Privacy Policy

Welcome to CGMAPP (“we”, “us”, “our”, or the “App”). We are committed to safeguarding your personal data, respecting your privacy rights, and maintaining absolute transparency regarding how your information is gathered, utilized, processed, and protected.

This Privacy Policy applies to all users worldwide who access or use the CGMAPP mobile applications (available on iOS and Android), our web applications, and related services (collectively, the “Services”). By installing, registering for, or using CGMAPP, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

We collect only the minimum personal information necessary to deliver, operate, secure, and improve our Services. This includes:

A. Information You Provide Directly

• Account & Profile Credentials: When you register, we collect your email address, display name, username, and password credentials (securely handled via industry-standard authentication protocols). You may optionally provide a biographical description (“Bio”) and profile photo.
• Phone Number (Optional / Matching): If provided for identity verification or friend discovery, your phone number is stored in hashed format or used strictly for account security.
• User-Generated Content (UGC): Content you voluntarily publish to community feeds, including posts, text, images, videos, comments, sermon notes, prayer bookmarks, and reactions (“likes”).
• Direct Communications: One-on-one direct messages, shared audio/devotional cards, and read receipts exchanged between you and other registered users.
• Customer Support & Feedback: Any correspondence, inquiries, bug submissions, or support requests you send directly to our ministry administrators.

B. Information Collected Automatically

• Device and Network Information: Device model, operating system version (iOS/Android), unique device identifiers, preferred language, time zone, and IP address.
• Push Notification Tokens: Unique device push notification tokens generated by your operating system to route real-time notifications for direct messages, mentions, and devotional releases.
• Usage & Engagement Statistics: Non-personally identifiable app interaction metrics, such as audio playback completion, devotional streak tracking, and reading progress.

2. Special Category Data (Faith & Religious Data)

We process this data solely on the basis of your explicit consent when you register and engage with our spiritual tools, or pursuant to legitimate activities undertaken by a religious, not-for-profit ministry entity with appropriate safeguards (GDPR Article 9(2)(d)). We do not sell, rent, monetize, or disclose your religious affiliations to commercial data brokers, advertising networks, or unauthorized third parties.

3. How We Collect Your Data

Data is collected through:

1. Direct Input: Forms completed during onboarding, profile edits, post creation, and messaging.
2. App Operations: Automatic synchronization with our secure cloud database systems during active sessions.
3. Media Selection: Picking photos or videos from your camera roll using system media pickers.

4. How We Use Your Information

We process your personal information strictly for the following purposes:

• Providing the Core Service: Authenticating accounts, synchronizing devotional reading progress, streaming sermons and music tracks, delivering community feed posts, and enabling messaging.
• Social Discovery & Connections: Allowing you to follow ministry leaders and connect with friends who also use CGMAPP.
• Notifications: Sending urgent alerts, new devotional declarations, church livestreams, and instant messaging alerts (which you can disable at any time in App Settings).
• Platform Security & Moderation: Preventing abuse, filtering spam, enforcing our Terms of Service, responding to reports of inappropriate content, and protecting users against fraud.
• Technical Maintenance & Debugging: Identifying performance bottlenecks, resolving application crashes, and maintaining data integrity.

5. Legal Bases for Processing (EEA, UK, and International Law)

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal frameworks established by the GDPR:

• Performance of a Contract (Article 6(1)(b)): Providing the features requested when you create an account and agree to our Terms of Service.
• Legitimate Interests (Article 6(1)(f)): Maintaining network security, preventing unauthorized access, moderating offensive content, and ensuring server stability.
• Explicit Consent (Article 6(1)(a) & Article 9(2)(a)): Required for processing Special Category Data relating to religious practices, address book matching, and optional push notifications.
• Legal Obligation (Article 6(1)(c)): Complying with statutory reporting requirements, child safety mandates, or valid law enforcement court orders.

6. Device Permissions We Request

To provide specific interactive features, the App requests permission to access certain device hardware and operating system capabilities. You can revoke these permissions at any time in your device’s system settings:

7. Contact Book & Friend Discovery (Privacy Safeguards)

When you choose to use our “Find Friends” feature, we implement industry-leading privacy protections designed to respect your contacts’ privacy in accordance with Apple App Store Guideline 5.1.2 and Google Play Developer Policies:

• No Plaintext Address Book Uploads: We never upload, copy, or store your unhashed address book on our servers.
• Client-Side Cryptographic Hashing: Your device normalizes phone numbers and generates a one-way mathematical hash using the SHA-256 cryptographic algorithm before any verification query is executed.
• Read-Only Verification: Hashed values are queried against registered user account hashes in our database strictly to identify existing mutual members. Non-matching contact hashes are immediately discarded in memory and are never saved or indexed.
• Strict Prohibition on Marketing: We never contact, email, or send unsolicited SMS invites to your contacts without your direct, manual invitation action.

8. Direct Messaging & Security Architecture

CGMAPP provides a direct messaging service for community members. We have engineered direct messaging with robust client-side encryption safeguards:

• Client-Side AES-256 Encryption: Direct message bodies are encrypted on your device using 256-bit Advanced Encryption Standard (AES) before being written to our database.
• Server-Secured Key Management: Unique conversation keys are derived via authenticated server-side cryptographic routines, ensuring encryption keys are never bundled into the client application binary.
• Notification Privacy: Push notification previews for encrypted direct messages display a generic placeholder (e.g., “Text message”) rather than plaintext message content, preventing eavesdropping on lock screens.
• Message Deletion: Users can delete individual messages (“Delete for Me” or “Delete for Everyone”). When a conversation is deleted, associated message records are removed from active databases.

9. Third-Party Service Providers & Data Processors

To provide, maintain, and secure our Services, we engage vetted third-party cloud infrastructure providers who act as data processors on our behalf. All providers are contractually bound by data processing agreements, strict confidentiality requirements, and industry-standard security safeguards:

10. Data Retention & Account Deletion Policy

We retain your personal information only for as long as your account remains active or as needed to provide you with our Services.

A. In-App Account Deletion (Self-Service)

In accordance with Apple App Store Review Guideline 5.1.1(v) and global privacy mandates, you may permanently delete your account and associated personal data at any time directly within the application:

1. Open the CGMAPP application.
2. Navigate to your Profile tab.
3. Scroll to the danger zone and tap “Delete Account”.
4. Type DELETE to confirm your intentional request.

B. What Happens When Your Account Is Deleted

• User Document & Authentication: Your account profile, authentication credentials, email address, username, phone number, and push notification tokens are permanently removed.
• Private Data: Your direct conversations, reading progress, private settings, and notification records are permanently deleted.
• Public Community Contributions: Post records, comments, and likes associated with your account in the active feed are removed from the database index.
• Media Deletion & Purging: If you wish to ensure that all historic images or videos previously uploaded to our media delivery network are purged, you may contact our privacy team at privacy@cgmapp.com and we will execute a complete cloud storage purge of all content files associated with your user identity within thirty (30) days.

11. Your Privacy Rights (GDPR & Global Standards)

Depending on your geographic location, you enjoy specific statutory rights regarding your personal data:

• Right of Access (Article 15 GDPR): You have the right to request a copy of the personal information we hold about you.
• Right to Rectification (Article 16 GDPR): You have the right to correct inaccurate or incomplete personal information directly within your Profile settings or by contacting us.
• Right to Erasure (“Right to Be Forgotten”, Article 17 GDPR): You have the right to obtain the erasure of your personal data without undue delay.
• Right to Restriction of Processing (Article 18 GDPR): You may request that we restrict processing of your data in certain circumstances.
• Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21 GDPR): You may object at any time to the processing of your data based on our legitimate interests.
• Right to Withdraw Consent: Where processing is predicated on consent, you may withdraw your consent at any time with future effect.

To exercise any of these statutory rights, please submit a written request to privacy@cgmapp.com. We will respond within thirty (30) calendar days.

12. California Consumer Privacy Rights (CCPA / CPRA)

This section provides supplementary disclosures required under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”):

• Categories of Personal Information Collected: Identifiers (name, email, IP address, username), protected classifications (religious affiliations voluntarily revealed via app use), internet/electronic network activity (app interactions), and visual data (photos, videos uploaded).
• No Sale or Sharing of Personal Information: We do NOT sell your personal information, nor do we “share” your personal information for cross-context behavioral advertising (as defined under California law). We have not engaged in such sales or sharing in the preceding twelve (12) months.
• Sensitive Personal Information: We process sensitive personal information (such as religious data voluntarily supplied) strictly to provide the core services you requested and not for secondary inference or cross-platform marketing.
• Non-Discrimination: We will never discriminate against you, deny you services, charge you different prices, or provide a lower quality of service because you exercised your California privacy rights.
• California “Shine the Light” Law: California Civil Code Section 1798.83 permits California residents to request details regarding disclosure of personal data to third parties for direct marketing. We do not disclose personal information to third parties for their direct marketing purposes.

13. Children’s Privacy (COPPA & Global Safeguards)

CGMAPP is not directed to children under the age of thirteen (13) (or sixteen (16) within the European Union and United Kingdom). We do not knowingly collect, solicit, or maintain personal information from children under these minimum ages.

If we become aware that an account has been registered by an individual under the applicable statutory age without verifiable parental consent, we will promptly deactivate the account and permanently delete all associated personal data from our systems. If you believe a minor has provided us with personal information, please contact us immediately at privacy@cgmapp.com.

14. Security of Your Information

We employ technical, physical, and administrative safeguards designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or misuse. These protections include:

• HTTPS / TLS 1.3 encryption for all data transmitted between the mobile application and cloud infrastructure.
• AES-256 symmetric encryption for direct message contents stored in database collections.
• Server-side authenticated access tokens and security rules restricting database access strictly to authorized resource owners.
• Restricted administrative roles and multi-factor authentication (MFA) on backend cloud management consoles.

While we take rigorous measures to protect your information, no wireless data transmission or electronic storage system is 100% impenetrable. We encourage you to use unique, robust passwords and avoid sharing your account credentials.

15. International Data Transfers

Our servers and authorized cloud data processors operate in the United States and other global hosting jurisdictions. If you access CGMAPP from outside the United States, your information will be transferred across national borders to secure enterprise cloud facilities located in other countries.

Where personal information is transferred from the EEA, UK, or Switzerland to countries that have not received an adequacy decision from the European Commission, we rely on recognized legal mechanisms, including the European Commission’s Standard Contractual Clauses (SCCs), to safeguard your rights.

16. Changes to This Privacy Policy

We may update or revise this Privacy Policy periodically to reflect enhancements to our features, operational practices, or evolving legal and regulatory requirements. When material changes are made, we will notify you through an in-app notice, a prominent announcement within the community tab, or by updating the “Last Updated” date at the top of this document.

Your continued use of CGMAPP following the posting of updated policies signifies your acceptance of the revised terms.

17. Contact Us & Data Protection Inquiries

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy or our data handling practices, please contact our designated privacy administration team: