Privacy Policy

Alpine Bible Church (“we,” “us,” “our”) is a church in Lehi, Utah. This policy explains what personal information we collect through our website at www.alpinebible.com, our iOS and Android apps, and the church’s records that sit behind them; who sees it; who we share it with; how long we keep it; and what you can ask us to do with it. We do not sell personal information, and we do not use it for advertising.

Forms on the website and in the app

When you send a contact, ministry, prayer, food pantry, story, survey, or “get involved” form, we keep what you typed (for example your name, email address, phone number, how you would like us to reply, and your message). With each submission we also keep the IP address it came from and your browser’s description of itself (the “user agent”), to deal with abuse and spam.

Each form is emailed to the staff member or ministry volunteer responsible for it, sometimes with a copy to the church office. Some of those volunteers use their personal email accounts. In the admin, form submissions are visible to church staff who handle them.

To stop automated spam, forms use Cloudflare Turnstile, which checks your browser without asking you to solve a puzzle in most cases.

Prayer requests

A prayer request sent from the website’s prayer form is private: it is never shown in the app or on the website. Its notification email goes to the person who coordinates prayer. In the admin, website prayer requests (and the contact details given with them) are visible only to the church’s senior administrators, not to every staff member who edits the website.

If you tick “Keep confidential (staff will pray)”, the email we send says only that a confidential prayer request arrived and when. It does not include your name, your contact details, or your request; those can be read only by signing in to the church’s admin.

The app’s prayer wall is different: what you post there (the display name you choose, a title, and your request or reply) is public to other app users. Depending on how the church has set up the wall, a post appears either after our staff approve it or as soon as you post it, and staff can remove it afterward. Please do not post anything there you would not want others to read. The app lets you report a post and block another user.

Giving

Gifts are made on our website and in our app through Stripe, our payment processor. Your card or bank details are entered into Stripe’s secure fields and go directly to Stripe; they never pass through or are stored on our servers. We keep your name, email address, the gifts you made (amount, date, fund or campaign), any recurring gift, and the identifiers Stripe gives us.

We also keep your mailing address, so we can send your year-end giving statement. It comes from one of three places: the billing address your Apple Pay or Google Pay wallet shares when you give, the address you type when we ask for it, or the address the church’s accounting records already hold. We keep it with your donor record.

To keep the church’s books, we send each gift to Aplos, our accounting system: your name, email address, the amount, the fund, and the processing fee. Aplos does not accept an address from our system, so the treasurer enters your address in Aplos by hand.

We email your receipt ourselves. The donor portal lets you sign in with a link sent to your email address and see your gifts; change the amount or schedule of a recurring gift, pause, resume, or cancel it, or update the card it uses; update your mailing address; and remove saved cards. Recurring gifts are Stripe subscriptions.

Gift amounts, donor records, and mailing addresses are visible only to the staff who handle finances (the treasurer and the giving and accounting administrators), not to other staff. When we are sure a donor is a person in the church’s congregation records, we link the two records, so a senior administrator viewing that person may see that they give.

Event registrations and sign-up sheets

When you register for an event we keep the payer’s name and email, the name of each person attending, and your answers to the event’s questions. Parents often register children, and an event may ask about a child’s allergies, medical needs, or dietary needs; those answers are kept with the registration. The confirmation email we send you says that those medical, allergy, or dietary answers were received but does not repeat them, since a sent email stays in mailboxes and our email provider’s records after we remove the answers from our own. If the event costs money, payment goes through Stripe as described above. Registrations are visible only to the staff and leaders assigned to run events, not to every staff member.

When you sign up on a sign-up sheet (for example to bring a meal or serve on a team), we keep your name, email address, phone number, and any note, and show them to the people who run that sheet.

The church’s congregation records

Like most churches, we keep a record of the people and families who are part of the church. Today those records are kept in Elvanto, our church management system. Once we switch the connection on, they are copied into our own system each night. They can include contact details and addresses, birthdates, household relationships, school grade, allergies, the groups and categories someone belongs to, and notes about bereavement or a death in the family. These records are never public. In our system they are visible only to the church’s senior administrators; the most sensitive details (birthdates, allergies, and bereavement notes) appear only on one person’s own record, never in lists or exports.

Email

We send email through Resend: replies to your forms, receipts, registration and sign-up confirmations and reminders, and messages you asked for. We keep a record of whether each email was delivered, bounced, or marked as spam, and we stop emailing an address that bounces or reports spam. You can ask us to stop emailing you at any time.

Text messages

Alpine Bible Church sends text messages through Twilio, only to people who agreed to get them, and only to the mobile number they agreed for. Each kind of text has its own yes:

• Check-in texts: your children’s pickup pass, instead of a printed checkout label, and a page from your child’s classroom when they need you. We send these only when your children are checked in. You can say yes on the check-in screen, on the welcome card, in My ABC, or by telling a staff member.
• Serving reminders, if you serve on a team and turned them on.
• Other church texts from staff, if you told us you want them.

We also send a single text you ask for, such as a sign-in code or a pickup pass you request at the station, and we answer a text you send us.

Msg & data rates may apply. Reply STOP to any text to stop all texts from us, START to start them again, and HELP for help. Changing your mobile number ends your yes for the old number.

We keep a record of each yes: the words you were shown, when you agreed, and the number you agreed for. We never sell or share your mobile number or your agreement to receive texts with anyone for their own marketing.

Our mobile apps

The apps do not require an account and do not use advertising identifiers. On first launch the app creates a random installation identifier that is not linked to your name. We use it, and on iPhone Apple’s App Attest, to confirm requests come from a genuine copy of the app, to limit abuse, and to let you manage your own posts. If you allow notifications, we keep the push token Apple gives us, your device model, operating system version, and app version, so we can send notifications through Apple’s push service. When you mark a reading-plan day complete, we record the installation identifier, the plan, and the date.

Website statistics

We count page views ourselves; we do not use Google Analytics, advertising pixels, or other third-party trackers. For each page view we record the page, roughly where the visit came from (country, region, and city, as Cloudflare estimates from the network), the kind of device and browser, and how you arrived (for example from a search engine). To count visitors without identifying them, we store a one-way hash made from your IP address, your browser, and the date; because the date is part of it, the same visitor cannot be followed from one day to the next. We do not store your IP address with page views, and we keep the individual page-view records for up to 90 days, after which only daily totals remain.

When someone asks for a page that does not exist, we record the address asked for, the page that linked to it, the country, the kind of device, and the browser’s description of itself, so we can fix broken links. We keep these records for up to 60 days.

We may also use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

For podcast and sermon downloads we record the episode, the kind of app that downloaded it, the country, and a one-way hash of the IP address (never the address itself), so we can count listeners without counting the same download twice.

Cookies and storage on your device

We use only cookies that the site needs to work. We use no advertising or cross-site tracking cookies.

• Staff sign-in: a session cookie that keeps staff and volunteers signed in to the admin, and a “known device” cookie, kept for up to 180 days, that remembers a device a staff member has signed in from before.
• Donor portal: a cookie that keeps you signed in to the donor portal for up to 30 days.
• Sign-up sheets: cookies that remember you opened a sheet with its access code, or the link to manage your sign-up.
• Stripe: on pages where you give or pay, Stripe sets its own cookies (such as __stripe_mid and __stripe_sid) to prevent fraud.
• Cloudflare: Cloudflare, which protects the site, may set cookies (such as __cf_bm and cf_clearance) to tell people from automated traffic, including when a form checks you with Turnstile.

Your browser’s local storage remembers preferences on your own device, such as light or dark theme, where you stopped in a sermon, the name and contact details you typed on a sign-up sheet so you need not type them again, and, after you give to a campaign, the amount you gave from that device, so its progress bar can thank you. That information stays on your device.

Embedded videos and Scripture

Sermon and service videos are hosted on YouTube. We embed them in YouTube’s privacy-enhanced mode (youtube-nocookie.com), which does not set YouTube cookies until you play a video. Your browser still contacts YouTube to load the player and the video thumbnails, so YouTube receives your IP address and browser details as it would for any website; once you play a video, YouTube’s own privacy policy applies. Scripture passages come from the ESV API (Crossway); we request them from our server and keep a copy, so your browser does not contact Crossway.

Who we share information with

We share personal information only with the service providers that run parts of our ministry for us, only as much as each needs, or when the law requires it or to protect someone’s safety. Our providers are:

• Cloudflare — hosts the website, its database and files, and provides security and Turnstile spam protection.
• Stripe — processes gifts and event payments.
• Aplos — the church’s accounting system (donor name, email, gifts).
• Elvanto — the church’s congregation records.
• Resend — sends our email.
• Twilio — sends and receives our text messages.
• Sentry — reports errors in the website so we can fix them. Error reports are set up to leave out cookies, sign-in details, and what you typed into a form, and do not identify you.
• Sonix and Anthropic — transcribe sermon recordings and tidy the transcripts. They receive sermon audio and transcript text, not information about you.
• Google — YouTube video embeds (privacy-enhanced mode), and sign-in for staff who choose to sign in with a Google account (we receive their name, email address, and profile picture, and nothing else from their Google account).
• Crossway (ESV API) — Scripture text.
• Apple — app distribution, App Attest, and push notifications; Google — Android app distribution. The app stores’ own privacy policies also apply to your use of them.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep information

We keep information only as long as we need it. Today:

• Individual page-view records are kept for up to 90 days; daily totals are kept.
• Records of requests for missing pages are kept for up to 60 days.
• The anti-abuse fingerprints kept with registrations and sign-ups are removed after 30 days.
• The IP address and browser details kept with a form submission: removed after 30 days.
• A file sent with a form that was never submitted is removed after a day.
• Expired staff sign-in sessions: removed after 30 days.
• Answers to event registration questions we mark as allergy, medical, or dietary: removed 90 days after the event (or after the registration, for a page with no event date).
• The one-way hash of the IP address kept with a podcast or sermon download: removed after 90 days; the download counts are kept.
• Giving records: kept for at least 7 years, as tax and accounting rules require. Older records are reviewed by the church rather than removed automatically.
• Expired sign-in links: removed once they expire.
• The app’s installation record (the random installation identifier, device model, operating system and app version, and reading-plan days): kept while the app is in use, and removed on request. Its push token is removed as soon as Apple tells us it no longer works, for example after the app is deleted; turning notifications off stops them being sent.
• The access and security log described under “Security”: kept for now without a set time limit, because it cannot be changed or deleted from. We will set a limit and state it here.

We are putting the following into effect:

• Form submissions and prayer requests, and any files sent with them: kept for up to 2 years.
• Records of email delivery: kept for 1 year, except the record that stopped our email to an address that bounced or reported spam, which is kept while that block stands.
• Any other allergy, medical, or dietary answer given for an event registration: removed on the same schedule as those above.

Children

Our website and apps are for a general audience and are not directed to children under 13, and we do not knowingly collect personal information from a child online. Parents and guardians do give us information about their children, for example when registering a child for an event or through the church’s congregation records. A parent or guardian can ask to see, correct, or delete that information as described below.

Your requests

You may ask what personal information we hold about you, ask us to correct it, or ask us to delete it. Email office@alpinebible.com or call (801) 341-8789. To protect you, we will confirm your identity before we share or change anything, usually by writing to the email address we already have for you. We will answer within 30 days.

Some information we must keep even if you ask us to delete it: records of gifts are kept for as long as tax and accounting rules require, and the access and security log described below cannot be deleted from. We will cancel a recurring gift at once, and tell you what we kept and why. You can stop our emails at any time. Information we delete from our live systems can remain in our backups until they expire, within about 12 months; we do not restore it from them except to recover from a failure.

Security and data breaches

To protect the records we keep, we also keep an access and security log: which staff member or system changed a record of a person, a donor, a gift, or someone’s access, and when; refused sign-in and access attempts; and, for security events, the internet address and browser description they came from. It records that a name, address, phone number, or note changed, not what it says, and it never holds the text of a prayer request or a form. When a donor uses the donor portal (signing in, changing a recurring gift, a payment method or their mailing address), the log records the email address they signed in with and what kind of change it was, not the new details. The log cannot be edited or deleted from, so that it can be trusted after an incident; only senior administrators can read it.

We protect information with access limited by role, encrypted connections, and providers that meet industry security standards; card details are handled only by Stripe. No system is perfectly secure. If a breach of security exposes your personal information, we will notify you as Utah law requires, and otherwise where we judge that notice would help you protect yourself.

Links to other websites

Our site links to other websites, such as social media. Their own privacy practices apply there.

Changes to this policy

When we change this policy we will update the effective date above, and for a significant change we will say so on this page.

Contact us

Questions about this policy or your information: office@alpinebible.com, (801) 341-8789, or by mail at Alpine Bible Church, 310 E State St, Lehi, UT 84043.