FiveSixteen ("the app", "we", "us") is a prayer-request sharing app for small groups. This policy explains what information we collect, how it's used, and — importantly — who else can see it. The short version: everything you post in a group is visible to that group's other members, the same way it would be if you shared it out loud in a room together. We never sell your information, and we never share it with advertisers or data brokers.
Account information: your name, email address, and password when you create an account. Your password is handled entirely by Firebase Authentication (see "Third-Party Services" below) — we never see or store it ourselves.
Group membership: which group(s) you belong to, and whether you're an admin of any of them.
Prayer requests and updates: the title, description, status, and any updates you or others post to a request, plus whether you marked it urgent, anonymous, or set it to auto-close on a date.
Your private prayer activity: how many times you've tapped "I prayed for this" on a request, and when you last viewed it. This is stored per-person and is never shown to anyone else — not even to the person who posted the request.
Your personal prayer list: if you use the optional "My Prayers" feature, the title, description, status, recurrence (e.g. daily, or specific days/dates), and any updates you add to your own private prayer items. See "Your Personal Prayer List" below for who can see this.
Notification preferences: your choices about when the app notifies you (new requests, urgent requests, answered prayers, broadcast messages, and your daily prayer reminder time).
Device push token: a token identifying your device, used only to deliver the push notifications you've asked for. If you sign out, we remove the token for that device.
Invitations: if you invite someone by email, we store that email address until they accept or the invitation is cancelled — even if they don't have an account yet.
This is the most important part of this policy: prayer requests, updates, and (except to non-admins on requests marked anonymous) requester names are visible to every member of that same group. There is no "private to just you" option for a request once it's posted to a group — that's the whole point of the app.
Marking a request "anonymous" hides your name from regular group members, but a group admin (and app-wide super users, see below) can still see who actually posted it, so there's always someone accountable behind an anonymous post.
People who are not members of a group cannot see that group's requests, updates, or membership list.
A group admin can see the full membership list of their own group(s) and manage requests within them. App-wide "super users" (the people who operate FiveSixteen) can access any group's data for moderation, support, and troubleshooting — the same way an email provider's staff technically can access accounts on their systems, even though they don't read your mail day-to-day.
The optional "My Prayers" feature is different from everything else in this app: it's a private list of things you personally want to pray for, on a schedule you set (daily, specific days of the week, a day of the month, or a specific date). It is never shared with a group, and — unlike the group visibility described above — it is not visible to group admins or to app-wide super users either. Only you can see it, full stop.
If you turn on "Include in Pray mode" in Account settings, items due that day are shown to you alongside your groups' requests during a prayer session — but this only changes what you see; it never shares those items with anyone else.
You can go a step further with "My Private Prayers" encryption (Account → My Private Prayers). When you turn this on, you set a separate Encrypt Password — different from your login password — that never leaves your device and that we never see, transmit, or store. Your private prayer items are encrypted on your device before they're ever saved, and stored in our database only in that encrypted form, so they are fully encrypted at rest — not even we can read them, because we never have the password or key needed to decrypt them. The flip side of that: because we don't have your Encrypt Password either, we can't recover it or decrypt your items for you if you forget it. In that case, the app's "Delete All Private Prayers" option is the only way to start fresh — the existing encrypted items themselves can't be recovered.
To operate the app: showing you your groups' requests, letting you post and respond to them, and sending the notifications you've chosen to receive.
To communicate with you: sending invitation emails on your behalf, and (rarely) messages from us about the app itself — e.g. a required update, or an important account notice.
To keep the app working properly and safely: things like removing a stale push-notification token, or a super user investigating a report of misuse.
We do not use your information for advertising, and the app contains no ad networks, analytics trackers, or third-party tracking SDKs of any kind.
We do not sell, rent, or trade your personal information or account details to anyone, for any purpose — not to advertisers, not to data brokers, not to anyone else. The only places your information goes are the ones described in this policy: visible to your own group(s) as described above, and the third-party service providers below who help us actually run the app.
Firebase / Google Cloud (Authentication, Firestore database, Cloud Functions, Cloud Messaging, and Hosting) — this is the infrastructure the entire app runs on: your account, your groups' data, and push notification delivery all live here. Google acts as our data processor for this. Our database is hosted in Google Cloud's africa-south1 (Johannesburg) region.
Resend — a transactional email service we use only to deliver group invitation emails on your behalf.
We don't use any other third-party services today. If that changes, we'll update this policy.
Your account and its data are kept for as long as your account exists. If you delete your own account (Account → Delete Account in the app) or a super user removes it, your profile and login are permanently deleted right away. Prayer requests and updates you posted stay visible in your group's history — each one already stores the name you posted it under directly, so it isn't affected by your account being gone. If a group itself is deleted, everything in it (requests, updates, invitations) is permanently deleted too. Your personal prayer list, being private to you, is permanently deleted along with your account.
You can update your display name and change your password anytime from Account settings in the app. You can turn any notification type on or off from Notification Settings. You can leave a group at any time, and you can delete your account entirely from Account → Delete Account — this is permanent and can't be undone.
FiveSixteen is not directed at children under 13, and we do not knowingly collect information from anyone under 13. If you believe a child under 13 has created an account, contact us (below) and we'll remove it.
Access to your group's data is enforced by server-side security rules — the app itself checks, on every request, that you're actually a member (or admin) of a group before showing you anything from it. Passwords are handled entirely by Firebase Authentication and are never visible to us in readable form. If you turn on "My Private Prayers" encryption (see "Your Personal Prayer List" above), those items are encrypted on your device with a password only you know before they ever reach our servers, so we hold only the encrypted result, never the password or the key derived from it. No method of storing or transmitting data is 100% secure, but we take reasonable, industry-standard steps to protect your information.
If we make a meaningful change to this policy, we'll update the "Last updated" date above and, for significant changes, let you know in the app.
Questions about this policy, or a request about your data (access, correction, or deletion beyond the in-app option above)? Reach us at speakup@stillabiding.com.