Privacy policy

Who we are

Sermon Archive (sermonarchive.org) runs this service. It keeps a church’s sermons, makes them searchable, and lets members take notes and talk about them.

Each church decides which sermons are in its archive and who may join it. For how your church uses its own records, such as its membership list, ask your church.

What we collect

We collect only what the service needs to work:

• Your account. Your name, your email address, the churches and groups you belong to and your role in them, and your settings, such as your language and Bible. If you set a password, we store only a scrambled form of it (an Argon2 hash), never the password itself.
• Planning Center sign-in. If you sign in with Planning Center, we receive your name, email address, and church from Planning Center, and keep an encrypted token that lets us confirm each day that you can still sign in.
• Sign-in sessions. For each device you sign in on, we keep when you signed in, how, and the kind of device, such as “Safari on iOS”, not your browser’s full details. If you turn on Face ID or Touch ID in the app, the check happens on your phone: we never receive your face or fingerprint.
• What you write and save. Notes, photographs of handwritten notes, highlights, reactions, Bible bookmarks, bulletins you add, discussion replies, reports of replies, research questions and their answers, and where you stopped listening or reading.
• Recordings you make. If you upload a recording (audio or video) or record a service live with your microphone, we keep the recording and its transcript. The microphone is used only while you are recording.
• Notifications. If you allow notifications, the address Apple or your browser gives us for sending them to your device.
• Network addresses. To slow down people guessing passwords or sending too many sign-in emails, we keep a keyed, one-way digest of your network (IP) address, not the address itself. Our web server’s access log records your network (the address with its last part removed), the page asked for, and the user agent; see “How long we keep it”.
• A record of administrative actions. When someone changes an account, a membership, or a church’s settings, we record who did it, what changed, and when. Any email address, name, or device details in them are removed after 90 days.
• Your usage of AI features. How much each AI feature cost, by church and by person, so a church can stay within its budget.
• Playback problems. If a recording fails to open in the app, we record the kind of player, the system’s error code, whether the app had already tried again, and whether you were on Wi-Fi or cellular. It is not connected to your account, and is deleted after 30 days.

We do not use analytics, advertising, or crash-reporting services, and we set no third-party cookies. The website sets one cookie to keep you signed in and one to remember your language.

How we use it

We use this information to sign you in, show you your church’s sermons, keep what you write, show it to the people you share it with, send you the emails and notifications you ask for, run the AI features described below, keep the service secure, and fix problems. We do not use it for anything else.

Who can see what you write

When you write a note, you choose who can read it:

• Only me. A private note is shown to nobody else in the app, including your church’s staff.
• A group. Members of the groups you share it with can read it. Your church’s staff and owners can also read notes shared with any group in the church.
• Staff. Your church’s staff and owners can read it.
• Church. Every member of your church can read it.

Discussion replies are seen by the church or group they are posted in, and church owners can read replies they have taken down.

Church staff see Insights: totals of where people wrote notes, which tags they chose, and how they reacted to Bible passages, to help them understand how the congregation engages with sermons. These totals can count private notes, but they never show a note’s text or who wrote it, and any total from fewer than five people is hidden so nobody can be singled out. The text of a private note is never shown to staff.

The people who run Sermon Archive can reach the database to keep the service running. We look at the content of your account only to fix a problem you report, to deal with abuse, or when the law requires it.

Religious beliefs

Belonging to a church, the sermons you listen to, and what you write about them can reveal your religious beliefs. We treat all of it as sensitive information.

• Only the people described under “Who can see what you write” can see it, and a private note is shown to nobody else.
• We use it only to provide the service. We never sell it, use it for advertising, or share it beyond the providers listed under “Services we use”, which receive it only to do their part.
• It is protected by the measures under “Security”, and you can download or delete it as described under “Your choices”.

AI features

Sermon Archive uses AI models to transcribe sermons, outline them, translate them, search them, and answer questions about them. To do this, we send the following to the model providers listed under “Services we use”:

• Sermon audio, transcripts, and outlines.
• What you type into search, research questions, and Bible questions, and the earlier messages of the same research thread.
• Photographs of handwritten notes you add, to read them.
• Notes you import, to sort them into a sermon.
• If your church turns on morning follow-ups, the notes you wrote on a sermon, including private ones, so the model can suggest something to think about the next morning. Only you see the result.
• Audio of a service you record live, to transcribe it.

We do not send your name or email address. Anything you type yourself, such as a question or a note, is sent as you wrote it, so please leave out details you would not want shared.

We send text, pictures, and recorded audio to AI models through OpenRouter, a United States company. Every request requires providers that keep none of it and do not train on it (zero data retention).

• Claude, GPT, and Microsoft models run on Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Azure, in the United States or the European Union.
• DeepSeek’s model and other open-weight models, such as Z.ai’s GLM, run only on United States hosts (such as Together, Fireworks, DeepInfra, and Baseten), never on DeepSeek’s own service or on other hosts outside the United States.
• Web searches for quotations send only the search words to Exa, a United States search provider, under its own data policy.

Zero data retention does not cover two things:

• OpenRouter may keep a request that its child-safety scanning flags.
• During a live service, the microphone’s audio is sent straight to Muse, Meta’s transcription service in the United States, rather than through OpenRouter. Meta handles it under its own data terms. Muse receives that audio and nothing else about you.

Answers, outlines, and translations made by AI may be wrong. They always point back to the moment of the recording they came from, and they never replace the recording or its transcript.

Services we use

These companies receive data from us only to provide their part of the service:

• OVHcloud rents us the server that runs Sermon Archive and holds its database. It is in the United States.
• Cloudflare (United States) carries traffic to the website, so it sees your network address, and stores recordings, photographs, pictures, and our encrypted backups.
• Backblaze (United States) stores a second copy of those recordings, photographs, pictures, and encrypted backups, in case Cloudflare’s copy is lost.
• OpenRouter (United States), the companies that run the AI models, and Exa receive what is listed under “AI features”.
• Meta (United States) receives the audio of a live service through Muse, to transcribe it.
• Resend (United States) sends our email. It receives your email address and the email itself: sign-in codes and links, password notices, invitations, notices about recordings handed to you, and codes and notices for deleting your account.
• Apple delivers notifications to the iPhone app, and your browser’s maker (such as Apple, Google, or Mozilla) delivers them to the website. They receive the notification address and the notification’s text.
• Planning Center (United States), only if you sign in with it. We ask it only who you are; we send it nothing about what you do here.

We also fetch public material: sermons from YouTube, podcast feeds, and church websites; and pictures and facts about people, books, films, and music named in sermons from Wikipedia, Wikidata, Wikimedia Commons, Open Library, MusicBrainz, the Cover Art Archive, and The Movie Database. These requests carry no information about you. Some Bible audio is played straight from its publisher (openbible.com or audiotreasure.com), which then sees your network address.

What we do not do

• We do not sell or rent your data.
• We do not show ads.
• We do not track you across other apps or websites, and we do not share your data with data brokers.
• We do not let AI model providers keep or train on what we send them through OpenRouter.

How long we keep it

• Your account and what you write are kept while your account exists, and erased 7 days after you confirm deleting it (see “Your choices”).
• Sessions are deleted 30 days after you sign out or they expire.
• Sign-in codes and emailed links are deleted after 35 days, failed password attempts after 7 days, and Planning Center sign-in links a day after they expire.
• Invitations are deleted 30 days after they expire, or 90 days after they are accepted.
• Morning follow-ups are deleted 30 days after the morning they were for.
• Planning Center church checks. If we send you a link to connect your church’s Planning Center, the name, email address, and device it reports are deleted after 90 days.
• Records of administrative actions are kept so a church can see who changed what. After 90 days, any email address, name, or device details in them are removed.
• Our web server’s access log records your network, not your full IP address, and the page you asked for without anything after the “?”. It is overwritten as it fills, usually within a few weeks.
• Backups are encrypted and kept for up to 12 months, so deleted data can remain in a backup until it expires. If we ever restore one, accounts that were deleted are deleted again.

Your choices

• See and download your data. On your Settings page, Download my data gives you a file with your account, churches, groups, notes, photographed pages, replies, research threads, highlights, reactions, bookmarks, where you left off, follow-ups, and links to the recordings you made.
• Correct it. Edit or delete your notes and replies at any time, and change your settings on your Settings page. To correct your name or email address, email [email protected].
• Close your account. On your Settings page, choose Ask to close my account. A church admin closes it: you are signed out everywhere, and what you wrote is kept so the account can be reopened.
• Delete your account and data. In the app or on the website, choose Settings → Delete account. You confirm it’s you and type your email address, and every device you’re signed in on is signed out at once. We erase your account 7 days after you confirm, and you can sign in and cancel until then.
  • Erased: Your name, email address, and password; your notes, shared ones too; highlights, bookmarks, reactions, and where you left off; research, follow-ups, and photographed pages; recordings kept for Only me; and your church and group memberships.
  • Kept without your name: A shared note others replied to stays as “Deleted”, with its words gone, so their replies keep their place. Your replies in discussions stay, shown as from “Someone”, as do reports you made, what you did as staff, and recordings you made for your church or groups, which church staff keep.
  Copies in our backups expire within 12 months.
• Notifications and the microphone can be turned off at any time in your phone’s or browser’s settings.

Children

Sermon Archive is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has given us personal information, email [email protected] and we will delete it.

Security

All traffic is encrypted in transit. Passwords are stored only as hashes, Planning Center tokens are encrypted, and network addresses are stored only as keyed digests. Recordings and photographs are reached through links that expire within minutes. Backups are encrypted with a key kept off the server, and the server is reached only with security keys. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

Changes to this policy

When this policy changes, we will post the new version here and change the date at the top. If a change affects how we use what you have already given us, we will tell you in the app or by email before it takes effect.

Contact

For questions about this policy or your data, email [email protected]. For help with the app, see Support.