Filament Privacy Policy

Last updated: [date]

This Privacy Policy explains how OnebyNine Systems LLC, a Michigan limited liability company, doing business as Filament, collects, uses, and shares personal information in connection with filament.church and the Filament Service. Capitalized terms have the meanings given in the Terms of Service.

3.1 Who this covers

• Church staff and Authorized Users who use the Staff Console.
• Congregation Site visitors who view a church's Published Content.
• Website visitors to filament.church.

3.2 Information we collect

From Church staff, in the Service. The Staff Console does not collect anything that identifies an individual. Each church has one shared staff password; we store only a salted hash of it (argon2id), never the password itself. When you sign in, your browser receives a session cookie named sermon_admin_session that expires after 12 hours; it is marked HttpOnly, Secure, and SameSite=Strict, and it carries no name, email, or other identity. Sign-in attempts are rate-limited by IP address; those addresses are held in the console's memory for 60 seconds and are never written to disk. The Staff Console keeps an edit log recording what changed and when, not who changed it. When an Authorized User accepts the Terms of Service in the Staff Console, we record the time, the version of each document accepted, and the IP address of the browser that accepted; this acceptance record holds the only IP address the Service stores, and we keep it for the life of the account.

From Church staff, outside the Service. At signup and for invoicing we collect a contact name, email address, church name and address, and payment details. Payments are processed by Stripe outside the Service; Filament does not store card numbers. We also keep support correspondence.

From Congregation Site visitors. Congregation Sites have no accounts, no analytics, and no forms, and set no cookies of their own. Search runs entirely in your browser, and your search queries never leave it. Your browser stores three things locally, on your own device: your light-or-dark theme choice, your recent searches, and whether the series list is open or closed; none of this is sent to us. Each page load fetches fonts from Google Fonts and video thumbnails from YouTube, and the video player on each sermon page is YouTube's embedded player; Google and YouTube receive your IP address and standard browser request data when those load, under their own privacy policies. Scripture text is fetched from Faithlife, LLC, as it is shown: previewing a reference, or opening a study guide, requests that passage from Faithlife's servers, and scripture links go to Biblia.com, which Faithlife also operates. Faithlife receives your IP address and standard browser request data with each such request, or when a link is followed, under its own privacy policy. Web-server request logs for Congregation Sites are [not kept / kept for N days — confirm].

From Source Content. Sermon audio and video may contain voices, names, or personal information of speakers and people mentioned in a sermon. We process this content only to provide the Service to the Church that directed us to retrieve it. The full transcript of each sermon is retained for the life of the Church's account; it is the material the Service is built on. Audio is downloaded only to be transcribed and is deleted as soon as transcription finishes. We never retain video.

3.3 How we use information

We use information to provide, secure, and improve the Service; to bill and communicate with churches; to respond to support requests; to enforce our Terms; and to comply with law. We do not sell personal information and do not use it for advertising.

3.4 How we share information

We share information with the following subprocessors, each bound to protect it and use it only to provide services to us or to the Church:

• Anthropic receives each sermon's transcript text and the church's name to generate summaries, themes, scripture references, and study guides, under Filament's account.
• ElevenLabs (by default), or Groq, OpenAI or Deepgram where configured, receive sermon audio to produce transcripts, under Filament's account.
• YouTube is contacted on the Church's behalf to retrieve its videos, captions, and publish notifications; those requests go through an outbound proxy operated by or for Filament.
• OVHcloud hosts the Service and Church Content.
• An off-site backup copy is held on Filament-controlled equipment in [location].
• Let's Encrypt issues the TLS certificates for each Congregation Site and Staff Console; it receives the hostname only.
• Stripe processes subscription payments outside the Service.

A current list, with what each provider receives, is at https://filament.church/subprocessors/.

We may also share information when required by law, to protect rights and safety, or in connection with a merger or acquisition.

Published Content is displayed publicly on the Congregation Site at the Church's direction. Filament does not control who views it.

3.5 Retention

We retain Church account data, including transcripts and Generated Content, for the life of the account and for 60 days after termination; after that the account's data is deleted. Backups are kept on a rotation of 14 daily and 8 weekly copies on the server, and for 60 days on the off-site copy, so no backup of a terminated account outlasts 90 days. Audio is deleted as soon as transcription finishes. Web-server request logs are retained [not at all / for N days — confirm]. We de-identify Generated Content before using it to improve the Service.

3.6 Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to certain processing. To exercise these rights, contact [privacy@filament.church]. If you are a congregant and your request concerns content a church published, we will refer you to that church, which controls that content. California residents: we do not sell or share personal information as defined by the CCPA.

3.7 Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Congregation Sites are informational and offer no accounts. If you believe a child has provided us personal information, contact [privacy@filament.church] and we will delete it.

3.8 Security

We use reasonable safeguards. All traffic to and from the Service is encrypted with TLS. Each church's data lives in its own operating-system account on the server, with isolation enforced by the operating system so that one church's processes cannot read another's files. API keys and other secrets are kept in files readable only by the system's root account. Backups run nightly, with a copy held off-site. No system is perfectly secure.

3.9 International visitors

The Service is hosted by OVHcloud in [OVH region], with a backup copy held in [location]. If you access it from elsewhere, your information will be processed there.

3.10 Changes

We will post changes here and update the date above. For material changes, we will notify churches by email to the account contact.

3.11 Contact

[privacy@filament.church] · OnebyNine Systems LLC, [mailing address], Michigan.