Skip to main content

SermonWeek

⏸️ Sign-ups are paused while we update our Privacy Policy and Terms.

← Back

DRAFT — for review, not yet in effect. This document has not been reviewed by a lawyer and may change before SermonWeek launches. Items marked proposed, pending owner confirmation are defaults we intend to adopt. Items in [brackets] are still open.

Privacy Policy

Last updated: October 28, 2026 (draft v2.1). Applies to sermonweek.org and the SermonWeek church pages and phone app.

"We" means SermonWeek, operated by [DECISION NEEDED: legal entity — Stacey Tam (individual) or SermonWeek LLC], [DECISION NEEDED: mailing address — PO box or USPS-registered private mailbox]. "Your church" means the church whose SermonWeek page you use. SermonWeek helps a church turn Sunday's sermon into a week of discipleship material. This page explains what we collect, why, who helps us, how long we keep it and your choices.

The short version

What we collect and why

Pastors and church staff

Name, email, church name, time zone and the role your church gives you (admin, pastor, staff, care team). Sermon audio, transcripts, drafts and anything you write or approve. Billing status from Stripe. We use this to run the service, sign you in with emailed links, and send service emails (sign-in links, weekly drafts ready, billing notices to the church's pastors and admins).

Church members who join emails

Your email (and name if you give it), the church you joined, your email choices and whether you said you're 18 or older (worked out from a birth-year question; we don't keep the year). We use this to send your church's recap and devotional emails. Every email has a one-click unsubscribe link.

Followers and visitors

If you follow a church in the phone app we create a random follower ID so the app remembers you, and we save your time zone so messages arrive at the right time. You can also give a first name, and an email address if you want the weekly recap email; both are optional, and following works without them. If you give an email we send a confirmation link and, once you confirm, treat you as an email subscriber (see above). We don't keep your birth year. That's all we collect to follow: a random ID, your time zone, and a first name or email only if you choose to give them. If you turn on notifications your browser gives us a push address, which we use only to send that church's daily message (Monday to Saturday). Turn notifications off any time in your browser or the app; we delete the push address when you do, or when the push service tells us it no longer works.

Questions and requests you send

Ask the Sermon questions (adults 18+) and the answers, and prayer requests (adults 18+, see Prayer requests). If someone under 18 tries Ask the Sermon, we don't keep the question.

Everyone

Basic technical data every website handles: IP address, browser type and the pages you open, used for security, rate limits and fixing problems. Cloudflare Turnstile checks for bots on our forms and sees your IP address and browser signals; see Cloudflare's privacy policy. Email delivery records (who, when, which email) help us prevent duplicates and handle bounces.

Demo and "send to deacons"

Anyone can try a demo built from a church's public podcast feed. Demo data, and the addresses of people a demo is shared with, are deleted after 7 days, except that if a recipient opts out we keep a scrambled (hashed) copy of their address on a do-not-email list.

Connected AI tools

A church admin can connect an outside AI assistant (through our MCP connector) to the church's SermonWeek data. When they do, that tool's provider receives the data the admin asks it to read, under that provider's terms. SermonWeek never connects tools on its own.

Read-aloud uses your device's built-in voice; the text isn't sent to us or anyone else to be spoken. If we ever add server-made audio, we'll update this policy and the provider list first.

Do Not Track. We don't track you across other sites, so we treat every visitor the same whether or not your browser sends a Do Not Track signal. We have no advertising or cross-site tracking cookies.

Cookies

We only use cookies the service needs. Kids, teen and family pages, embeddable widgets and the connector endpoints set no cookies at all.

Sermon recordings

Churches can upload sermon audio or record in the browser. Audio is used only to make a transcript and drafts. Recordings are stored with Backblaze B2 (US East) while they're processed (they pass through Cloudflare on the way, and may be held there temporarily if Backblaze is unavailable) and are deleted 3 days after the sermon is transcribed and drafted, from every place we keep them. If processing fails, the pastor can delete the recording right away, and we delete it within 14 days. Transcripts and drafts stay until the church deletes them or closes its account. We don't play the original recording to members.

AI

We send sermon audio, transcripts and Ask the Sermon questions to xAI (X.AI LLC / SpaceX Super Intelligence LLC) to transcribe and draft. xAI doesn't use API data to train its models, and we don't use your information to train AI models. We have requested zero data retention for our xAI account; until xAI confirms it in writing, xAI may keep this data for up to 30 days for abuse monitoring, then delete it. xAI may process data outside the United States.

Drafts are based only on what the preacher said and the Scripture cited. Our instructions tell the AI not to quote, name or describe anyone else in the room, and to leave out prayer requests, health or personal details, announcements and song or hymn lyrics. A pastor reviews and approves every draft before anyone sees it. The Friday care report is assembled without AI.

Prayer requests

Prayer requests are for adults 18 and older, and you tick a box agreeing that your church's care team may receive and keep your request, which may include religious or health information. You can send one anonymously. Requests go only to your church's care team: its SermonWeek administrators and anyone they add, usually pastors. Every time someone opens the care page it's logged, and the church's admins can see that log. We delete prayer requests and our copy of the weekly care email after 90 days. Copies already delivered to care-team inboxes are kept or deleted by your church. SermonWeek staff don't read them except to fix a problem you or your church report, to keep the service secure, or when the law requires. Please don't include other people's private details without their OK. To withdraw consent or delete a request sooner, ask your church or email [DECISION NEEDED: privacy contact email, e.g. privacy@sermonweek.org].

Please know: pastors and church leaders may be required by law to report suspected abuse or neglect of a child or vulnerable adult, and may share information to keep someone safe. If someone is in danger, call 911. To report child abuse in Mississippi, call 1-800-222-8000. In a crisis, call or text 988.

Ages and children

SermonWeek's kids, teen and family pages are made for parents and leaders to use with children. These pages have no sign-up, forms, notifications or cookies, and we don't collect personal information from them beyond the technical security data every page uses. To follow a church in the app, turn on notifications or join emails, you must be 13 or older; Ask the Sermon and prayer requests are for adults 18+. We ask your birth year before these steps and don't store it. If you believe a child under 13 has given us information, email [DECISION NEEDED: privacy contact email, e.g. privacy@sermonweek.org] and we'll delete it.

Service providers (subprocessors)

These companies process data for us only to run SermonWeek:

We'll post changes to this list here, and email church admins 30 days before adding a new provider that handles church data.

Disclosures required by law

We may disclose information when the law requires it (for example, a valid court order or subpoena), or when we believe in good faith it's needed to protect someone from serious harm. Your church and its leaders have their own legal duties, including reporting suspected child abuse, that SermonWeek doesn't control. If we sell or reorganize the business, this policy goes with the data.

How long we keep it

Your rights and choices

Wherever you live, you can ask to see, correct, download or delete your information, or withdraw consent for prayer requests, by emailing [DECISION NEEDED: privacy contact email, e.g. privacy@sermonweek.org]. We answer within 30 days and won't treat you differently for asking. If we deny a request, you can appeal by replying to our answer. Connecticut residents may contact the Connecticut Attorney General if they disagree with our response. Members can also unsubscribe with one click and ask their church to remove them. Because churches control their members' data, we may pass your request to your church.

Security and breaches

We use encrypted connections, signed links, per-church data separation, rate limits and the least access needed. No system is perfectly secure. If a security breach affects your information, we'll investigate quickly and notify you and your church as the law requires, and tell affected churches within 72 hours of confirming a breach of their data.

Changes

We'll date every version and keep a short list of what changed. For material changes we'll email church admins 30 days before they take effect.

Contact

Questions: [DECISION NEEDED: privacy contact email, e.g. privacy@sermonweek.org] · SermonWeek, operated by [DECISION NEEDED: legal entity — Stacey Tam (individual) or SermonWeek LLC], [DECISION NEEDED: mailing address — PO box or USPS-registered private mailbox]

Also see the Church Agreement and the Member & Visitor Terms.