LEGAL

Privacy Policy

Last updated: 2026-09-20

This Privacy Policy describes how the LW Churches API ("we", "us", "the service") collects, uses, and protects your data when you use the admin dashboard and associated REST API.

Data we collect

  • Account credentials: username and a bcrypt password hash (admin login only).
  • KingsChat profile: when you sign in via KingsChat OAuth, we store your KingsChat user ID, username, and display name.
  • Role & access assignments: your role (admin / admin_manager / rzm) and the regions or zones you are authorized to view.
  • Audit log entries: actions you perform (create, update, delete, approve, reject) are recorded with your user ID, the entity affected, and a timestamp.
  • Login attempts: failed and successful admin logins are logged per IP address and username for brute-force protection. These records are automatically purged after 7 days.
  • Technical data: IP address (for rate limiting and security logging). No analytics, advertising, or third-party tracking cookies are used.

Where data is stored

All data is stored in a single MariaDB/MySQL database hosted on the same server as the application (Coolify-managed or your own infrastructure). Data does not leave this infrastructure except for the one-time KingsChat profile lookup that occurs during OAuth sign-in.

Cookies

The service uses a single first-party session cookie (churches_api_sess) to keep you signed in. The cookie is marked HttpOnly and SameSite=None and Secure where KingsChat authentication is available. No tracking, advertising, or analytics cookies are set. No consent banner is required because no non-essential cookies are used.

Data retention

  • Account and audit data is retained for the lifetime of the service.
  • Login attempt records are automatically deleted after 7 days.
  • Rate-limit counters are automatically deleted after 24 hours.

Your rights (GDPR / CCPA)

If you are in the EU, UK, or California, you have the right to:

  • Access the personal data we hold about you.
  • Export a copy of your data in JSON format.
  • Rectify inaccurate information (e.g. display name).
  • Erasure — request deletion of your account and associated records.
  • Object to processing or withdraw consent (OAuth login).

To exercise any of these rights, contact the service administrator. The administrator can export or delete your user record, role assignments, and audit entries from the Users page in the admin dashboard.

Security

Passwords are stored as bcrypt hashes. Session cookies are protected with HttpOnly + SameSite attributes. The admin login is protected by CSRF tokens, rate limiting, account lockout, and (optionally) Cloudflare Turnstile CAPTCHA. All database queries use parameterized statements. Security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are set on every response.

Contact

For privacy questions or data requests, contact the service administrator through your organization's internal channel.

Back to dashboard