1. Scope
This policy applies to the independently developed native iOS version of The Pastor's Desk distributed through Apple's App Store. It does not describe an earlier web or Capacitor prototype or any separate service that has its own privacy policy.
The app is a private ministry organizer. Its current release operates without a production account server, cloud synchronization service, advertising network, analytics service, or third-party crash-reporting service.
2. Information stored locally
The app can store the following information on your device:
- A local profile, including the name and email address you choose to enter.
- Ministry records such as contacts, prayer requests, tasks, calendar events, newcomer records, ministry logs, small-group information, documents, and counseling notes.
- App preferences such as appearance and display settings.
- Opaque identifiers needed to update an event that you link to Apple Calendar.
This information is used only to provide the app's features on your device. Because it is not transmitted to us, we cannot view, retrieve, sell, or use it for advertising.
3. Permissions and Apple services
- Calendar: If you choose to link an event to Apple Calendar, the app requests calendar access to create, update, or delete that linked event. Denying access does not prevent you from saving an event inside The Pastor's Desk. You can revoke access at any time in iOS Settings.
- Notifications: If you choose an event reminder, the app may request permission to schedule a local notification. Reminder details are processed on the device. You can revoke permission in iOS Settings.
- Device authentication: The app may use Touch ID, Face ID, or your device passcode through Apple's Local Authentication framework to protect access. The app does not receive or store your biometric data.
- Imports and exports: You may choose files to import or create encrypted backups and document exports. Files leave the app only when you choose a destination through Apple's system interface. The destination's privacy practices then apply.
Apple may process App Store transactions, device backups, calendar data, and other platform information under Apple's own privacy terms. The developer does not receive payment-card details or gain access to your Apple account data through these features.
5. Retention, deletion, and privacy choices
Local information remains on your device until you delete individual records, replace or erase an imported backup, or remove the app. The developer has no server-side copy of this information and therefore has no remote record to retain or delete.
- Delete individual ministry records using the relevant feature in the app.
- Revoke Calendar, notification, or local-authentication permission in iOS Settings.
- Delete exported files and backups from every destination where you chose to save or share them.
- Remove the app to remove its local app container. Apple may retain device backups or Keychain items according to your device and iCloud settings; the developer cannot access them.
6. Security
The native app protects ministry records with encrypted local storage, iOS Data Protection, and device-only Keychain keys. Counseling notes use a separate encryption key and are shielded when the app becomes inactive. User-created backups are encrypted with the passphrase the user provides.
No security measure can guarantee absolute protection. You are responsible for protecting your device passcode, backup passphrases, and any destination to which you export information.
7. Children
The Pastor's Desk is designed for pastors and ministry workers and is not directed to children. The app does not knowingly collect personal information from children.
8. Changes and contact
This policy may change as the app's features or data practices change. The effective date above will be updated when a revised policy is published. Material changes will be disclosed in the app or its App Store listing when appropriate.
For privacy questions, use the developer support link provided on The Pastor's Desk App Store product page. Because the current native release does not collect or retain server-side user data, there is no remote user-data record for the developer to access, correct, or delete.