Legal

Privacy Policy

Effective August 20, 2026 · Last updated August 20, 2026

Uncomn is operated by Uncomn Discipleship ("Uncomn," "we," "us," "our"), based in San Antonio, Texas.

This policy explains what Uncomn collects, why, who can see it, and what you can do about it. It covers the Uncomn mobile and web apps and the Uncomn website.

We do not sell personal information. We do not use it for targeted advertising. We do not use your organization’s content to train AI models.

1. Two different roles, and why it matters

Uncomn is used by organizations — churches, campus ministries, and similar groups. That creates two distinct relationships, and your rights differ slightly depending on which one applies.

When we act on our own behalf (we are the "controller"): your account details, how you use the app, the emails and notifications we send you, security and abuse prevention, and anything you send us directly at our support address.

When we act on an organization’s behalf (we are the "processor"): the records your organization creates inside Uncomn — group rosters, attendance, RSVPs, lesson progress, message board posts, and curriculum. Your organization decides what goes in, who sees it, and how long it stays. We hold and protect it for them.

In practice: if you want your attendance history corrected or a message board post removed, your organization’s admin is the fastest route. If you want your Uncomn account itself deleted, come to us. We will help either way — see §9.

2. What we collect

2.1 Information you give us

Category	What it includes	When
Account	Name, email address, profile photo (optional), password (stored only as a hash — we never see it)	Signup, profile edits
Organization	Organization name, your role (admin, group leader, member), group memberships	Signup, invitation, admin action
Meeting activity	RSVP responses (going / maybe / can’t), guest counts	You tap them
Lesson progress	Which lessons you’ve marked not started, in progress, or completed, per group	You mark them
Content you post	Message board posts, notes, group and event details	You write them
Curriculum	Course outlines, lesson titles, descriptions, and Scripture references — including text pasted into the outline importer	Admins and leaders
Support	Anything you send to our help address	You email us

2.2 Information others record about you

This is the part most policies leave out, and it applies to everyone in a group.

Attendance. After a meeting, your group leader records who was present and who was absent. Absences are recorded, not just attendance — that is deliberate, because it is what makes a group that has quietly stopped meeting visible. A leader can attach a short note to a row. Each record stores who saved it and when.
Roster membership. An admin or leader can add you to a group, change your status, or remove you.
Invitations. If someone invites you, we receive your email address from them before you have an account.

2.3 Information collected automatically

Category	What it includes
Device and push	Push notification token, device type, OS, app version
Log and technical	IP address, timestamps, pages or screens accessed, errors
Security	Sign-in attempts, one-time-code requests, rate-limit signals

The Uncomn app contains no product analytics SDK. We do not track how you use the app for analytics purposes, and there is no third-party analytics or tracking library in it.

2.4 What we do not collect

Payment information. Uncomn is free during beta and we do not collect card details. If paid plans launch, payments will be handled by a payment processor and card numbers will never reach our servers.
Location. We do not collect device location or GPS.
Contacts. We do not access your phone’s contact list.
Advertising identifiers. We do not use them and we do not run ads.

3. Religious participation is sensitive information

Using Uncomn reveals that you take part in a faith-based group, and can reveal how consistently you take part and what you are studying. Under laws including the Texas Data Privacy and Security Act, the EU and UK GDPR, and several US state privacy laws, that is sensitive personal information, and we treat it accordingly:

We never sell it, share it for cross-context behavioral advertising, or disclose it to advertisers or data brokers.
We never use it to build profiles for marketing.
We do not disclose your attendance, lesson progress, or group membership outside your organization, except as described in §7.
Inside the app, access is enforced at the database level by row-level security — not just hidden in the interface.

Where the GDPR or UK GDPR applies, we process this information on the basis of your explicit consent and your organization’s, given when you join. You can withdraw consent by leaving the group or closing your account.

4. Why we use your information

Purpose	Examples	Legal basis (GDPR/UK)
Run the service	Show your groups, meetings, curriculum, and progress	Performance of a contract
Schedule and remind	Generate recurring meetings; send reminders by push and email three days ahead	Contract; legitimate interests
Verify identity	One-time email codes at signup and sign-in	Contract; legal obligation
Prevent abuse	Rate limits on invitations and emails, leaked-password checking	Legitimate interests
Summarize for leaders	Weekly summaries of what met, who came, and lesson progress	Contract; legitimate interests
Import curriculum	Parse a pasted outline into lessons (see §6)	Contract
Support and fix problems	Diagnose a bug you report; read error logs	Legitimate interests
Comply with law	Respond to lawful requests; keep records we’re required to keep	Legal obligation

We do not use your content to train our own models or anyone else’s.

5. Who can see what

Inside a single organization:

	Other members of your group	Your group leader	Organization admin	Uncomn staff
Name and profile photo	Yes	Yes	Yes	Yes
Email address	No	Yes	Yes	Yes
RSVP to a meeting	Yes — RSVPs are shown to the group	Yes	Yes	Only if needed for support
Attendance, including absences	No	Yes	Yes	Only if needed for support
Lesson progress	No	Yes	Yes	Only if needed for support
Message board posts	Yes, within that group	Yes	Yes	Only if needed for support

Leaders can read your progress. They cannot change it. Only you can mark a lesson complete for yourself. That asymmetry is enforced in the database and is not a setting anyone can turn off.

Staff access is limited and purposeful. We access organization content only to fix a problem, respond to a support request, meet a legal obligation, or address a genuine safety or security issue.

Uncomn does not connect organizations to each other. Nobody outside your organization sees your groups, attendance, or progress.

6. AI features

Uncomn’s outline importer lets an admin paste a course outline as text and turns it into structured lessons.

The text you paste is sent to a third-party AI provider (Anthropic) to be parsed.
It is used only to extract the outline you pasted. The model is instructed to extract only — never to invent titles, descriptions, or Scripture references.
Our provider does not use content submitted through its API to train its models.
We do not use your content to train models either.
Do not paste confidential or sensitive personal information about other people into the importer. It is built for curriculum outlines.
Parsing is automated and can be imperfect. Review the result before you publish it; nothing is published without an admin confirming it.

Automated parsing here has no legal or similarly significant effect on anyone.

We share personal information only with service providers who help us run Uncomn, and only for that purpose. Each is bound by contract to protect it.

Provider	What it does	Data involved	Location
Supabase	Database, authentication, file storage, serverless functions	All app data	Canada (ca-central-1)
Resend	Transactional email — codes, invitations, reminders, summaries	Name, email, message content	United States
Anthropic	Parses pasted course outlines	Only the text pasted into the importer	United States
Netlify	Hosts the marketing website	Site visit logs	Global CDN
Apple, Google	App distribution and push notification delivery	Push tokens, notification payloads	Global

We may also disclose information:

To your organization. Your admins and leaders can see what §5 describes. If your organization’s account ends, its content stays with the organization.
When the law requires it. In response to a valid legal request. We will notify you unless we’re legally prohibited from doing so.
To prevent harm. If we believe in good faith that disclosure is necessary to prevent serious harm to someone, particularly a minor.
In a business transfer. If Uncomn is acquired or merged, data transfers with it. This policy continues to apply until you’re given notice of a new one.

We do not sell personal information, and we have not in the preceding twelve months.

8. Notifications and email

Transactional email — one-time codes, invitations, password resets, meeting reminders, weekly summaries. These are part of the service. You can turn off reminders and summaries in settings; you cannot turn off codes and security notices while your account is open.
Push notifications — meeting reminders and group activity. Turn them off in the app or in your device settings at any time.
Marketing email — if we send any, every message includes an unsubscribe link, and unsubscribing never affects your account.

9. Your rights and choices

Wherever you live, you can ask us to:

Access a copy of your personal information
Correct anything inaccurate
Delete your account and personal information
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent where we rely on it

How to exercise them. Email hello@uncomn.co from the address on your account. We’ll respond within 45 days (extendable once by another 45 where the law allows), and we will not treat you differently for asking.

A note on organization records. Attendance, RSVP, and lesson-progress records belong to your organization. If you ask us to delete them, we will pass your request to your organization’s admin and support them in carrying it out, and we will tell you what happened. Records that document a group’s history may be retained by the organization even after you leave it.

If you’re in Texas. The Texas Data Privacy and Security Act gives you the rights above and the right to appeal a decision. If we decline a request, we’ll tell you why and how to appeal. If your appeal is denied, you may contact the Texas Attorney General at texasattorneygeneral.gov.

If you’re in California. You have rights of access, deletion, correction, and portability, and the right to know what we collect and disclose — all set out above. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for any purpose beyond providing the service.

If you’re in the EEA or UK. You have the rights above plus the right to lodge a complaint with your local supervisory authority. Our legal bases are in §4.

10. How long we keep information

Data	Retained
Account details	Until you delete your account, then removed within 30 days
Attendance, RSVP, lesson progress	For as long as your organization keeps its account, since these form its history
Message board posts	Until deleted by you, a leader, or an admin
Curriculum	Until deleted by an admin
Email delivery logs	30 days
Security and access logs	90 days
Backups	7 days

Deleted data is removed from live systems immediately and cycles out of backups within the backup window above. We may keep the minimum needed to resolve disputes, prevent abuse, or meet a legal obligation.

11. Children and young people

Uncomn is often used by student and youth ministries, so this section is specific.

Minimum age 13. You must be at least 13 to create an Uncomn account. We do not knowingly collect personal information from children under 13. If we learn we have, we delete it promptly.
Ages 13–17. A minor may use Uncomn only with the permission of a parent or legal guardian. The organization that invites a minor is responsible for obtaining that permission and for following its own policies on ministry with minors. Uncomn does not verify it.
What leaders can see. A leader of a group containing minors can see the same information §5 describes: attendance, lesson progress, and posts.
Parents and guardians. To review, correct, or delete a minor’s information, contact the organization’s admin, or email us at hello@uncomn.co and we will help.

If you believe a child under 13 has an account, email us and we will act on it.

12. Security

Passwords are hashed and salted; we never store or see them.
Signup uses a one-time code sent to your email — no account exists until the inbox is verified.
New passwords are checked against known breach databases and weak ones are rejected.
Rate limits on invitations, emails, and code requests.
Data is encrypted in transit (TLS) and at rest.
Access between organizations is separated by row-level security in the database itself, not just in the interface.
Staff access is limited to those who need it, and is logged.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required regulator as the law requires.

13. Where your information is held

Uncomn is operated from the United States, and our providers store data in the United States and Canada — the app’s database is hosted in Canada, and email and AI processing take place in the United States. If you use Uncomn from outside those countries, your information is transferred to and processed there. Where required, we rely on Standard Contractual Clauses or another approved transfer mechanism.

14. Changes to this policy

We’ll post the updated policy here with a new date. For material changes — particularly anything that widens who can see your information — we’ll notify you by email or in the app before it takes effect.

15. Contact

Uncomn Discipleship
San Antonio, Texas, United States
hello@uncomn.co