Privacy

Chapelbook app privacy policy.

This covers the Chapelbook app for iPhone and Android, and the web app at app.chapelbook.com. Effective October 20, 2026.

Who we are

Chapelbook is church software built by Sam Bartolotta in Central Arkansas. A church uses it to keep its people, kids' check-in, calendar, messages, volunteer schedule and giving records in one place.

This policy is about the Chapelbook apps. The Chapelbook website, chapelbook.com, has its own short website privacy page.

Two roles. Your church decides what goes into Chapelbook and who in the church can see it. In privacy terms, the church is the one in charge of the data, and Chapelbook is the service provider that stores and protects it for the church. We use it only to run Chapelbook for that church.

That means your church is the best place to ask about your information. You can also ask us directly. We will help.

What the app collects

Not everything below applies to every church. A church chooses which features to use.

About you, when you sign in

• Your name and email address, as your church entered them. You sign in with a link or code we email you. There is no password.
• Your role at the church, such as member, leader, staff or pastor.
• A sign-in token kept on your device so you stay signed in. On the phone it sits in the phone's secure storage.
• Your small settings, such as text size and which alerts you want.

What your church puts in

• Names, households and family roles, addresses, phone numbers, email addresses and birthdates.
• Church life: attendance, groups, forms and the answers people give, notes (some limited to leaders or the pastor), serving schedules and your answers to serving requests.
• Messages inside Chapelbook, and email replies sent into message threads.
• Reports. If a member reports a message, the church's leaders get a copy of the words so they can act on it.
• Giving records: the date, amount, fund and donor name. They come from the church's own Zeffy account or from the church entering cash and checks. We never see card or bank numbers. In the app you see only your own giving and statements. A person who handles the church's giving sees more, and only after unlocking giving with Face ID or a PIN.

Records kept for safety

• Who opened the church's giving screens and when (never the amounts). Only people who handle giving and the pastor can read this log.
• A log of important changes, such as role changes and data exports, so a church can see who did what.

What we do not collect

Social Security numbers. Card or bank numbers. Your GPS coordinates (they stay on your phone). Face scans (Face ID stays on your phone). Your contacts. Your microphone. Advertising IDs. Please do not type card or bank numbers into notes or messages.

What your phone asks about

Each of these is off until you choose it. You can turn any of them off again in your phone's settings.

• Location, for Arrival welcome. If you turn on Arrival welcome, your phone checks whether you are at your church so it can show a short welcome. The check happens on the phone. Your GPS coordinates are not sent to your church or to us. On iPhone, if you pick "Even when the app is closed," the phone watches one spot, your church's parking lot. Android never runs in the background for this.
• "Let my church know I've arrived." This is a second, separate switch, and it is off by default. If you turn it on, Chapelbook keeps a record that you arrived at your church today and what time, linked to you and your church, so the church's greeters can see it. We do not send your GPS coordinates or your distance from the church. The record is deleted automatically after about 30 days. Because it comes from your location, we treat it as location data. Tapping "I'm here" does not read your location; if this switch is on, it creates the same arrival record.
• Camera. Used only to scan the pairing code when you set up a phone or tablet as a check-in kiosk. The camera is never used for anything else, and it takes no pictures.
• Notifications. If you turn on phone alerts, we keep a code for your phone so alerts can reach it. An alert shows a short title and a preview, such as "Can you serve Sunday?"
• Face ID or fingerprint. Only for people who handle church giving, and only if they choose it. Your phone tells the app yes or no. Your face and fingerprint never leave the phone. A PIN works instead.

Children and teens

Churches keep records about children, mostly for kids' check-in and classes. This section says plainly what we do.

No accounts for children

• Children do not have Chapelbook logins. There is no sign-up screen. A login exists only when a church leader invites a grown-up's email address.
• We do not ask children for anything. A parent or the church enters a child's information. At a check-in tablet, a parent does the typing.
• The database itself refuses to link a login to a child (a child role, or anyone under 18). If we ever learn that a child under 13 has an account, we switch it off and delete it. Our rule for churches: get a parent's OK before inviting a teen.

What is kept about a child

Name, birthdate, grade, household, and parents. For kids' check-in, a church may also keep allergies, medical and special-needs notes, the list of people allowed to pick the child up, and check-in and check-out times. Staff can also add a "do not release to" alert, which only staff see. These are used to keep the child safe, and for nothing else.

Photos of children

• The only photos in Chapelbook are ones a church's staff or a parent chooses to upload to a person's record, on the web screens that the phone app also opens. The app's camera is never used to take them.
• Children's photos are off by default.
• A photo can exist only while a parent has said yes. The system records who said yes and when.
• When a parent withdraws consent, the photo is deleted. The database does this itself. It does not depend on someone remembering.

What we never do with a child's information

We never sell it. We never use it for ads. We never build profiles of children. We never contact a child. We never use it to train artificial intelligence. We never make it public. Allergy and medical notes are shown only to the staff and volunteers who need them to keep the child safe.

Rules that apply

Chapelbook is built to follow the federal Children's Online Privacy Protection Act (COPPA) and Arkansas's Children and Teens' Online Privacy Protection Act. In plain words:

• We do not collect information from children themselves. Parents and churches supply it.
• A parent can ask to see what is kept about their child, to correct it, and to have it deleted. See how to ask.
• A parent can refuse any further collection about their child. Tell the church or tell us, and we will stop and tell the church.
• Teens (13 to 17) get the same protections: no ads, no sale of their information, no profiles. We apply this in every state, not only Arkansas.

How we use it

Only to run Chapelbook for your church: to show the right records to the right people, send the emails and alerts the church asks for, keep backups, keep the service secure, and fix problems.

We do not sell or rent personal information. We do not use it for advertising. The app has no advertising tools and no analytics tools that follow you. We do not use anyone's information to train artificial intelligence.

Who can see it

• Other churches: never. Each church's records are kept apart inside the database itself. Automated tests check this.
• Inside your church: only people your church's leaders allow. Roles control who sees what. Giving is limited to people given the Giving permission, and to each donor for their own gifts. Private message threads are seen only by people in them.
• Report or block. In Messages you can report a message to your church's leaders, or block a person. A blocked person's messages disappear for you and you get no alerts from them.
• Chapelbook. Sam Bartolotta, and the AI assistant he uses to build and fix Chapelbook (Anthropic's Claude), can see a church's records only when needed to support that church or fix a problem, and for no other reason.
• Others: only if the law requires it, such as a valid court order. We would tell the church first unless the law forbids it.

Companies that help us

These companies work for us. They get only what they need to do their job.

Supabase

The database, sign-in, and stored files. It runs on Amazon Web Services in the United States. This holds your church's records.

Vercel

Hosts the web app at app.chapelbook.com. It sees ordinary web traffic and standard request logs.

Resend

Sends our emails: invitations, sign-in links, messages, and receives email replies. It sees names, email addresses, and what the email says.

Expo, Apple and Google

Deliver phone alerts. They see your phone's alert code and the alert's title and short preview.

Zeffy

Online giving, in the church's own Zeffy account. The Give button opens Zeffy outside the app. Zeffy's privacy policy applies there. We receive gift records from it. We never touch the money.

Netlify

Hosts this website only. It is not part of the app.

Google Workspace

Our email. It holds any message you send to hello@chapelbook.com.

Twilio

Texting, only if a church turns on texting with its own number. Texting is not turned on for any church today. We will update this page before it is.

We do not share personal information with advertisers, data brokers or anyone else. If we ever add another company, such as an error-reporting service, we will update this page before it goes live and it will not receive names, messages or records.

How long we keep it

A church's records stay while the church uses Chapelbook. The church can change or remove them whenever it wants. Some things are cleared sooner:

• "Arrived today" records: about 30 days, then deleted automatically.
• Copies of sent emails in our queue: 30 days, then deleted automatically.
• Phone alerts waiting to send: 7 days, then deleted automatically.
• A child's photo: deleted the moment a parent withdraws consent.
• Allergy and medical notes: a church can edit or clear them any time. We also clear them automatically, every day, about one year after the child's last check-in. If a child never checked in, it is one year after the notes were last changed.
• Check-in and check-out history: kept while the church uses Chapelbook, because many churches' insurers ask for it. A church can ask us to delete it sooner.
• Removed people: "Remove" hides a person and can be undone. To erase someone for good, use Delete my account, or ask us.
• If a church stops using Chapelbook: the church can export everything first. We delete the church's data 30 days after the cancellation takes effect. We email the church's leaders before we do. Backups are cleared within 30 days after that.
• Backups: kept for a short time so we can recover from a failure. Deleted information leaves backups within 30 days. We never use a backup to bring back something that was deleted on purpose.

Delete your information

You do not need a reason. We will never ask for your password.

If you are a member or a parent

Fastest way, in the app: open More and tap Delete my account. Or ask in one of the other ways: tell your church office, or email hello@chapelbook.com with your name, your church, and whether you want your own information deleted or a child's. All three are handled the same way.

1. Right away: your login is switched off and you are signed out. Your phone's alert code, your arrival records and your photo are deleted. Your church's leaders and Chapelbook support are told.
2. We reply within 5 business days. We confirm with the church that the request is really from you, so nobody can delete or read your information by pretending to be you.
3. Within 30 days, the rest is erased: your person record, your messages, your form answers, and your check-in, serving and follow-up history.
4. Giving stays, without your name. The church needs its giving records for its books and tax statements. Your gifts stay as anonymous gifts, with no name, no email and no link to you, so the church's totals still add up. Pledges are deleted. Incident reports you wrote about a child's safety are also kept.

If you are the only pastor or admin of your church, your login stays on so the church is not locked out. We record your request and contact you to sort it out.

For a child, a parent can ask for the child's allergy and medical notes, photo, pickup list and other records to be corrected or deleted in the same way. A parent can also withdraw photo consent at any time, and the photo is deleted at once.

If you are a church

Your leaders can export all of your data any day, as CSV and JSON, without asking. To delete everything, a pastor or admin emails hello@chapelbook.com from the address on the account. We confirm by calling the church office number we have on file, then delete the church and all its people within 30 days. Backups follow within 30 days after that.

The same steps are on one short page: chapelbook.com/delete-account.

Security

• Everything travels over an encrypted connection (HTTPS). The store versions of the app refuse an unencrypted connection.
• Each church is a separate space. Database rules stop one church from reading another's records, and we test those rules automatically.
• Giving is locked by default. It opens with Face ID or a PIN, locks itself after 5 minutes of no activity, and every unlock is logged.
• Sign-in is by emailed link or code, so there is no password to steal.
• The app keeps your sign-in in your phone's secure storage.

No system is perfectly secure. We keep very little sensitive information on purpose.

If something goes wrong

If we find a security problem that affects a church's information, we tell that church right away, with the facts we have, and keep updating them. We help the church tell families as Arkansas law and any other law that applies requires. Where more than one state's law applies, we follow the strictest deadline.

The demo church

The app includes a demo church for app store reviewers and for showing Chapelbook to churches. Every person in it is invented. A few demo logins can use a password. Real churches cannot: the database refuses a password sign-in for any real church. The demo church is reset regularly.

Changes and contact

If we change this policy in a way that matters, we update the date at the top and email each church's leaders before the change takes effect.

Questions or requests: hello@chapelbook.com or (501) 514-5811. Sam Bartolotta answers every privacy question himself.

See also the website privacy page and the terms and data agreement.