Privacy Policy

Last updated 2026-10-14

Wozer Church Media (WCM) is built offline-first on purpose: the app's actual job — listening to a service and matching scripture, word studies, and sermon points — happens entirely on your own computer. Nothing about how a church actually uses the app gets sent anywhere. This page covers the much smaller set of things that do involve us directly.

What we collect

• When you request the free trial or buy a license: your church name and an email address, submitted through the forms on this site. We use this to follow up, send your license, and (for a Ghana Mobile Money request) arrange payment manually.
• When you activate a license inside the app: your church name and a hardware-derived device identifier, sent once to our activation server to issue a signed certificate and enforce your plan's seat limit. Apart from activation, the app only goes online for features you switch on yourself (below).
• Follow along and your church page (only when a church switches Follow along on): while it is on, WCM sends what is on screen for members to follow: the scripture reference, the sermon title and speaker, the current sermon point, and, if the church turns them on, live captions and song lyrics. After the service we keep the scripture references, points, song titles (never lyrics), and any notes the pastor chooses to share, so members can look back. Announcements and recording links are added by the church on its dashboard. Members don't create accounts; joining a church needs only its code.
• Notifications (WCM Bible and WCM Study Bible, optional): if a member turns on notifications from their church, the phone's notification address (a token issued by Google Firebase on Android, or by the browser on iPhone) is stored against that church's code, with the kinds of notification they picked. It is used only to send that church's notifications (a service is live, a recording is ready, announcements, today's devotional, a group guide, and for team members their own duties). No name or phone number is stored with it, and it is deleted when they tap Leave this church or turn notifications off.
• Prayer requests (optional): a member can send a prayer request to their church. They choose to show their name, hide it (no name is stored, but the church can still reply through a private code kept on the member's phone), or stay fully anonymous (no reply possible). Requests are seen only by the church's Admin and its Prayer team, who can also pass one to the pastor or show it on the church screen in WCM (with the name only if the member chose to show it). They are deleted automatically after 60 days.
• Sermons sent from WCM Study Bible to WCM: the sermon a pastor sends (title, scriptures, points, notes, announcements, songs) waits in our server's inbox until the church's WCM collects it.
• If you buy by card: payment is handled entirely by Stripe on Stripe's own hosted checkout page. Your card number never reaches us or this website — we only receive confirmation that a payment succeeded.
• Crash reports (optional, on by default, can be turned off in Settings): if the app crashes or hits an unexpected error, a report describing what happened and where is sent to help us fix it. This report never includes your sermon audio, transcripts, or anything you've displayed.

What we never collect

• Sermon audio, live transcripts, scripture history, or anything else the app detects or displays during a real service. This processing is 100% local — the audio never leaves the computer it's running on, not even temporarily, not even to us. If a church sends live captions to members' phones, each caption line passes through our service to the phones and is not kept.
• No analytics, no advertising trackers, no cookies of any kind on this website.
• No member accounts: members join a church with its code alone. The only sign-in anywhere is the optional WCM Study Bible sync (below), and no personal profile is kept beyond the church name and email used for a trial request or purchase.
• No ads, and we never sell anyone's information.

Church Life: what a church collects from its members

Church Life is the part of the church page a church uses with its own people: the team rota, visitor welcome, testimonies, prayer requests, daily devotionals, small-group guides and Insights. It is stored on our Follow along service (hosted on Cloudflare), kept separately for each church code. Members never create an account.

Who is responsible for it

The church decides whether to switch each part on, what to ask its members, and who on its team can see the answers. So the church is responsible for its members' Church Life information (in data-protection terms, usually the "controller"). Wozer Church Media stores it and runs the service for the church, and uses it for nothing else. If you want to see, correct or remove something you gave a church, ask that church first; we will help the church act on it, and you can also contact us (below).

Visitor details

• What is sent: a first-time visitor can fill in a short form in the app: their first name and, if they wish, a phone or WhatsApp number, the area they live in, how they heard about the church, and a prayer request. Nothing is kept unless they tick that the church may contact them. If they also tick "Show my first name on the welcome screen", their first name can appear on the church screen, but only after someone on the church's team approves it.
• Who sees it: only the church's Admin and its Welcome team (people the Admin gave a Welcome team link).
• How long: visitor details are deleted automatically after 12 months.
• Removing it: the visitor can tap Remove my details in the app at any time and their details are deleted at once (only a count of visitors remains, never a name). The church can also delete them on its dashboard.

Testimonies

• What is sent: a title, the testimony itself, an optional scripture, and the sender's name exactly as they choose to show it: full name, first name only, or anonymous (no name at all).
• Private or public: a private testimony is seen only by the church's Admin and the Media team links the Admin made; it never appears on the church page or the church screen. A public one can be shown on the church page and on the church screen in WCM, but only after the church approves it.
• How long: testimonies that never became public (private, declined or not yet approved) are deleted automatically after 12 months. Approved public testimonies stay until the church removes them; the church page shows the newest 30.
• Withdrawing one: ask your church to take it down. The church can edit, unpublish or delete it on its dashboard at any time, and a testimony that was sent to the church screen is then taken off it. You can also contact us.

The team rota

• The rota holds the duty roles for each service date and the volunteers' names as the church types them. No phone numbers or email addresses.
• A volunteer with a Volunteer team link sees the rota and their own duties, and can say "I can't make it" with an optional short reason. The reason is seen only by the church's Admin and Media team (and the volunteer who wrote it); others on the rota only see that the person can't make it.
• The church can change or remove names and dates on its dashboard at any time.

Daily devotionals and small-group guides

• These are written by the church's pastor (or a preacher the Admin allows) in WCM Study Bible Pro and sent to members at the time the church chose. They are deleted automatically after 24 months.
• Small groups record only how many people joined, never who. A group leader can report that the group met and how many were present, as a number.
• How many times a devotional was opened is kept as a number only.

Insights

• Insights shows the church's Admin numbers only: services, how many followed, visitors, prayer requests, testimonies, devotionals and guides opened, group meetings, and the scriptures used most. It never shows who did what. Monthly totals are kept for 24 months.
• To count new and returning followers, the app uses a random id it made for itself when it was installed (nothing personal, not linked to a phone number or any account). The service keeps only a one-way hash of it, salted differently for each church so it can't be matched across churches, never the id itself. That hash is never shown to anyone and is deleted after 90 days.

Team links by role

• The church's Admin can give helpers a team link for one role: Media, Preacher, Prayer, Welcome, Volunteer or Group leader. We store the name the Admin typed for that link, its role, and the secret that makes the link work. No email address or phone number.
• Each link opens only its own part of the dashboard (for example, only the Welcome team and the Admin see visitors). The Admin can switch any link off or delete it at any time.

Join links and QR codes

A church's join link and QR code carry only the church's code (a small-group join link also carries that group's join code). They contain nothing about the person who shares or scans them.

Network addresses and limits

To stop abuse (for example, someone flooding a church with fake forms), the service counts requests per network address and per phone. These counters hold only a short one-way hash of the address or of the app's random id, never the address itself, and the daily clean-up deletes them once their hour, day or week is over.

Church pages made in WCM Study Bible Pro

• A pastor with WCM Study Bible Pro can make a church page without WCM. The page records its owner only as a one-way hash of the Pro key's id. Our licence server checks the Pro key and signs a short-lived permission; the church page never receives the key, its id, or an email address.
• If the page moves to another of the pastor's Pro keys, the previous owner's hash is kept for 30 days so the pastor can still recover the page, then dropped.
• Closing a page: the pastor can close the church page (this needs the pastor's Pro key as well as the Admin link). Closing deletes everything stored for it: services, announcements, Church Life records, team links, notification addresses and any recordings stored with us. All we keep is the code and the date it was closed, so that code is not given to another church page, and members' phones that still hold it are told the page has closed.

What stays on your phone or computer

• Notes, highlights, bookmarks and reading in WCM Bible and WCM Study Bible stay on the device. Leave this church stops following that church and its notifications, and leaves them untouched.
• The private codes that let you read your church's reply to a prayer request or its welcome message after a visitor form, and remove your visitor details, are kept only on your phone; the service stores just a one-way hash of them.
• WCM Study Bible sync (optional): if you sign in with your email to keep notes, highlights, bookmarks and sermons the same on your phone and computer, they are encrypted on your device before upload (end-to-end encrypted). Our sync server stores only that encrypted data and your email (to send sign-in codes), and cannot read what you wrote. Deleting your sync account removes everything stored for it.

Google user data (church dashboard)

The church dashboard at church.wozerchurchmedia.com has an optional Upload to Google Drive button, so a church can put its sermon recordings in its own Google Drive. If a church uses it:

• What we ask for: Google sign-in with one permission only, see, edit, create and delete only the specific Google Drive files you use with this app (the drive.file scope). We cannot see, open or list any other file in the church's Drive.
• What we do with it: create a folder called WCM Sermons in the church's Drive, upload the recording the church picks, set that file to anyone with the link can view so the church's members can listen, and save the file's link on the service it belongs to. Nothing else.
• What we store: only the link to the uploaded file. The sign-in token stays in the browser tab for that visit; it is never sent to or stored on our servers. The recordings stay in the church's own Drive and use its storage. When a member plays a recording in the app, it is streamed from Drive through our server without being stored.
• Sharing: Google user data is not shared with anyone, not sold, not used for advertising, and not used to train AI or machine-learning models.
• Removing access: the church can delete the files or the WCM Sermons folder in Drive at any time, remove a recording from a service on the dashboard, and revoke the dashboard's access at myaccount.google.com/permissions.

Wozer Church Media's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

Church name and email from a signup or purchase request are stored in our own database (hosted on Deno Deploy) and, if you've set it up, mirrored to a Google Sheet you control. Card payments are processed by Stripe under Stripe's own privacy policy. Follow along, church pages, Church Life records (including prayer requests, visitor details and testimonies) and notification addresses are held on Cloudflare; WCM Study Bible sync data is held encrypted on Deno Deploy, and its sign-in codes are sent through our email provider; notifications are delivered through Google Firebase Cloud Messaging (Android) and Apple or the browser's own push service (iPhone and web). We don't sell or share your information with anyone else.

How long we keep it

Signup and activation records are kept for as long as your license is active, so re-activating on a new computer or asking about your plan works without starting over. Church Life records are kept for the periods given above (visitor details and private testimonies 12 months, prayer requests 60 days, devotionals, guides and Insights 24 months), or until the church deletes them or closes its church page. You can ask us to delete your church's record at any time — see Contact below.

Contact

Questions about this policy, or a request to delete your data: reach out through the contact form on the main site.