Privacy policy

Who this is for

Pending legal review

Kirk Safety is a church safety-team operations app (roster, schedule, Live, Handbook). It is for adult crew and captains. It is not a consumer social network, not an ad product, and not a medical-records system. Kirk is for people 18 and older. We do not knowingly collect information from anyone under 18. If we learn someone under 18 has an account, a captain removes them.

Pending legal review

Account email and password (sign-in is handled by our sign-in provider, Supabase Auth). Roster display name. Crew phone numbers are required so captains can reach crew. Kirk does not send text messages. A captain can pick one person from contacts on their iPhone to invite. Kirk receives only that person's name and phone or email. Kirk does not read or upload the address book. Assignments, check-ins, incidents, medical response notes, Handbook text your captains edit, and in-app messages for that church. Optional person or vehicle descriptions and short notes on an incident, stored as separate description rows for a captain-set retention period (1–90 days, default 7). Those descriptions are not searchable or matched across incidents. Descriptions are excluded from after-action reports and log exports. If you delete your account, the description row stays with the church and the author name is removed. Phone alert registrations so we can send Sunday / urgent alerts you enable. Face ID / device unlock stays on your device and is never uploaded.

Pending legal review

Pending legal review

Medical, Safety threat, Child or family, Other, and Stuck radio phone alerts go to the crew. Inactive and removed people are not included, and another church is never included. A mute on the contact relay does not stop these alerts. The phone alert text is the same for every recipient of that alert. It does not include a name or a minor detail.

A new-message notification can include the first 60 characters of the message and no sender name. Message text can appear in notifications. That text passes through Apple, Expo and Google. You can hide message text in Settings > Notifications.

Pending legal review

Captains and church admins are scoped to their own church. There is no shift lead. Active members of your church, including captains and church admins, can see your number and tap to call. It is hidden when you leave. Phone numbers are readable by active members of the same church. Active members of your church can see alerts and Live notes. All active members can read incident reports and medical response records. Direct and group chats are seen only by the people in them. Incident descriptions are visible to the person who wrote the report, captains, crew assigned to that service, and confirmed floaters. Person descriptions on a minor-involved incident are limited to captains and the person who wrote them. Descriptions are excluded from after-action reports and log exports. When you delete your account, the description row stays with the church and the author name is removed. Other churches cannot see your roster. Kirk has one platform owner. They can see church setup and look up any person by exact email across churches (role, sign-in state, and last sign-in time). They can create churches, edit the public site copy and ops banner, keep church notes, archive a church (which blocks everyone in it from signing in until it is restored) or rename a church, reissue invites, and revoke access. They can promote an existing member to captain, issue a captain invite, and set a church's primary captain email.

We do not sell data. We do not run ads or third-party tracking. Spotlight shows adult first names and post labels only — not invite codes, emails, phones, or child-safety fields. Medical and incident tools are coordination notes, not medical advice.

Pending legal review

Optional person or vehicle descriptions and short notes on an incident, stored as separate description rows for a captain-set retention period (1–90 days, default 7). Those descriptions are not searchable or matched across incidents. Descriptions are excluded from after-action reports and log exports. If you delete your account, the description row stays with the church and the author name is removed.

Delete your account

Pending legal review

You can hide message text in Settings > Notifications.

In the app: Settings → Account → Delete account. Type DELETE to confirm. That removes your account and roster info. Church records you created stay with the church after you delete your account. If you delete your account, your messages show as Former member. Ask a captain or church admin to remove them. A later account step can also remove your messages. To request help, email support@kirksafety.com. The steps are also on Delete account.

Pending legal review

Kirk is for people 18 and older. We do not knowingly collect information from anyone under 18. If we learn someone under 18 has an account, a captain removes them. Kirk does not check in children.

Pending legal review

Face ID / device unlock stays on your device and is never uploaded.

A paired Apple Watch can show a temporary status snapshot that includes the first names of adults serving on the same service. That does not widen what your church already sees in Kirk — roster, assignments, and check-ins are already visible to members of the church — but it moves those first names onto a wrist. First names always show on the watch, the phone, and crew notifications; members cannot hide their own names. Captains can turn first names off for the church (Settings → Apple Watch → Show first names on Apple Watch). The watch stores nothing else on the device. Queued watch reports travel between the paired iPhone and Apple Watch and are dropped after 15 minutes. If a watch report is waiting on the iPhone, Kirk may show two generic local notifications: “Open Kirk to finish sending.” and “Add details to your report.” Those notifications contain no names or report details. Kirk Safety is not a 911 substitute. The last WatchConnectivity snapshot may be included in an iPhone backup; the watch holds no login token or person identifier (binding_id and service_id are random, not credentials), and may contain adult first names when names are on. It is overwritten on every clear event. There is no age data in the schema, so “adults only” is an attestation, not a technical control.

Pending legal review

Pending legal review

support@kirksafety.com