Privacy Policy

Middle Tennessee Tres Dias ("MTTD," "we," "us") runs a private member portal for our Christian ministry community. We use it to keep the roster, welcome candidates, share weekend files, collect sign-ups, and let members message one another.

We keep that information so the community can do its work. We do not sell it, and we do not use it for targeted advertising. When you are signed in, we also record which pages and features you use, with your account and whether the device is a phone or a desktop. We never record message content in that record. We do not sell it. We use it only to improve the portal, and we keep it for up to 24 months. You can ask to see it, correct it, or delete it. The Data deletion section explains how, including how to disconnect Google, Facebook, or X.

The data controller is Middle Tennessee Tres Dias, the ministry that decides why this portal uses personal information and how. Email us at the address in Contact. The portal is published at https://app.mttd.org.

Companies that host the portal, store the database, send notification email, or deliver a push notification work on our instructions. They are service providers (processors). Google, Meta, and X are responsible for their own sign-in services. We receive only the account details described below.

We have not appointed a representative in the European Union or the United Kingdom. This portal serves our community in Middle Tennessee. It is not offered to the public in the EU or the UK, and it does not monitor people there. If you are in the EU or the UK and you use the portal, contact us at privacy@mttd.org and we will handle your request directly.

The portal stores the information the community actually uses. That includes:

• Member and people records. Name, email, phone, church, city, state, postal code, gender, a photo, a short bio, and a link to a spouse when one is recorded. Gender is stored because weekends are organized as men's and women's weekends.
• Weekend roles and service. The weekends you served, your role, area, position, whether you are an area head, attendance, meeting duties, shirt size, whether a weekend donation was received, and scholarship requests. We store the donation status and amount the community records. Donations are voluntary and are processed by Stripe; we do not store card numbers or bank account numbers. If you give with Venmo, that donation happens on Venmo's own site.
• Candidates and sponsors. A sponsor can put a candidate on a weekend. We store the candidate's contact details, sponsor, status, table seating, and attendance confirmation. Confirming attendance asks for a name, email, and two emergency contacts (name, relationship, and phone), plus optional phone, church, city, state, postal code, dietary notes, and other emergency notes.
• Care details. Dietary notes (which can describe allergies or other health needs), emergency-contact notes, and notes an administrator keeps on a person's record.
• Pages and features you use. When you are signed in, we record the page you opened or the feature you used, your member account, and whether the device was a phone or a desktop. A feature is something like sending a message, applying filters, exporting, approving or reverting a change, publishing, editing your profile, or signing in. We never record message content. We do not record an email address or the words you type into a filter in this record.
• Messages and group chats. One-to-one messages and weekend, area, area-head, and custom group chats. A message is text, up to 2,000 characters, plus the time and the sender. Removing a message only sets a deleted mark. The portal hides the text. The text stays in the database until that record is actually deleted.
• Files and documents. Files leaders upload for a weekend, training materials, and photos (member photos and weekend photos). Access depends on the grants set on each document. Training files are available to signed-in members.
• Sign-ups and surveys. The form, your choices, quantities, notes, and survey answers.
• Meeting minutes. Notes typed or imported for a meeting, attendance, and the rector's message. Imported notes can include a title, time, attendees, summary, action items, and transcript.
• Push notifications. If you turn them on, we store the browser's push address and keys, whether push is enabled, and whether the preview should hide the message text. Logging out removes that browser's push address.
• Other community records. Talents you claim, training you complete, and a request to serve.
• Help lesson progress. When you mark a Help lesson done, we store which lesson and when. You can see your own progress. Only administrators and people given permission to view help progress can see who finished which lessons. You can undo a lesson at any time, and your progress is deleted with your account.

We get this information from:

• You, when you edit your profile, message someone, answer a sign-up, or upload a file.
• A sponsor or a leader who adds or updates a people record.
• Google, Facebook, or X, when you use those buttons to sign in. See the next section.
• Granola or Fireflies, when you connect your own account and import a meeting.
• Your browser, when you subscribe to push notifications.
• The portal itself, when you are signed in and you open a page or use a feature.

A name and an email are needed for a member record and a login. A candidate confirming attendance must provide a name, an email, and two emergency contacts. Phone, church, address, photo, bio, dietary notes, push notifications, a meeting-tool key, and social sign-in are optional. You can use email and a password and never connect Google, Facebook, or X.

You can sign in with the email and password on your member record. Passwords are handled by our sign-in service, Supabase. We do not keep your password in the member record. A new login is created only when the email already belongs to an active member who does not yet have a login. A stranger cannot create an account.

You may also sign in with Google, Facebook, or X when those buttons are turned on. The provider sends our sign-in service your name, email address, a flag that says whether the email is verified, and the provider's id for your account. We use the verified email to match the member record already on file. We do not replace your member name with the name from the provider. X often does not send an email. In that case X works after you have already signed in another way and linked it from My Profile.

We ask Google for the usual sign-in scopes (openid, email, and profile), Facebook for email and the public profile, and X for permission to read the user and the user's email. We do not read your posts, friends, followers, or messages on those services, and we do not post anything to them.

Password-reset codes are emailed by Supabase. You type the code yourself. We do not ask you to send a password to us by email.

A member who is allowed to import meeting notes can connect that member's own Granola or Fireflies account, or paste or upload notes. The API key is stored encrypted (AES-256-GCM) on that member's connection. The portal shows only the last four characters. The browser is not given the key back. The key is used to fetch meetings from that member's own account. Disconnecting the tool deletes the stored key.

The notes you choose to import are saved with the weekend meeting: title, time, attendees, summary, action items, transcript, and a link back to the source when the provider supplies one. Those notes are then part of the community's meeting record.

We use a sign-in cookie, set by Supabase, to remember that you are signed in. That cookie is required for the portal to work. We do not use advertising cookies.

The portal does not include Google Analytics, Vercel Analytics, or an advertising product. We do not track you across other companies' websites or apps. Inside the portal, we do record which pages and features a signed-in member uses, together with that member's account and a device type (phone or desktop). We never record message content in that record. We do not sell it. We use it only to improve the portal, and we keep it for up to 24 months.

The portal also stores a few things in your browser, on this device only:

• Which roster sections you collapsed, for you and that weekend.
• Whether you dismissed the prompt to install the app.
• Which message windows you had open, until you close the tab.

The installed app's service worker can store the app icon, the offline page, and other static files. It does not store signed-in pages, private documents, or API responses.

Signup, candidate confirmation, and meeting-location search use the IP address only in the server's memory, and only long enough to slow repeated attempts. We do not write that address into the member database. Our host may keep its own technical logs of requests.

Do Not Track. We do not respond to a Do Not Track browser signal. We also do not track members across other sites, which is the activity that signal is meant to stop. This statement is here for the California Online Privacy Protection Act.

Global Privacy Control. We do not sell personal information and we do not share it for cross-context behavioral advertising, so that signal has nothing to turn off. We still treat Global Privacy Control as a standing opt-out of any future sale or sharing. If we ever sold or shared personal information that way, we would honor the signal.

We use personal information to:

• Create and protect your login, and keep at least one way to sign in.
• Build weekend teams, show service history, and seat candidates.
• Let sponsors invite candidates and let candidates confirm they will attend.
• Share files, training, sign-up lists, and surveys with the people who should see them.
• Deliver messages you send, and push notifications you turn on.
• Keep meeting notes the community asks to import.
• Record whether a weekend donation was received and whether a scholarship was requested. Stripe sends receipts for donations made in the portal.
• Send a notification email, such as a new-candidate note, when that email is configured.
• Protect the portal, limit abuse, and fix problems.
• See which pages and features members use, so we can improve the portal. We do not sell that record, and we do not use it for advertising.

If European or UK law applies to you, we rely on these reasons:

• Membership. Providing the account and the portal features you use (Article 6(1)(b) GDPR and UK GDPR).
• Legitimate interests. Running the ministry community: rosters, sponsorship, meetings, safety contacts, and the record of who served (Article 6(1)(f)). The community's interest is organizing weekends for its members. You can object, and we will stop unless we have a compelling reason to continue.
• Consent. Optional choices you turn on yourself: push notifications, connecting Granola or Fireflies, linking Google, Facebook, or X, and optional details you type, such as dietary notes (Article 6(1)(a)). You can withdraw consent at any time. That does not undo use that already happened.
• Legal obligation. Keeping or sharing something because the law requires it (Article 6(1)(c)).

Taking part in Middle Tennessee Tres Dias reveals that you are connected with a Christian community. Under the GDPR and UK GDPR, that is a special category of personal data (religious belief). Dietary notes can also reveal health information, which is a special category too. Some US state laws call religious belief and health information sensitive data.

We process this information in the course of the community's own work, about our members, former members, and people in regular contact with us for that purpose, such as candidates and sponsors. We rely on Article 9(2)(d) of the GDPR and the UK GDPR: a not-for-profit body with a religious aim, with safeguards, and without disclosing the information outside the community unless the person consents or the law requires it. Service providers that host or deliver the portal process it for us. They do not receive it for their own purposes. Where a law asks for explicit consent as well, you give it by joining the community or by choosing to enter an optional detail, and you may withdraw it by emailing us.

We use sensitive information only to run the community and to care for people on a weekend. We do not sell it, and we do not use it for targeted advertising or profiling.

The portal is for signed-in members. What each person sees depends on the role they hold, the weekend they are on, and permissions a leader has granted. In plain terms:

• You can see and edit your own profile, including your emergency contacts and dietary notes.
• A member can see an active weekend team when they are assigned to it, when it matches their community (men's or women's), when they are qualified to serve across that line, or when they are an administrator. The team list shows names, roles, phone, email, and church.
• City, state, postal code, dietary notes, and emergency-contact notes are shown to leaders who are allowed to edit contact details, and to administrators. They are not on the ordinary team list.
• Weekend history is limited to your community, weekends you served, and administrators. A current secretariat assignment is treated as an administrator while it lasts.
• A one-to-one message is visible to the two people in it. A group chat is visible to members who match that group. After a weekend closes, some group history stays readable for people who were on that team, and new messages stop.
• Sign-up and survey answers are visible to you and to members allowed to view responses.
• Documents follow the person and role access set on each file.
• Usage records are visible to administrators and to members who have been allowed to view usage metrics. They are not on the ordinary team list. The record shows the page or feature, the account, and the device type. It does not show message content.
• Meeting notes and imported transcripts are visible to members allowed to work with that meeting.
• Secretariat names, photos, and bios are visible to signed-in members.
• Administrators can manage people, roles, files, and notifications. That access is for running the community.

We share personal information with service providers only so they can do the work we ask them to do. We do not allow them to use it for their own advertising.

• Supabase. Database, file storage, and sign-in, including email-and-password accounts and the Google, Facebook, and X connection.
• Stripe. Processes donations made in the portal. Stripe receives the card or bank details you enter and handles them under its own privacy policy. Stripe collects the email you give for your receipt and emails the receipt. MTTD stores only the donation amount, status, and Stripe reference numbers, not your name, email, or card number.
• Vercel. Hosts the website and runs the application.
• Resend. Sends community notification email, such as a new-candidate message, when that email service is configured. The message contains the candidate's name and contact details and goes to the recipients the community has selected.
• Web push services. If you enable notifications, your browser's push service delivers them. We accept subscriptions only from Google Firebase Cloud Messaging, Mozilla, Apple, and Microsoft.
• Google, Meta (Facebook), and X. Only when you choose those buttons. They receive the sign-in request. We receive the account details described above. We do not send them the member directory.
• Granola and Fireflies. Only when you connect your own key. We send that key to the service you chose so we can list and import meetings you select.
• OpenStreetMap Nominatim. When a signed-in member searches for a meeting location, our server sends the words they typed to Nominatim (nominatim.openstreetmap.org) and shows the place names it returns. We do not send the member's name. The IP address is used only in memory to limit how often that search can run.
• xAI. Only if an administrator has configured an API key. Exporting a weekend book can send that weekend's theme photo and the weekend theme title to xAI to suggest colors and decorative pictures. The member directory is not sent. If the key is not set, this step does not run.

We do not sell personal information. We do not share it for targeted advertising or cross-context behavioral advertising. We do not profile members to decide what ads to show, and we do not use personal information for automated decisions that produce legal or similarly significant effects.

Under the California Shine the Light law (Civil Code section 1798.83), we do not disclose personal information to other businesses for their own direct marketing. A California resident may email privacy@mttd.org once each calendar year and ask. We will confirm that we do not make those disclosures.

The software does not delete member records on a fixed calendar. We keep them for as long as the community needs them to run weekends and to remember who served. That is the criterion we use.

• A push subscription is deleted when you log out of that browser, or when the push service says it is no longer valid.
• A meeting-tool API key is deleted when you disconnect that tool.
• Candidate confirmation links and password-reset codes expire.
• Removing a message only marks it deleted and hides the text in the portal. The text stays in the database until the record is actually deleted.
• Each notification we send (email, push, or in the portal) is recorded in a delivery log with the recipient, the time, and whether it was delivered. Log entries and in-portal notifications are deleted after 180 days.
• A usage record is kept for up to 24 months, then deleted. It stores the page or feature, the member account, and the device type. It does not store message content.
• If you ask us to delete your information, we delete or reduce it as described under Data deletion. We may keep a limited record of service on a weekend where other members still rely on that history, and anything the law requires us to keep. We will tell you what we kept.

We protect the portal with signed-in access, role checks on the server, private storage for documents and photos, and encrypted connections (HTTPS). Meeting-tool keys are encrypted before they are stored. Passwords are handled by the sign-in service and are not kept in the member table. No method of storage or transmission is perfectly secure. Please use a unique password and tell us if you think your login has been misused.

If we learn of a breach of personal information that the law says we must report, we will notify the people affected and the authorities the law names, in the way and on the schedule that law requires.

This portal is for our ministry community. It is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. The Children's Online Privacy Protection Act (COPPA) applies to operators of sites directed to children under 13, or who knowingly collect their personal information. If we learn that we have personal information from a child under 13, we will delete it.

The software does not ask for a date of birth, so a record alone does not tell us whether a candidate or member is under 16 or under 18. We do not sell personal information of anyone, including anyone under 16. We do not offer sign-up as a service directed at children. If you believe we have information about a minor, email privacy@mttd.org and we will delete it. A parent or sponsor who enters a young person's details should do so only for a real weekend purpose.

Depending on where you live, you can ask us to take the steps below. We honor these requests for our members even where a particular statute exempts a ministry or applies only after a size threshold.

• Access. A copy of the personal information we hold about you, and a description of what we do with it.
• Correction. Fix information that is inaccurate. You can also edit your own profile while you are signed in.
• Deletion. Erase personal information, as described under Data deletion.
• Restriction. Ask us to limit processing while a request is unresolved, or where the law gives you that right.
• Portability. A copy of information you provided, in a common format, where the law gives you that right.
• Objection. Object to processing based on legitimate interests. We will stop unless we have a compelling reason that overrides your interests, or the law requires us to continue.
• Withdraw consent. Turn off push notifications in My Profile, disconnect a meeting tool, unlink a social sign-in, or email us. Withdrawal does not affect processing that already happened.
• Opt out of sale, sharing, and targeted advertising. We do not do those things. You may still email us and we will confirm that.
• No automated decision-making. We do not make decisions about you by solely automated means, including profiling, that produce legal or similarly significant effects. Roster and sponsorship decisions are made by people.

Email privacy@mttd.org from the address on your account. Tell us what you want. We may ask for something we already hold, such as a weekend you served, so we know the request is yours. We will not ask you to email your password.

Someone else may submit a request for you if you have authorized them in writing (an authorized agent). We may still contact you to confirm it.

We answer within 45 days. If the request is complex, or we have many at once, we may take another 45 days. We will tell you before the first period ends. We do not charge a fee unless the law allows a fee for a request that is plainly unfounded or excessive.

If we decline, you may appeal. Reply within 45 days of our decision and put "Appeal" in the subject line. We answer an appeal within 60 days. If we deny the appeal, we will tell you how to contact your state attorney general when that state's law gives you that step. Virginia, Colorado, and Connecticut are among the states that require an appeal path.

We will not deny you a weekend, ask a different suggested donation, or reduce your access because you made a privacy request. We may still refuse a request the law does not require us to grant, and we may ask you to confirm who you are.

If you are in the European Economic Area, you may also complain to the data protection authority where you live, where you work, or where you believe a problem happened. If you are in the United Kingdom, you may complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to help first. Please email privacy@mttd.org.

You can ask us to delete personal information we hold about you. This section is the data-deletion instructions for this portal, including for Facebook (Meta) Login.

Ask by email

Email privacy@mttd.org from the email address on your member record. Use the subject "Data deletion request." Tell us your name, the email on the account, and whether you want us to remove the login, delete the member record, or both. If the request is about Google, Facebook, or X, name the provider. If you cannot sign in, say so, and we will disconnect the provider from our side.

We will verify the request as described under Your rights, then delete or remove the login, contact details, messages, files you uploaded, push subscriptions, meeting-tool keys, and other personal information we can remove. We may keep a reduced record that a role on a weekend was filled, where the community's history still depends on it, and anything the law requires us to keep. We will tell you what we kept and why. There is no delete button in the portal today. Choosing Remove on a message is not the same as deleting it. That action only marks the message deleted and hides the text. The text stays in the database until we delete the record. An administrator can also deactivate a member record, which turns off access. Deactivation alone is not the same as deletion. Ask by email if you want the information deleted.

Unlink Google, Facebook, or X

Unlinking stops that provider from opening your login. It does not delete your member record. To unlink:

1. Sign in to the portal.
2. Open My Profile.
3. Find Sign-in methods.
4. Choose Remove next to Google, Facebook, or X, and confirm.

The last sign-in method on the account cannot be removed, so you always have a way back in. To remove Facebook and also delete the member information Meta's login was attached to, email the deletion request above after you unlink, or email us if you cannot sign in. We do not post to or read your Facebook, Google, or X account when we unlink it.

Several states have comprehensive consumer privacy laws. As of October 4, 2026, laws are in effect in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Tennessee, Minnesota, Maryland, Nebraska, Indiana, Kentucky, and Rhode Island. Florida's Digital Bill of Rights is also in effect and applies mainly to very large companies. Alabama (May 1, 2027), Louisiana (January 1, 2027), Oklahoma (January 1, 2027), and Vermont (January 1, 2028) have enacted laws that are not yet in effect. We will follow this same notice for residents of those states when those laws apply.

Many of these laws exempt nonprofit organizations, or they apply only after a business handles personal information about a large number of that state's residents or earns substantial revenue from selling personal information. A ministry like ours may fall outside some of them. Colorado is an example of a law that can reach nonprofits, and a few others do not exempt them. We have not made a state-by-state decision that each statute binds us. We still provide the notices and the request process in this policy.

For residents of those states, this policy is our notice of:

• The categories of personal information we collect, and the sources, listed above.
• The purposes, listed above.
• The categories we disclose to service providers, listed above. We disclose information so they can host, store, email, or deliver a notification. We do not sell it.
• Sensitive data, including religious belief and health-related dietary notes, used only as described above, with consent where a law requires consent, and never sold.
• The rights to access, correct, delete, and obtain a copy, and to opt out of sale, targeted advertising, and profiling. We do not sell, target ads, or profile, so those opt-outs have no further effect.
• How to submit a request, how we verify it, how an authorized agent may submit one, how to appeal, how long we take, and that we will not discriminate against you for asking.

We are in the United States. Supabase, Vercel, Resend, the push services, and the sign-in providers process information in the United States. If you are in the European Economic Area or the United Kingdom, that is a transfer out of your country.

Where European or UK law applies to a transfer, we rely on the provider's Standard Contractual Clauses and, when the provider participates, the EU-US Data Privacy Framework and the UK extension to it. Middle Tennessee Tres Dias is not itself certified under the Data Privacy Framework. Nonprofit organizations are often outside the framework's scope. Our hosting and sign-in providers may be certified on their own. You can ask us which transfer tool covers a particular provider and we will tell you what we have.

We will post changes on this page and update the effective date. If a change is significant, we will also tell signed-in members by a notice in the portal or by email when we have an address. The date at the top of this page is the date of the current version.

Questions, requests, appeals, and deletion requests go to:

Please also read our Terms of Service.