Privacy Policy

Introduction

This Privacy Policy explains how Purposeful Living Church ("the Church", "we", "us") collects, uses, shares and protects information when you use the PLC Media App ("the App"), the official mobile app of Purposeful Living Church. The App is built and maintained for the Church by Appointed Systems Group ("ASG"), Kampala, Uganda, which acts as the Church's service provider. By using the App, you agree to the practices described here. If you do not agree, please do not use the App.

Google User Data at a Glance

Signing in with Google is optional. If you choose to sign in, this is everything the App does with your Google user data:

What we receive: your name and email address, plus the profile-photo link and account identifier that Google includes with sign-in; and, because you grant it on Google's consent screen, access to your YouTube account through the https://www.googleapis.com/auth/youtube.force-ssl permission.
Why: to sign you in, to show your name in the App, and — only when you tap the button — to like or unlike a video, post a comment, or subscribe or unsubscribe to the Church's YouTube channel from your own YouTube account.
Who receives it: only Google (to carry out the action you asked for) and Supabase (our hosting provider, acting on our behalf). Full details are in Sharing, Transfer & Disclosure of Google User Data below.
What we never do: we do not sell Google user data, use it for advertising, or transfer it to data brokers, advertisers or analytics companies.
Your control: you can revoke access at any time and request deletion — see Retention & Deletion and Your Rights & Choices.

Information We Collect

We collect only what is needed to make the App work:

Google Account information (only if you sign in with Google). Your name and email address, and the profile-photo link and unique account identifier that Google supplies to our authentication system. The App uses your name and email to sign you in and display who you are signed in as. The App does not display or otherwise use your profile photo; it is held only as part of the account record created by our authentication provider. If you sign in with Google, your Google name is pre-filled as your display name; you can change it at any time in Profile.
YouTube account data (only if you sign in with Google and use the YouTube buttons). To perform the actions you request, the App reads and writes the following on your own YouTube account: the name of your YouTube channel, whether you have liked a given video, a video's public statistics, public comments on the Church's videos, whether you are subscribed to the Church's channel, and the like, comment, subscribe and unsubscribe actions themselves. This information is displayed to you while you are on the video screen. We do not copy it into our database.
Google authorization token. To keep your YouTube actions working without asking you to sign in every time, we store the long-lived Google refresh token issued to the App. It is encrypted before it is saved and is used only by our server-side function to obtain short-lived access when you request a YouTube action. See Data Storage & Security.
User-submitted content. Prayer requests, testimonies, comments, likes and follows you choose to submit inside the App. Prayer requests and testimonies can be sent anonymously and you choose whether they are shared publicly.
Device information. A randomly generated app-install identifier and a push-notification token, used only to deliver notifications to your device and to attach likes and anonymous submissions to your installation. These are not linked to your Google account.
Diagnostic data. Basic error messages that the App prints on your device to help us fix faults. The App does not include an advertising or third-party analytics service.

We do not collect payment card numbers, bank credentials or mobile money PINs through the App — see Giving & Donations.

How We Use Information

We use the information above only to provide and protect the App's features:

Google name and email: to create and sign in to your account, to show "Signed in as" in Profile, and to attribute comments and follows to you.
YouTube permission and data: solely to like or unlike a video, read your like status, read and post comments, and subscribe or unsubscribe to the Church's channel, each at your request. We do not use it for any other purpose.
Google authorization token: solely so our server can act on your YouTube requests; never to read your account in the background, and never to contact you.
Other information: to operate streaming, playback, saved content, comments and follows; to send notifications you have enabled; to review and respond to prayer requests and testimonies; and to maintain the security, stability and performance of the App.

We do not sell your personal information, and we do not use it for third-party advertising.

We share, transfer or disclose Google user data only with the recipients listed below, only for the purpose stated, and only to the extent needed to provide a feature you asked for. We do not sell Google user data, and we do not share it with advertisers, advertising networks, data brokers or analytics providers.

Recipient	Google user data they receive	Why
Google LLC (Google Sign-In and YouTube API Services)	Your sign-in authorization, and the YouTube requests you trigger: your like or unlike of a video, the text of a comment you write, and your subscribe or unsubscribe.	To carry out, on your own YouTube account, the action you asked for. Google handles this data under the Google Privacy Policy.
Supabase, Inc. (our backend hosting provider: database, authentication and server functions)	Your Google name, email address, profile-photo link and account identifier; your display name, comments and follows linked to your account; and your Google refresh token in encrypted form.	To store and process the data on our behalf so the App can sign you in and function. Supabase may process it only to provide its hosting service to us, not for its own purposes.
Church administrators and ASG (the App's developer, acting as the Church's service provider)	Your name, email address and the comments you post in the App. They cannot see your Google password, and your encrypted refresh token is not read by people — it is decrypted only by the automated server function described below.	To moderate community content, provide support, and keep the App secure. Access is limited to authorised personnel.
Other App users and the public	Only your display name and the text of a comment you choose to post. A comment you post to YouTube is public on YouTube.	Because you chose to post it. We do not publish your email address.
Authorities, only where legally required	Only the specific information legally demanded.	To comply with applicable law or a valid legal process, or to protect the rights, safety or security of users, the Church or the public.

Not shared with push-notification services. Expo's push service and Google's Firebase Cloud Messaging receive only your device's push token and notification content so that notifications can be delivered. They do not receive your Google name, email address, YouTube data or Google refresh token.

No other transfers. We do not transfer Google user data to any other party. If the App were ever transferred to a different operator, we would not move Google user data to it without first obtaining your consent.

Google API Services — Limited Use

Purposeful Living Church's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide and improve the user-facing features described in this policy.
We do not transfer Google user data to others except as listed in Sharing, Transfer & Disclosure of Google User Data, as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your consent.
We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.
We do not allow humans to read Google user data unless we have your affirmative agreement for specific data, it is necessary for security purposes (for example, investigating abuse), it is necessary to comply with applicable law, or it is aggregated and anonymised for internal operations.

YouTube API Services

The App uses YouTube API Services. By using the YouTube features in the App (like, comment, subscribe), you agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy.

The App requests the https://www.googleapis.com/auth/youtube.force-ssl permission, which lets it manage your YouTube account on your behalf. It is requested because YouTube's API requires it for rating videos, posting comments and managing subscriptions. The App uses it only for the actions you tap; it does not browse your videos, playlists, watch history, private data or subscriptions to other channels.

You can revoke the App's access to your Google data at any time at https://security.google.com/settings/security/permissions. When Google reports that access has been revoked, we delete the stored authorization on our servers the next time the App tries to use it, and YouTube features will ask you to sign in again.

Push Notifications

The App can send push notifications for things like live broadcast alerts and playback controls. You can disable notifications at any time from your device's system settings. Disabling notifications does not affect your ability to use the rest of the App.

Data Storage & Security

App data is stored using Supabase, with access controls (Row Level Security) restricting who can read or write which records. Data in transit between the App, our servers and Google is encrypted using HTTPS.

Your Google refresh token is encrypted with AES-256-GCM before it is saved. The encryption key is held only as a protected server secret, is never included in the App, and the App itself has no permission to read the stored token. The token is decrypted only inside our server function, only to obtain a short-lived Google access token for an action you requested. Short-lived access tokens are not stored in our database.

While we take reasonable measures to protect your information, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

Other Third-Party Services

Besides Google and Supabase (described above), the App relies on:

YouTube, to play Live TV and video content in an embedded player. Like any embedded video, YouTube may receive standard technical information such as your IP address and device details when a video loads. This is governed by Google's privacy policy.
Expo (push-notification delivery and app updates) and Google Firebase Cloud Messaging (Android notification delivery). They receive your push token and device information, never your Google account data.
Our radio streaming provider, which delivers the live Purpose FM broadcast and receives your IP address when you listen.

Each of these services has its own privacy practices, and we encourage you to review them.

Giving & Donations

The Give section of the App displays bank account and mobile money details so you can send a gift directly through your own banking or mobile money app. The App itself does not process payments, and does not collect or store your card details, bank login credentials, or mobile money PIN. Any transaction you make is between you and your bank or mobile money provider, governed by their own terms and privacy practices.

Children's Privacy

The App is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will take steps to remove it.

Retention & Deletion

How long we keep Google user data. We keep your Google name, email address and account record for as long as your account exists. We keep your encrypted Google refresh token only while it is needed for YouTube actions: it is deleted (and revoked with Google) when you delete your account, and it is deleted when Google reports that you have revoked access.

How to delete your account and Google user data. You can:

On the web: follow the steps on our Delete Your Account page.
By email: write to info@purposefullivingchurch.com from the email address of the account.

We action verified web and email requests within 30 days. Deleting your account removes your account record, display name, comments and follows linked to your account and your stored Google authorization, and we revoke the authorization with Google. Copies held in routine backups are overwritten in the normal backup cycle. Content you posted on YouTube itself (such as a YouTube comment) belongs to your YouTube account and is managed through YouTube. We may keep limited information where the law requires it.

Your Rights & Choices

Depending on your location, you may have the right to:

Request access to the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your information (see Retention & Deletion).
Withdraw consent to notifications or data processing at any time.
Revoke the App's access to your Google account at any time at security.google.com/settings/security/permissions.

To exercise any of these rights, reach out using the contact details below.

We will never ask for your bank PIN, mobile money PIN, Google password or full card number inside the App or by email. If you ever receive such a request claiming to be from us, please do not respond and contact us directly.

International Processing

Our hosting provider may store and process data on servers outside Uganda, and Google processes YouTube requests on its own global infrastructure. By using the App you understand that your information may be processed in other countries. Wherever it is processed, the protections in this policy continue to apply to Google user data.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the App or our practices. We will update the "Last updated" date above whenever changes are made, and we will notify you in the App of any material change to how Google user data is used or shared before the change takes effect.

Contact Us

If you have questions about this Privacy Policy or how your information is handled, contact us: