Privacy Policy

1. Who we are

Still Rooted ("Still Rooted", "we", "us" or "our") operates the website and web application at https://stillrooted.org (the "Service"). The Service helps churches stay connected with members of their church family who live in continuing-care facilities, hospitals or at home, through handwritten cards and letters, care packages, flowers, visit and meal sign-ups, birthday reminders, prayer requests and donations.

This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it and the choices you have. If you have questions, contact us at stillrootedadmin@gmail.com.

2. Information we collect

a. Information from Google Sign-In

You sign in to the Service with your Google account. When you choose to sign in, Google shares the following with us, with your permission, using the standard "openid", "email" and "profile" scopes:

• your name;
• your email address and whether Google has verified it;
• your profile picture; and
• a unique Google account identifier used to confirm the sign-in.

We do not receive your Google password, and we do not request access to your Gmail, Google Drive, Google Calendar, contacts or any other Google data.

b. Information you or your church add

• Account and church details: your role in your church (member, staff or administrator), your church's name, return mailing address and settings.
• Information about people your church cares for ("residents"): names and preferred names, birthdays, facility names and room numbers, mailing addresses, photos, care notes, and remembrance details. This is entered by church members and staff for the purpose of caring for that person.
• Letters and cards: the messages you write, Bible verses you choose, how you sign the card, card designs, doodles, and any pictures or children's drawings you upload for Special Cards.
• Other recipients and saved addresses: names and mailing addresses of people you send cards to who are not residents, including addresses you choose to save for later.
• Prayer requests you post, and replies sent by residents and their families.
• Visit, meal and care requests, including dates, notes, and florist or gift choices.

c. Payment information

Card payments and donations are processed by Stripe. You enter your card details directly into Stripe's secure payment form; we never see or store your full card number or security code. We receive and keep a record of the payment, such as the amount, date, what it was for, the payment status and the Stripe payment reference.

d. Technical information

When you use the Service, our servers automatically record basic technical information needed to run and secure it, such as your IP address, browser type, the pages and features requested, and the date and time. We use one essential cookie, session_token, to keep you signed in. Your browser may also store small preferences (such as your season-theme choice) in local storage. We do not use advertising cookies, and we do not use third-party analytics or tracking tools.

3. How we use information

• To sign you in, confirm your identity and keep your session secure.
• To let church administrators approve accounts and assign roles.
• To show residents, letters, prayer requests and schedules to the right members of your church.
• To have your cards handwritten and mailed, and to send care packages and flower requests.
• To process payments and donations, issue refunds and keep the church fund's records.
• To send service emails, such as a weekly birthday and mail reminder to staff, an alert when a letter is waiting for review, a notice that your card is on its way, and receipts or order updates.
• To keep the Service safe, prevent misuse, fix problems and improve how it works.
• To comply with legal obligations.

We do not sell your personal information, we do not share it for advertising, and we do not use it to build advertising profiles.

4. How we use Google user data

Still Rooted's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use your Google name, email address and profile picture only to create and identify your Still Rooted account, sign you in, show your name and picture to members of your church inside the Service, and send you service emails.
• We do not sell Google user data, and we do not use or transfer it for advertising, credit-worthiness or any purpose unrelated to providing the Service.
• We do not allow humans to read your Google user data except with your permission, when needed for security or to investigate misuse, or when required by law.
• We do not use Google user data to train artificial-intelligence or machine-learning models.

You can remove Still Rooted's access to your Google account at any time at https://myaccount.google.com/permissions. Removing access stops future sign-ins; to delete the information already stored in your Still Rooted account, contact us as described in section 8.

5. Who we share information with

Within your church. Each church's information is kept separate from every other church. Inside your church, what you can see depends on the role an administrator gives you. Some actions, such as deleting residents or letters, are limited to administrators.

Service providers. We share only the information each provider needs to perform its service for us:

• Google: to sign you in.
• Stripe: to process card payments, donations and refunds.
• Handwrytten: to write and mail cards. Handwrytten receives the card message, the signature, the card design or uploaded picture, the recipient's name and mailing address, and the church's return address.
• Our email delivery provider: to send service emails to the addresses involved.
• Our hosting, database and file-storage providers: to store and run the Service securely.

Public pages. A resident or family member who receives a reply link can view only the letter they were sent. Children's drawings appear in the church's Special Card Gallery only when the person who uploaded them gives permission, and only the child's first name and age are shown.

Legal reasons. We may share information if required by law, to respond to valid legal requests, or to protect the safety, rights or property of our users, churches or the public.

6. How long we keep information

• Account, resident, letter and church information is kept while your church uses the Service, or until it is deleted.
• Residents deleted by an administrator are kept in a "Recently deleted" list for 30 days so mistakes can be undone, then permanently removed.
• Sign-in sessions expire after 7 days.
• Payment and donation records may be kept longer where needed for accounting, tax or legal purposes.

7. Security

We protect information with encrypted HTTPS connections, secure, HTTP-only sign-in cookies, role-based access controls, separation of each church's data, and limits on who can delete information. No method of transmission or storage is completely secure, but we work to protect your information and will act promptly if we learn of a problem.

8. Your choices and rights

• Access and correction: you can see and update much of your information in the Service, or ask your church administrator for help.
• Deletion: you can ask us to delete your account and the personal information connected to it by emailing stillrootedadmin@gmail.com from the email address on your account. We will respond within 30 days. Some records, such as payment records, may be kept where the law requires.
• Information about someone else: if you are a resident or family member and want information about you corrected or removed, contact your church or email us.
• Emails: staff can ask an administrator to turn off the weekly reminder email. Essential service emails, such as payment receipts, may still be sent.
• Google access: you can revoke access at any time as described in section 4.

Depending on where you live, you may have additional rights under local law, such as the right to request a copy of your information. Contact us to make a request.

9. Children's privacy

The Service is intended for adults. We do not knowingly allow children under 13 to create accounts. Children may draw pictures that an adult uploads for Special Cards; the adult decides whether the drawing may be shown in the church's gallery. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above, and for significant changes we will let users know in the Service or by email.

11. Contact us

Still Rooted
Website: https://stillrooted.org
Email: stillrootedadmin@gmail.com

See also our Terms of Service.