Privacy Policy

The Disciple operates Oriental Orthodox Connect for churches and other authorized organizations ("Church Partners"). This Policy covers visitors to the website and people who use Church Partner accounts. Church Partners decide what content to upload, process, or publish and who may access their administrative accounts. This Policy does not replace an individual Church Partner's own privacy notices to its clergy, speakers, staff, or congregation.

• Account and organization information: names, email addresses, password hashes, roles, church details, contact details, logos, and account preferences.
• Church Content: sermons, audio, video, photographs, transcripts, translations, summaries, subtitles, clips, and associated metadata. Content can include the image or voice of a speaker or another person.
• Integration data: connected YouTube channel identifiers, channel and video metadata, OAuth permissions and tokens, and sync history.
• Service information: processing jobs, feature usage, credit balances, support requests, device or browser data, IP address, security events, and server logs.

We do not ask for payment-card details in the current simulated top-up flow. A future paid checkout would require an updated notice identifying its payment provider and processing.

We receive information from Church Partners and their Authorized Users, from website and API use, and from connected services when a user grants access. When YouTube is connected, the Service can receive channel and video information within the permissions requested at the Google consent screen. Some imported content may also be processed to create requested transcripts, summaries, or clips.

We use information to authenticate users; manage Church Partner accounts; import, store, process, and publish content as requested; transcribe, translate, summarize, and generate clips; operate YouTube sync or publishing when authorized; track usage and credits; respond to support requests; maintain security and reliability; investigate abuse; and comply with legal obligations. We do not use private Church Content to train a general-purpose model of our own without a separate disclosure and any authorization required by law.

Configured AI features use Google Gemini for tasks such as summaries, classification, or translation. Relevant prompts and portions of Church Content, such as transcript text, may be sent to Google to provide the requested result. Transcription can also run with local faster-whisper software on our server. Video processing may generate clips, subtitles, and audio files on the server. AI output may be inaccurate; Church Partners should review it before publication. Google's handling of information is described in its Privacy Policy and applicable service terms.

When an Authorized User connects YouTube, we use the granted access to read eligible channel and video information and, where the feature is enabled and requested, publish to the channel. We store connection credentials and relevant channel or video records while the integration is active. A Church Partner can disconnect YouTube through the Service. Disconnecting removes locally stored connection credentials and stops new sync or publishing through that connection; previously imported video records, downloaded media, and generated outputs may remain in the Church Partner's library until deleted separately.

You can also revoke access from your Google security settings. Revocation at Google does not itself remove copies of content previously imported into this Service. To request deletion of YouTube-derived records or related content, email mark@orientalorthodoxconnect.com and identify the channel or Church Partner. We will verify authorization and handle the request under applicable law and YouTube's policies. Use of YouTube features is also subject to the YouTube Terms of Service.

Based on the current deployment and application code, the principal external providers are Amazon Web Services for backend hosting and server-local media storage, Vercel for frontend hosting, and Google for YouTube integration and Gemini AI processing. PostgreSQL, Redis, and local transcription are operated with the backend infrastructure rather than identified as separate external vendors. Not every provider receives every category of data. We have not identified a live external analytics vendor, transactional-email provider, or payment processor in the current production flow.

We may also disclose information when required by law, to respond to valid legal process, protect users or the Service, investigate abuse, or complete a business transfer subject to applicable obligations. We do not sell personal information for money as part of the ordinary Service.

Content a Church Partner chooses to publish can be viewed, indexed, downloaded, or reshared by others. Draft or other non-public content is intended for authorized access and necessary service processing, not public display through normal Service features. A Church Partner is responsible for checking its publication settings and obtaining necessary permissions, including for people whose image or voice appears in content.

The administrative website uses an authentication cookie to keep an Authorized User signed in. Browser and server technologies also support navigation, security, and operational logging. The inspected frontend does not include an identified third-party advertising or analytics tracker. If non-essential analytics or advertising tools are added, we will update this Policy and provide any legally required choices.

We retain account records, Church Content, integration information, and logs for as long as reasonably needed to provide the Service, maintain security, comply with law, resolve disputes, and honor applicable agreements. Retention can differ by data type and Church Partner plan. Deleting active content may not immediately erase backup copies or content already published to external platforms. We do not state a fixed backup deletion period because one has not been verified for the current deployment. Contact us to request eligible account or content deletion; we may need to verify that you are authorized to act for the Church Partner.

We use access controls, account authentication, transport security for the public API, and operational safeguards intended to protect information. No online service can guarantee absolute security. The Service is hosted in the United States and may be accessed from other countries; laws governing personal information may differ across jurisdictions. Church Partners should assess whether they need additional agreements or notices before uploading regulated or especially sensitive information.

Administrative accounts are for authorized adults acting for Church Partners. The Service is not directed to children under 13 and does not offer individual child accounts. A sermon or other Church Content may nevertheless include a child's image or voice. Church Partners are responsible for obtaining necessary consent and should avoid uploading or publishing a child's information without appropriate authorization. Contact us if you believe information about a child should be removed.

Contact mark@orientalorthodoxconnect.com to request access, correction, export, deletion, or information about our handling of your personal information or Church Content. We will verify the request and respond according to applicable law and the Church Partner's authority over its account. Rights and exceptions differ by location. Authorized Users may also ask their Church Partner administrator to update their account access.

We may update this Policy as the Service changes. We will give notice of material changes when required by law and will not silently apply materially broader uses to previously collected private content where additional notice or consent is required. Privacy questions and requests may be sent to The Disciple, operating Oriental Orthodox Connect, at mark@orientalorthodoxconnect.com.