIA section 72), and with your consent.

Bible readings. Scripture text and audio come from the free Bible service at bible.helloao.org. When you play an audio reading, your device streams it directly from that service, which sees your IP address the same way any website does. We don't send it anything about you.

8. How long we keep it

• Your account and profile: until you delete your account or ask us to.
• When you leave a church: we delete the messages, reactions and sermons you posted there, along with your group memberships, roster duties and availability for that church.
• When your account is deleted: we delete your profile and the content you posted. Content you published for your church as an admin, such as sermons, notices or files, stays with the church without your name.
• Shared files that a church sets to expire are deleted 30 days after they expire.
• Sign-in records: deleted 6 months after they were last used, or sooner when you sign out or your account is deleted.
• Notifications: deleted 90 days after we send them, or once they expire if that's later.
• Event tickets and RSVPs: deleted 1 year after the event. If your account is deleted first, your tickets go with it.
• Content reports: deleted 1 year after we last acted on them.
• Deleted accounts: we keep only the date and an internal account number as a record that the deletion happened, for 5 years. If you asked us by email, we delete the request emails once it's done.
• Website enquiries: deleted 2 years after you send them.
• Backups: our hosting provider's database backups roll off after about 7 days, so deleted information can survive in a backup for that long.

9. How we protect it

All traffic is encrypted (HTTPS), passwords are hashed, and our hosting provider encrypts the database and stored files at rest. Access to production systems is limited to the Information Officer and protected by individual keys. Church admins can see only their own church's members. If a security breach affects your personal information, we'll notify you and the Information Regulator as POPIA requires.

10. Age

You must be 18 or older to create a Strong Steeple account. Church admins may not add anyone under 18 unless the church has their parent or guardian's consent. If you think we hold a child's information without that consent, email support@strongsteeple.co.za and we'll remove it.

11. Your rights

Under POPIA you can:

• Ask what we hold about you and get a copy, free of charge.
• Correct your information. You can edit most of it yourself in your profile.
• Have it deleted. Delete your account yourself in the app under Settings, Delete account, which takes effect straight away. If you can't sign in, use our account deletion page or email us.
• Withdraw your consent at any time. Because the Service can't work without processing your church membership, withdrawing consent means deleting your account. Withdrawing doesn't affect processing that happened before.
• Object to processing we do in our legitimate interest.
• Turn off notifications in the app's settings or your device settings.
• Complain to the Information Regulator if you're unhappy with how we've handled your information.
• Ask for other records we hold under the Promotion of Access to Information Act, as our PAIA manual explains.

To use any of these rights, email support@strongsteeple.co.za from the address on your account. We'll respond within 30 days. Where your church holds the details (see section 2), we may involve your church admins.

The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Email: enquiries@inforegulator.org.za · Phone: 010 023 5200
Website: inforegulator.org.za

12. Cookies

We use only the cookies needed to keep you signed in and secure, plus small preferences such as dismissing the app download banner. We don't use cookies for advertising or tracking.

13. Changes to this policy

When we change this policy, we'll update the date above. If a change affects what you've agreed to, we'll ask for your consent again the next time you open the app.

14. Contact

Questions about this policy or your information? Email support@strongsteeple.co.za.