This policy covers the Church OS mobile app. Our company privacy policy covers Akarmis as a whole; where the two differ on this app, this page governs.
Church OS holds pastoral records, welfare cases, and concerns raised about young people. Those are among the most sensitive things a church keeps about anyone, and the app is built so that fewer people can see them, not more.
Your church is the owner and controller of its records. Akarmis is a processor: we store and move that data on the church's instructions, and we do not decide what is done with it. If you want a record corrected or removed, your church decides, and we act on its instruction.
We do not sell your data. We do not share it with advertisers, we do not use it for marketing, and we do not use it to train artificial-intelligence systems. There is no advertising in the app, no third-party analytics, and no tracking SDK of any kind. The app has exactly two third-party components, one to hold your sign-in token in the phone's secure storage and one to offer Face ID. Neither sends anything anywhere.
Belonging to a church is itself information about your religious beliefs, and welfare and safeguarding records can say something about your health or your circumstances. Under UK data protection law that is special category data and carries a higher duty. Your church holds it on the basis it has established with its members as a religious body; we hold it only to provide the service to your church.
No location, at any time. No contacts, no photo library, no microphone, no calendar. The app asks for none of those permissions, so it could not read them if it wanted to. It also holds no payment details: Church OS does not take money.
This is the part most worth reading, because it is the part the app is actually built around.
Ministries cannot see one another. Each ministry's records are fenced off in the database, and the fence is enforced by the server rather than by the app being polite about it. Planning & Events can learn that the Youth Ministry has a programme on the 12th and that it needs the hall; it cannot learn who is in the Youth Ministry, who attended, or what was said about anyone.
Concerns about young people are narrower still. The youth roster is mostly minors. A pastoral, welfare, conduct or safeguarding concern raised about a young person is readable by the Youth President and the Youth Organizer, and by nobody else on the youth team. A group leader is told what to do about a young person in their care; they are not told why unless the President judges they need to know. Serious concerns go to the Pastor rather than being settled inside the department.
Welfare cases are visible to the welfare team and the Pastor, not to the wider church.
Your church's leadership can see the records their role allows. Akarmis staff do not read your church's data in the ordinary course of running the service, and access it only when your church asks us to investigate a problem.
| Permission | What it is used for |
|---|---|
| Face ID | Optional. It lets you return to the app without retyping your password. Your face never leaves your phone and is never sent to us: iOS tells the app only whether the person matched, and the app then releases a secret it keeps in the phone's Keychain. Declining Face ID blocks nothing; the password always works. |
| Network | Talking to your church's server over HTTPS. That is the only place the app connects to. |
Your sign-in token, the name of your church, your display name, and a small cache of your ministry's headline figures so the app can open something rather than nothing when the signal is poor. If you turn on Face ID, a random secret is also kept, in the part of the Keychain that requires the phone to be unlocked with its own passcode.
Signing out erases all of it. So does deleting the app.
The server runs in London. The database is hosted in Frankfurt, Germany. Both are inside the United Kingdom and European Economic Area respectively, and traffic between your phone and the server is encrypted in transit. Passwords are never stored: the server keeps a slow one-way hash from which the password cannot be recovered.
Only the two providers needed to run the service: our application host and our database host. Neither is permitted to use your church's data for anything else. Nothing is sent anywhere else, and there is no analytics or advertising network involved at any point.
You can sign out at any time from inside the app, which ends the session on that phone and erases what it had stored.
Removing your account is a request to your church, because your church owns the records. Here is what it does and does not do, stated plainly:
Records are kept for as long as your church requires them. Sessions expire on their own: after thirty minutes of inactivity, and in every case twelve hours after signing in. When a church stops using Church OS it may take its data with it and may require us to delete what we hold.
The app is used by church workers, not by children. Records about young people are held in it, and section 4 sets out the deliberately narrow rules on who can read a concern raised about one. Any safeguarding matter is escalated to the Pastor rather than resolved inside a department, and the app is built to make that the path of least resistance.
You may ask what personal data is held about you, ask for it to be corrected, ask for it to be deleted, or object to how it is used. Start with your church, which controls the records and can act immediately. If you would rather come to us, write to us and we will respond within a working week, and we will act on your church's instruction.
Questions about this policy, or about your data: [email protected] · Akarmis Technologies Ltd.
For anything about a specific person's records, contact your church first — it owns them and can act faster than we can.
We update this page as the app changes; the date above always reflects the current version.