Privacy Policy

Effective Date: July 21, 2026 | Last Updated: October 7, 2026

Crowded Ventures, LLC ("Company," "we," "us," or "our") operates the HolyCrowds mobile application and related services (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. HolyCrowds offers three account types — individual, church, and business — and this policy applies to all of them.

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, password, first and last name, and the account type you choose (individual, church, or business) — for account creation and authentication

• Profile Information: Profile photo, bio, testimony, interests, phone number, date of birth — for building your profile. Phone number and date of birth are stored privately and are not shown on your public profile

• Organization Information (church & business accounts): Organization name, description, category or denomination, address, service or business hours, logo and photos, livestream and social links, sermons, product/service listings, and current offers — for operating your public organization page

• Location Data: City/region name and coordinates (when you set your location or search for a place) — for showing your general area and finding nearby events, churches, and businesses

• User Content: Direct and group messages, event and post listings, group descriptions, comments, prayer requests, event ratings, business reviews, visitor ("I'm new here") cards, and broadcasts — for providing core features

• Payment Information: If you purchase a subscription, the transaction is processed by Apple. We receive your subscription status and transaction identifiers directly from Apple, but we never receive or store your full credit-card or payment-method details — see Section 4

• Communications: Emails or messages you send to us, support requests, and reports — for customer support and safety

1.2 Information Collected Automatically

• Device & Push Information: Device type, operating system, app version, unique identifiers, and — if you enable notifications — a push notification token (Firebase Cloud Messaging / Apple Push Notification service) so we can deliver alerts

• Usage Data: Pages viewed, features used, and timestamps — for improving the Service. For church and business pages, we count aggregate profile views and outbound link/listing clicks so organizations can see engagement; these counts are not tied to the identity of the individual viewer in the organization's dashboard

• Log Data: IP address, browser type, and crash reports — for security and error resolution

1.3 Information from Third Parties

We may receive information from authentication providers (e.g., Firebase Authentication by Google) and from Apple's App Store confirming your subscription status. We only receive information necessary for authentication, account management, and delivering the features you use.

1.4 Sensitive Information

Because HolyCrowds is a faith-based community, some information you choose to provide — such as your religious affiliation or denomination, testimony, prayer requests, and the faith community you belong to — may reveal your religious or philosophical beliefs. Many privacy laws treat information about religious beliefs, precise geolocation, and the data of a known child as "sensitive." We collect this information only when you voluntarily provide it to participate in the community; we process it based on your explicit consent; we do not use it to infer characteristics about you and we do not use or disclose it for advertising; and you can remove it at any time by editing your profile or deleting your account. We do not sell sensitive personal information, and we use and disclose it only for the purposes permitted by applicable law.

2. How We Use Your Information

• Provide the Service: Create and manage your account, display your profile, facilitate messaging, enable event and group features

• Safety and Security: Detect and prevent fraud, abuse, and violations; enforce our policies; protect users

• Improve the Service: Analyze usage patterns, diagnose technical issues, develop new features

• Communications: Send service-related notifications, respond to your inquiries

• Legal Compliance: Comply with applicable laws, regulations, and legal processes

We do NOT sell your personal information to third parties. We do NOT use your data for targeted advertising.

Lawful Basis for Processing (GDPR)

We process each category of data for a specific purpose and on the legal basis noted in parentheses:

• Name, email, password — account creation & authentication (Contract)

• Profile photo, bio, testimony, interests — public profile & community features (Consent)

• Date of birth — age verification (13+ requirement) (Legal obligation)

• Location (city/coordinates) — nearby events & groups (Consent)

• Phone number — account security & contact (Consent)

• Messages, comments, reviews, prayer requests — messaging & community features (Contract)

• Organization & listing data — church/business pages (Contract)

• Subscription status — providing paid features (Contract)

• Push token — delivering notifications (Consent)

• Device info, usage data, IP address — security, debugging, improvement (Legitimate interest)

• Reports & support requests — safety & enforcement (Legitimate interest)

3. How We Share Your Information

3.1 With Other Users — Your public profile information (name, photo, bio, testimony, interests, general location) is visible to other authenticated users. Messages are visible to their recipients. Comments, event ratings, business reviews, and non-anonymous prayer requests are visible to other users in the relevant context. If you post a prayer request anonymously, your name is not shown alongside it. Church and business page content (organization details, sermons, listings, posts, and broadcasts) is publicly visible. If you are an admin of a church or business, your membership and administrative actions are visible to that organization's other admins.

3.2 With Service Providers — We share information with the following providers who perform services on our behalf:

• Google Firebase: Authentication, database (Firestore), file storage, serverless functions, push messaging (Firebase Cloud Messaging), and crash & error reporting (Firebase Crashlytics) — governed by the Google Cloud Terms of Service and Google Privacy Policy

• Apple: App distribution, in-app purchase billing, and push notification delivery via App Store services. Apple processes your payment; we do not receive your payment-method details

• OpenStreetMap (Nominatim): Forward and reverse geocoding to convert place searches or coordinates to city/state names — governed by OpenStreetMap's privacy policy; only the search text or coordinates are sent, not your identity

• Bible content providers (bible-api.com and API.Bible / American Bible Society): When you search or read scripture, your search query is sent to retrieve the passage; your identity is not sent

These providers are contractually bound to use your information only to provide their services and maintain appropriate security measures.

3.3 For Legal Reasons — We may disclose information to comply with legal obligations, protect our rights, prevent wrongdoing, protect user safety, or protect against legal liability.

3.4 Business Transfers — In a merger, acquisition, or asset sale, your information may be transferred. We will notify you of any change in ownership.

We do NOT sell your personal information, and we do NOT share it with data brokers or advertisers.

4. Subscriptions and Payments

HolyCrowds offers optional paid subscriptions that unlock certain features (for example, organization tools for church and business accounts). Subscriptions are sold as auto-renewable in-app purchases through the Apple App Store.

4.1 What we receive — Payment is handled by Apple. We receive your subscription status, product identifier, and purchase and renewal dates directly from Apple (via the App Store Server API) so we can grant or revoke access to paid features. We never receive, see, or store your credit-card number, CVV, or other payment-method details — those stay with Apple.

4.2 How we use it — We use your subscription status solely to provide the features you paid for, to restore your purchases across devices, and to provide support. Managing or cancelling your subscription is done through your Apple ID / App Store settings, as described in our Terms of Service.

5. Data Storage and Security

5.1 Storage — Your data is stored using Google Firebase infrastructure with industry-standard security including encryption at rest and in transit. Data is primarily stored in the United States.

5.2 Security Measures — We implement reasonable safeguards including encrypted data transmission (TLS/SSL), Firestore security rules, input sanitization (XSS prevention), file upload restrictions, and authentication-based access controls.

No method of transmission or storage is 100% secure. While we use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active. Upon account deletion:

• Your public profile (name, photo, bio, testimony, interests) is deleted immediately

• Your private data (email, phone, date of birth, location coordinates) is deleted immediately

• Your authentication record is deleted from Firebase Authentication

• Messages you sent may persist in recipients' chat histories, as they are part of the recipients' data. Your name on these messages will be replaced with "Deleted user"

• Anonymized or aggregated data (e.g., total user count, feature usage statistics) may be retained but cannot be linked back to you

• Certain data may be retained for up to 90 days as required by law, for fraud prevention, or to resolve disputes that arose before deletion

7. Your Rights and Choices

Access and Update — Access and update your profile information at any time through the Profile page.

Delete Your Account — Delete your account through the Settings page. This permanently removes your profile data.

Location Data — Location is only collected when you explicitly set it. You can remove it at any time.

Notifications — Manage push notification preferences through your device settings.

Data Portability — Request a machine-readable copy of your data by contacting support@holycrowds.com. We will provide it within thirty (30) days.

Subscriptions — View, manage, or cancel a paid subscription any time through your Apple ID / App Store settings.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives you the rights described below, subject to verification and legal exceptions.

8.1 Categories of Personal Information We Collect — In the preceding 12 months we have collected the following CCPA categories: identifiers (name, email, phone number, account and device identifiers, IP address); customer records (password, phone number); characteristics of protected classifications (age/date of birth and, where you choose to provide it, religious affiliation); commercial information (subscription status and transaction identifiers from Apple); internet or network activity (usage and log data); geolocation data (the city/region and coordinates you provide); audio/visual information (profile and organization photos); and other information you submit (testimony, messages, prayer requests, reviews). We collect these from you, your device, and our service providers (Apple and Google/Firebase), and disclose them to service providers for the business purposes described in Sections 2 and 3.

8.2 We Do Not Sell or Share — We do not "sell" your personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined by the CCPA. We have not sold or shared personal information — including that of consumers under 16 — in the past 12 months.

8.3 Sensitive Personal Information — Information that reveals your religious beliefs and your precise geolocation may be "sensitive personal information." We use it only to provide the community features you request and for purposes the CCPA permits — never to infer characteristics about you. Because our use is already limited to those permitted purposes, we honor the right to limit the use of sensitive personal information by default.

8.4 Your California Rights — You have the right to: (a) know and access the specific pieces and categories of personal information we have collected; (b) delete your personal information; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information (we do neither); (e) limit the use of sensitive personal information; and (f) be free from discrimination for exercising your rights.

8.5 Shine the Light — California Civil Code § 1798.83 lets California residents request information about disclosures of personal information to third parties for those third parties' direct marketing. We do not disclose personal information to third parties for their own direct marketing.

8.6 How to Exercise Your Rights — Email support@holycrowds.com, or exercise access, correction, and deletion directly in the app (Profile and Settings). We will acknowledge your request and respond within 45 days (extendable once by another 45 days with notice). We verify requests using the email and information associated with your account. You may use an authorized agent with proof of authorization. If we deny your request, you may appeal by replying to our decision or emailing support@holycrowds.com with "Privacy Appeal" in the subject line.

8A. Other U.S. State Privacy Rights

Residents of other states with comprehensive consumer-privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, as well as additional states whose laws take effect in 2025–2026 (such as Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland) — have rights similar to those above. Depending on your state of residence, you may have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete your personal data; obtain a portable copy of data you provided; and opt out of (i) the sale of personal data, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not sell personal data, use it for targeted advertising, or conduct such profiling, so there is nothing to opt out of. If this ever changes, we will update this policy and provide an opt-out mechanism beforehand.

How to exercise — Email support@holycrowds.com or use the in-app Profile and Settings tools. We will respond within the period your state's law requires (generally 45 days). You may designate an authorized agent to act on your behalf.

Right to Appeal — If we decline to act on your request, you may appeal by emailing support@holycrowds.com with "Privacy Appeal" in the subject line. We will respond within the period required by your state's law (generally 45–60 days) and explain our decision. If your appeal is denied, you may submit a complaint to your state Attorney General.

Nevada Residents — Nevada law (NRS Chapter 603A) allows Nevada consumers to opt out of the "sale" of certain covered information. We do not sell your information as defined by that law; you may still submit a request to support@holycrowds.com.

Washington & Health Data — HolyCrowds is not a health service and does not knowingly collect "consumer health data." If you are a resident of a state with a consumer-health-data law (such as Washington's My Health My Data Act) and believe we hold such data about you, contact support@holycrowds.com and we will address your request.

9. European Residents (GDPR)

If you are in the European Economic Area, you have additional rights under GDPR including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our legal basis for processing includes your consent, contractual necessity, and legitimate interests. Contact support@holycrowds.com to exercise these rights.

10. Cookies and Local Storage

The Service uses local storage and session storage technologies within the mobile application to maintain your authentication session and store your preferences (such as dark mode settings). We do not use traditional browser cookies for tracking. Third-party services integrated with the Service (such as Firebase) may use their own storage mechanisms as described in their respective privacy policies.

Do Not Track: Some browsers send "Do Not Track" (DNT) signals. Because there is no industry consensus on how to respond to DNT signals, the Service does not currently respond to DNT signals. This may change as standards evolve.

11. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users via email and/or in-app notification within seventy-two (72) hours of becoming aware of the breach, or as otherwise required by applicable law. The notification will describe the nature of the breach, the types of information involved, and the steps we are taking to address the incident.

12. Children's Privacy

12.1 Age Requirement — The Service requires users to be at least 13 years old. We verify this by collecting date of birth at registration and denying access to users under 13.

12.2 COPPA Compliance — We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has created an account, we will immediately delete the account and all associated data.

12.3 Users Aged 13–17 — Users between 13 and 17 may use the Service with the knowledge and consent of a parent or legal guardian. Parents may request access to, modification of, or deletion of their child's data by contacting support@holycrowds.com.

12.4 Reporting — If you believe a child under 13 has provided us with personal information, or if you have concerns about a minor's safety on the platform, contact us immediately at support@holycrowds.com, and we will promptly investigate and, where appropriate, delete the account and all associated data.

13. Your Consent and How to Withdraw It

By creating an account and checking the agreement box during registration, you provide explicit consent to the collection and processing of your data as described in this Privacy Policy. You may withdraw your consent at any time by:

• Deleting your account through the Settings page (this withdraws all consent)

• Removing optional data such as your profile photo, bio, testimony, location, or interests through the Profile page

• Contacting us at support@holycrowds.com to request specific data deletion or processing restrictions

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Withdrawing consent for data necessary to provide the Service (email, name) will require account deletion.

14. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our primary data infrastructure (Google Firebase) is hosted. By using the Service, you consent to such transfers. For EU/EEA residents, these transfers are conducted under Google's Standard Contractual Clauses (SCCs) as approved by the European Commission.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes (changes to data collection, sharing practices, or your rights), we will notify you via in-app notification and email at least thirty (30) days before the changes take effect. The "Last Updated" date will be revised. Continued use after the effective date constitutes acceptance. If you do not agree, you should delete your account before the effective date.

16. Contact Us

Crowded Ventures, LLC
Email: support@holycrowds.com
Website: holycrowds.com

For GDPR-related inquiries, you may also contact your local data protection authority.

© 2026 Crowded Ventures, LLC. All rights reserved.