Privacy Policy

Rockhub is a discipleship tool built for The Rock Churches. It is used by church leaders to keep track of the people they are looking after and the people they hope to reach.

This policy covers two different groups. It covers members, who sign in and use the app. It also covers contacts, who are people a member has saved and who may never use Rockhub at all. Both are described below, because the second group did not choose to be here and that deserves saying out loud.

About a member: your name, username, phone number, email address, photo if you add one, your birthday if you add one, and who your leader is.

About a contact you save: their name, phone number, WhatsApp number, email address, address and city, birthday, photo, how you met them, and anything you write about them.

About your work: your follow-up reminders, which lists someone is on, and a record of when you reached out to somebody and what came of it.

Your password is never stored. What is stored is a one-way scramble of it that cannot be turned back into your password, not by us and not by anybody who obtained the file.

Connecting Google Contacts is optional. Rockhub works without it, and you can disconnect at any time.

If you connect it, Rockhub asks Google for the same things it already keeps about a contact you add by hand: names, phone numbers, email addresses, birthdays, addresses, photos, notes and links.

It asks for those because it uses them. Your birthday reminders and your contact map are built from exactly these fields, so a contact who arrived from Google works the same as one you typed in yourself. Rockhub does not ask Google for anything it has nowhere to put.

What comes back is shown to you first. Nothing is saved until you have seen the list of people coming in and chosen to bring them in. People you already have arrive unticked, so a second sync does not fill your contacts with duplicates.

Limited use. Rockhub’s use of information received from Google is limited to showing you your own contacts inside Rockhub. It is never sold, never used for advertising, never used to build a profile of anybody, and never given to anybody else except where the law requires it. Disconnecting Google removes Rockhub’s access. Contacts you already chose to bring in stay in your account until you delete them, because by then they are your contacts rather than Google’s.

Rockhub holds the names, numbers and addresses of people in your church, and in many countries that is information the law treats as sensitive. It is guarded accordingly.

• It is encrypted on the way. Every connection between your phone or browser and Rockhub, and between Rockhub and its database, is encrypted. Nothing about a member travels in the clear.
• It is encrypted where it sits. The database and its backups are encrypted on disk.
• The database itself decides who sees what. Permission is not a rule the app remembers to apply. Every request carries the identity of the person making it, and the database refuses to hand over rows that person is not allowed to see. A mistake in a screen cannot show you somebody else’s contacts, because the rows never arrive.
• Your Google connection is out of reach. The key Google gives Rockhub when you connect your contacts is kept where no signed-in account has any permission on it at all, including yours. Only Rockhub’s own server can use it, and only to fetch your own contacts for you. When you disconnect, Rockhub asks Google to cancel the key and then deletes it.
• Your password is never stored, in any form that can be turned back into your password. What Rockhub Stores, above, says how.
• On a phone, your sign-in is held in the device’s own secure storage rather than an ordinary file. That is the Keychain on iPhone and encrypted storage on Android.
• You can add a second step to signing in, so a stolen password is not enough on its own. It is in your account settings.
• Very few people can reach the church’s data directly, and every administrative action is recorded with the name of the person who took it.

How long it is kept. Your information stays for as long as you have an account. When you delete your account it goes with it, and Removing Things below says exactly what happens and how fast.

Rockhub is used by one church rather than sold to the public, and none of the information in it is ever sold, rented, or used for advertising, by us or by anybody else.

Rockhub exists so leaders can help the people below them, so a leader can see the people their disciples are looking after, and so on down the line. That is the point of the app rather than a compromise in it.

Two things are never visible to your leader:

• All Contacts. The full list of everybody you have saved, including anything a phone sync brought in.
• Deleted. Where a contact goes when you remove them.

Between them, those two mean a contact can enter your account and leave it again without your leader ever seeing that it existed.

Private notes are yours alone. Nobody else can read them, at any level of the church.

Lists are not private. Any list you build can be seen by your leader, including its name. Rockhub tells you this at the moment you create one, and it matters most for a list built from a word in your notes.

The Rock Churches sends text messages to members who have agreed to receive them, from the church’s own number and always named as coming from The Rock Churches. There are two kinds, and a member agrees to each separately: church notices (service times, meeting reminders and important announcements) and invitations and news (church events and what the church is doing).

Nobody is texted because they appear in Rockhub. A member is asked, with two boxes that start unticked, when they create or claim their account. Saying no, or saying nothing, means no messages.

Messages are usually a few a month. Message and data rates may apply. Reply STOP to any message to stop them; that is recorded straight away and no further messages are sent. Reply HELP for help, or write to hello@therockchurches.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with anybody. The only company that handles a member’s phone number for these messages is Twilio, which delivers them on the church’s behalf.

Nobody buys it and nobody is sold it. Rockhub does not run advertising, does not track you across other websites, and does not share your information with anybody for their own purposes.

A few companies handle data on the church’s behalf in order to run the app: Supabase, which stores it; Vercel, which serves the website; Twilio, which delivers the church’s text messages; and Expo, which delivers notifications to the app on your phone. Each acts only on the church’s instructions.

Separately from the church’s messages, a text you send to somebody from Rockhub is sent by your own phone, from your own number, using your phone’s messaging app. Rockhub never sends that message on your behalf and never sees whether it was sent.

A contact you delete moves to your private Deleted area, where only you can see it and where you can restore them if it was a mistake.

You can close your account yourself, from Account in the app or on the website. To have your account and everything in it removed entirely, or if you cannot sign in, write to hello@therockchurches.com. If you are a contact rather than a member and you want to be removed from Rockhub, write to the same address and it will be done.

Rockhub is not intended for children to sign in and use. Young people in the church may appear as contacts saved by a leader, in the same way a youth group keeps a list today.

If this policy changes in a way that affects what happens to your information, the date at the top changes with it.

Questions go to hello@therockchurches.com.