Privacy Policy

What Information Do We Collect?

When you create an account or use the Service, we may collect:

• Your email address and display name;
• Your password (stored as a secure hash — we never see it in plain text);
• Your church name and church code (if you register or join a church map);
• Prayer notes and any other content you choose to enter into the Service;
• Messages or enquiries you send to us by email or via the contact form.

When you record prayer walks or mark streets, we collect:

• GPS route data (start point, waypoints, distance, duration) — only while a walk is actively in progress;
• Street segment identifiers and associated prayer data you post;
• Timestamps of prayer activity.

GPS data is used only to record and display your prayer routes. It is not used for advertising, profiling, or sold to any third party.

We do not receive personal information from third parties. However, third-party services integrated into the Service (such as Mapbox for mapping and Supabase for authentication) may collect technical data such as your IP address and browser type in connection with providing those services. Please refer to their respective privacy policies for details.

By using Pray Every Street, your use of the Service implies that you hold Christian religious beliefs. Under UK GDPR, religious belief is a 'special category' of personal data. We process this category with your explicit consent, granted by your acceptance of this Privacy Policy and your active use of the Service. This information is not shared publicly or sold to third parties.

How Do We Use Your Information?

We use the information we collect for the following purposes:

• To create and manage your account, and to authenticate you when you sign in;
• To deliver the core features of the Service — including displaying your prayer routes, street highlights, and prayer notes on the map;
• To enable church administrators to coordinate prayer activity across their congregation;
• To aggregate anonymised prayer data for the global prayer map;
• To respond to your enquiries and provide support;
• To send you service-related communications (such as password resets or important policy updates);
• To send you optional email updates about prayer activity, if you have opted in;
• To improve the Service, fix bugs, and understand how it is being used;
• To detect and prevent fraud, abuse, or security breaches;
• To comply with our legal obligations.

We will never use your data for targeted advertising, and we will never sell it.

Legal Bases for Processing

Under UK GDPR, we rely on the following legal bases to process your personal information:

• Consent — for the processing of your religious belief data (special category), for optional marketing emails, and for GPS data. You may withdraw consent at any time by contacting us or updating your account preferences.
• Performance of a contract — to provide you with the Service you signed up for, including account management, prayer walk recording, and map functionality.
• Legitimate interests — to maintain the security and integrity of the Service, to improve our features, and to prevent fraud, where these interests are not overridden by your rights.
• Legal obligation — where we are required to process or disclose data to comply with applicable law.

We are the data controller for your personal information as described in this policy. If you have questions about our role or your rights, please contact us at [email protected].

When and With Whom Do We Share Your Information?

We do not sell your personal information. We may share it in the following limited circumstances:

We use the following third-party providers to operate the Service, each of whom processes data only as instructed by us and under appropriate data protection agreements:

• Supabase — database storage and user authentication. Data stored in the EEA.
• Mapbox — interactive map rendering. Mapbox may collect certain technical usage data.
• Cloudflare Pages — website hosting and content delivery.
• Stripe — donation payment processing. Stripe handles all payment card data; we receive only a transaction confirmation.
• Resend — transactional email delivery (e.g. password resets, welcome emails).

If you join a church map, the church administrator(s) for your church will be able to see your display name and which streets you have prayed. Other members of your church cannot see this information. Street data displayed on the public global map is always anonymised.

We may disclose your information where required to do so by law, court order, or in response to a lawful request from a regulatory authority or law enforcement agency.

In the unlikely event that Pray Every Street or its underlying assets are transferred to another Christian organisation, your data may be included in that transfer. We would notify affected users in advance.

Cookies and Tracking Technologies

We use a small number of essential cookies to operate the Service — principally to maintain your login session. We do not use advertising cookies, and we do not use third-party tracking or analytics cookies.

Mapbox, as a third-party service embedded in the app, may set its own technical cookies in connection with rendering maps. Please refer to the Mapbox privacy policy for details.

You can control cookies through your browser settings. Disabling essential cookies may affect your ability to log in or use the Service.

How Long Do We Keep Your Information?

We retain your personal information for as long as your account is active, or for as long as is necessary to provide the Service and comply with our legal obligations.

If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, financial records related to any donations you have made, which may be retained for up to 7 years).

Prayer walk routes and street data associated with a deleted account will be anonymised and may be retained as part of the aggregate global map data.

How Do We Keep Your Information Safe?

We implement appropriate technical and organisational measures to protect your personal data, including:

• All data is transmitted over HTTPS (encrypted in transit);
• Passwords are hashed using industry-standard algorithms — we never store plain-text passwords;
• Database access is restricted and authenticated;
• User data is isolated by church — members cannot access another church's data;
• Prayer walk data is anonymised on the global map.

Despite these measures, no internet transmission or storage system is completely secure. If you believe your account has been compromised, please contact us immediately at [email protected].

Children's Privacy

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children under the age of 18. If a child has registered without parental consent, or if you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete the relevant data promptly.

Your Privacy Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you;
• Right to rectification — to ask us to correct inaccurate or incomplete data;
• Right to erasure — to ask us to delete your personal data ('the right to be forgotten');
• Right to restriction — to ask us to limit how we process your data;
• Right to data portability — to receive your data in a structured, machine-readable format;
• Right to object — to object to our processing of your data where we rely on legitimate interests;
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time.

To exercise any of these rights, please email us at [email protected]. We will respond within 30 days. You will not be charged for making a request, and we will not discriminate against you for exercising your rights.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK data protection supervisory authority, at www.ico.org.uk or by calling 0303 123 1113.

If you have opted in to receive prayer updates or newsletters from Pray Every Street, you may unsubscribe at any time using the unsubscribe link in any email we send, or by emailing us at [email protected]. Opting out of marketing will not affect service-related communications.

Do-Not-Track Signals

Some browsers offer a 'Do Not Track' (DNT) signal. Because there is no universally agreed standard for how websites should respond to DNT signals, we do not currently alter our data practices in response to DNT requests. We will revisit this if a recognised standard is adopted.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, applicable law, or our data practices. When we make significant changes, we will notify you by email or by a prominent notice within the Service. The 'Last updated' date at the top of this document shows when the policy was most recently revised.

We encourage you to review this policy periodically. Continued use of the Service after any update constitutes your acceptance of the revised policy.

How to Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or to your personal data, please contact us:

How to Review, Update, or Delete Your Data

You can review and update your account information at any time by logging in to your account settings within the app at app.prayeverystreet.com.

To request deletion of your account and all associated personal data, please email us at [email protected] with the subject line 'Data Deletion Request' and we will action your request within 30 days.