KnowCore Privacy Policy

Effective date: June 6, 2026 Last updated: September 18, 2026

1. Who we are and how to read this policy

KnowCore ("KnowCore," "we," "us") provides software that churches use to manage check-in and attendance, people, discipleship and growth, ministry depth charts, pastoral care, prayer, community needs, and member engagement (the "Service"). KnowCore is operated by Greg Bolewitz, doing business as KnowCore, 1260 Freeport Road, Kittanning, PA 16201, USA. This policy covers the Service (the admin console, member-facing pages at each church's KnowCore address, and our APIs) and our public website at knowcore.app.

The Service is offered to churches. Two kinds of information are involved, and our role differs for each:

• Churches and their administrators (our customers). When a church signs up and uses KnowCore, we act as a data controller for the church's account, billing, administrator, and website-visitor information. Sections 2 through 7 and 11 through 18 describe that.
• Church members and attendees (data subjects). For information about a church's members and attendees, the church is the data controller and KnowCore is a data processor (under the GDPR and similar laws) and a service provider (under the California Consumer Privacy Act and similar U.S. state laws), acting on the church's instructions. If you are a church member and want to access, correct, or delete your information, please contact your church first — they control that data. We will assist the church in fulfilling your request. A Data Processing Agreement is available at https://knowcore.app/dpa.

By using the Service or our website, you agree to the collection and use of information as described in this policy.

2. Information we collect and how

From churches and administrators

• At sign-up and in the admin console: name, email address, phone number, mailing address, church name and address, role, login credentials (via Google sign-in or email/password through Firebase Authentication), and, for paid plans, subscription and billing details (payment card details are collected and stored by Stripe, not by us).
• When you contact us: anything you include in a support request, ticket, form, demo booking, or email. We use it for the purpose you sent it.
• On our website (knowcore.app): if you request access, download a guide, or book a demo, the name, email, church, and details you enter; and the analytics data described in Section 6.

About church members and attendees (on behalf of the church)

Which of these a church collects depends on the features it turns on:

• Identity and contact: name, email, phone, mailing address, household and family relationships, campus.
• Profile: date of birth, anniversary date, and a profile photo or selfie (if provided), and profile updates a member submits through "Update my info."
• Participation and engagement: check-in and attendance records, streaks and milestones, reward points and redemptions, badges, reading-plan progress, scripture-memory progress, sermon notes a member saves, prayer requests and prayer activity, responses to community needs, meal-train claims, and self-reported support of missionaries.
• Growth and serving (visible to church leaders only): discipleship and spiritual-gifts assessment responses, discipleship intentions and matches, ministry depth-chart placements, statuses, growth and leadership plans, materials completed, and volunteer clearance status (for example a background check recorded by the church or synced from its screening integration).
• Pastoral care (restricted to the church's care team): care cases, touchpoints, and notes. Care notes are encrypted with a per-church key (Section 9).
• Sign-in and devices: a one-time verification code sent to the member's phone (SMS) or email, an optional passkey (Face ID, Touch ID, Windows Hello) device credential, and a device cookie used to recognize a returning member; NFC tag identifiers when a church uses tags.

Sensitive information. Some of this may be considered sensitive under privacy laws — for example religious participation, prayer requests and care notes that may mention health or personal circumstances, information about children, and volunteer screening status. We process it only to provide the Service to the church and at the church's direction, and we limit access as described in Section 9.

Collected automatically

• Technical and usage data: IP address, device and browser type, operating system, pages and features used, timestamps, referring page, and error and performance logs. We use this to operate, secure, debug, and improve the Service.
• Cookies and local storage: see Section 6.

From integrations you connect

When a church connects a third-party service (Section 7), we receive the data that integration is designed to exchange — for example people, teams, and screening status from Planning Center Online, or list membership from a text-messaging provider. We do not receive data from an integration unless the church has enabled it.

When you use AI-assisted features

Questions typed into Insights or the help assistant, drafting requests in the depth chart, member-submitted content that is screened automatically, and any ratings or feedback you give on AI output. Section 4 explains what is sent where.

3. How we use information

• To provide, operate, secure, and maintain the Service for the church.
• To authenticate users and protect accounts (verification codes, passkeys, sign-in checks).
• To send transactional and Service-related messages (for example verification codes, prayer and need notices, reminders the church configures, password resets, billing receipts, security and product notices).
• To screen member-submitted content (for example prayer requests) automatically before the church publishes it, and to provide the AI-assisted features described in Section 4.
• To provide customer support, respond to requests, and troubleshoot problems.
• To process billing, subscriptions, and orders, and to comply with tax and accounting obligations.
• To detect, prevent, and investigate abuse, fraud, security incidents, and violations of our Terms.
• To understand how the Service is used, in aggregate, and to improve it.
• To send churches and prospective churches product news, onboarding help, and offers (you can unsubscribe at any time; see Section 5).
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use church or member data, prompts, or AI output to train our own or any third party's AI models.

4. AI-assisted features

Some features use a third-party large language model (currently Google Gemini). What is sent depends on the feature:

• Insights. Your question is sent to the model so it can be turned into a structured filter. Your member roster is not sent to the model; the filter is then run on our own servers against your data, and the matching members are shown to you.
• Help assistant. Your question and excerpts of our product documentation are sent to the model. Conversation transcripts may be reviewed by our support team to answer you and improve the documentation.
• Drafting aids (for example depth-chart position descriptions, growth and leadership plans, and resource suggestions). The relevant position, ministry, and plan context — which may include a person's name, status, and plan notes — is sent to the model to produce the draft. You review and edit every draft before it is saved.
• Content screening. The text of member submissions (for example prayer requests) is sent to the model or to a content-classification service to flag content for the church's review. Where a church enables it, prayer requests may also be scanned to suggest pastoral follow-up to the church's care team.

Our AI provider is contractually prohibited from using this content to train its models and from retaining it beyond what is needed to return a response. We keep logs of AI usage (feature, time, and usage volume) for billing and abuse prevention, and we may keep prompts and output for a limited period to troubleshoot problems, after which they are deleted or de-identified. AI output can be inaccurate; our Terms of Service explain your responsibility to review it.

5. Text messaging and email

• Verification codes. When a member asks to sign in by phone, we send a one-time code by SMS through our SMS provider. We store the phone number, the fact that a code was sent, and the result. Message and data rates may apply. Opt-in information collected for these codes is not shared with third parties for their own purposes.
• Church-to-member texting. If a church connects a text-messaging provider, the church is the sender and that provider's privacy policy applies to messages sent through it. At the church's election, we push contact details and list membership to that provider so the church can message its people. Members can opt out by replying STOP to the church's messages or by asking their church.
• Email to members. Emails the Service sends to members (for example a prayer-request update, a need response, or a reminder the church configured) are sent on the church's behalf through our email provider and may be sent from the church's own email domain where the church has set that up. Replies go to the church.
• Email to churches and prospects. We send administrators Service-related email (which you cannot opt out of while you have an account) and product news, onboarding sequences, and offers through our marketing-email provider (which you can leave with the unsubscribe link in any such email or by contacting us).

6. Cookies, analytics, and "Do Not Track"

• The Service (admin console and member pages). We use strictly necessary cookies and browser storage to keep you signed in, remember a member's verified device, and remember interface preferences (for example the page you were on). We do not use advertising cookies in the Service, and we do not run third-party analytics on member pages. Error monitoring (Sentry) may record technical details of an error, including the page and browser involved.
• Our public website (knowcore.app). We use Cloudflare Web Analytics (cookieless) and, to measure our own marketing, Google Analytics 4, Google Ads conversion tracking, and the Meta (Facebook) Pixel. These set cookies or similar identifiers, record pages visited, and may report when a visitor takes an action such as requesting access or booking a demo. We do not combine website analytics with member data from the Service. You can limit this tracking with your browser settings, the Google Analytics opt-out browser add-on, and Meta's ad preferences. Where a consent banner is required by your location, we will only set non-essential cookies after you accept.
• Do Not Track and Global Privacy Control. Our website does not currently respond to browser "Do Not Track" signals, for which there is no accepted standard. Because we do not sell or share personal information for targeted advertising, a Global Privacy Control signal does not change how we treat your data; you may still contact us to exercise any right in Section 11.

7. How we share information

We share personal information only as described here. We do not sell it.

Sub-processors and service providers. We use vendors to run the Service, under contracts that require them to protect the data and use it only to provide their service to us. The current list (also Annex 3 of the DPA) is:

We will give churches at least 30 days' notice before adding a sub-processor that will process member data, by email to the account owner or a notice in the Service.

Integrations you choose. When a church connects a third-party service, we exchange data with it as that integration requires. Current integrations include Planning Center Online (people, teams, attendance, profile updates, and screening status, two-way at the church's election), Clearstream (text messaging: contacts and list membership), and hardware control tools such as Bitfocus Companion and Elgato Stream Deck (which call our API with the church's key). Those services' own privacy policies govern what they do with the data, and the church should review them.

Within your church. Information about members is visible to the church's administrators and leaders according to the permissions the church sets. Some information members submit is shown to other members or the public where the church publishes it (Section 8).

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify churches before their data becomes subject to a different privacy policy.

Legal and safety. We may disclose information if required by law, subpoena, or a valid request from a public authority; to enforce our Terms; to protect the rights, property, or safety of KnowCore, our customers, members, or the public; or to detect and address fraud, security, or technical issues. Where permitted, we will tell the affected church.

8. Public and shared content

Some features let a church publish member-submitted content to its community or the public, such as a prayer wall, a community-needs board, meal-train sign-ups, or a landing page. What is published, and to whom, is controlled by the church's settings and moderation. Content a member chooses to share to a public page may be seen by anyone with the link, and we cannot control what viewers do with it. Members should ask their church about its publishing settings, and can ask the church to remove content they submitted.

9. Security

We protect information using encryption in transit (TLS) and at rest, secret management, role-based access controls, least-privilege service accounts, and logging. Pastoral care notes are additionally encrypted with a per-church data key managed in Google Cloud KMS, so they are stored only as ciphertext, including in backups. Member-facing access is protected by email or SMS verification and optional passkeys; sensitive leader-only data (depth chart, clearances, care) is never exposed to member pages. Administrators can restrict what each user in their church can see.

No method of transmission or storage is completely secure. If we learn of a breach affecting personal information we hold, we will notify affected churches without undue delay, and authorities and individuals as required by law, so that the church can meet its own obligations.

10. Data retention

• Active accounts. We keep church and member data for as long as the church's account is active and as needed to provide the Service.
• Individual erasure. When a church erases a member, that person's records are permanently deleted from live systems and purged from routine backups within 14 weeks, except as noted below for safeguarding records.
• Cancellation or lapse. If a church deletes its account, all of its data is deleted immediately and irreversibly from live systems and purged from backups within 14 weeks. If a subscription lapses or is cancelled without deleting the account, we keep the data for up to 90 days to allow reactivation, after which we may delete it.
• Safeguarding / background-check records. Where a church uses the Service to record volunteer clearances (for example background checks, child-safety training, or other credentials it requires for people who serve), those clearance records and any documents the church uploads are treated as the church's compliance and safeguarding records. Because churches are typically obligated to keep proof that the people serving in sensitive roles were screened, these clearance records and documents are retained even when an individual member is otherwise erased — they are archived to the church's clearance records rather than deleted. They are deleted when the church deletes its entire account, or on the church's specific instruction. This retention is limited to clearance status, dates, who recorded it, and the uploaded documents; it is accessible only to the church's administrators and leaders, never to the member-facing app.
• Logs, usage, and AI records. Technical logs and usage records are kept for up to 12 months for security and troubleshooting; AI prompts and output kept for troubleshooting are deleted or de-identified on the same schedule; aggregate usage statistics may be kept indefinitely.
• Billing and legal. We keep billing records, invoices, tax documents, and records needed to resolve disputes or enforce agreements for as long as the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to know what personal information we hold about you, to access it, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

• Church members and attendees: contact your church to exercise these rights — it controls your data, and the Service gives it tools to export, correct, and permanently delete your information. If you have contacted your church and the matter is not resolved, you may contact us and we will help.
• Churches, administrators, and website visitors: contact us at the address in Section 18. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law.
• Marketing email: use the unsubscribe link in any marketing email, or contact us.

We will not discriminate against anyone for exercising a privacy right.

12. Additional disclosures for residents of the EEA, UK, and Switzerland

• Legal bases. Where the EU or UK GDPR applies: for member data, the church (as controller) determines the legal basis and we process on its documented instructions. For data where we are a controller (accounts, billing, website), we rely on performance of a contract (providing the Service you signed up for), our legitimate interests (operating, securing, and improving the Service and marketing it to organizations), consent (for non-essential cookies and marketing email where required), and compliance with legal obligations.
• Your rights. You have the rights to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. Contact us as in Section 18. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
• Transfers. We are based in, and process data in, the United States, where data protection law may differ from your country's. Where we receive personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses (and the UK Addendum), and the DPA at https://knowcore.app/dpa sets out our processor commitments.

13. Additional disclosures for residents of California and other U.S. states

This section applies where a U.S. state privacy law (for example the California Consumer Privacy Act as amended by the CPRA, or the laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) gives you rights.

• Categories of personal information collected in the last 12 months: identifiers (name, email, phone, address, account IDs, IP address); customer records (billing details, church affiliation); commercial information (subscription and order history); internet and usage activity (pages and features used, device and browser data, website analytics); geolocation inferred from IP address; audio/visual (profile photos, where provided); professional information (role at the church); inferences drawn for product improvement; and, on behalf of churches, the member categories in Section 2, some of which are sensitive personal information (religious affiliation and participation, health-related details in pastoral notes, information about minors, precise account credentials, and background-check status).
• Sources: you; your church; your devices and browser; our vendors; integrations the church connects.
• Purposes: those in Section 3.
• Disclosed for a business purpose to: the vendors and integrations in Section 7, and your church.
• Sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We have no actual knowledge that we sell or share the personal information of anyone under 16.
• Sensitive personal information. We use sensitive personal information only to provide the Service requested by the church, to secure it, and as otherwise permitted by law. We do not use it to infer characteristics about you for other purposes.
• Your rights. You may request to know, access, correct, delete, or receive a portable copy of your personal information, and to limit the use of sensitive personal information. For member data, submit the request to your church (Section 11); we act as its service provider and will support it. For information we control, contact us as in Section 18.
• Verification and authorized agents. We will verify requests by matching the information you provide to what we hold and, where necessary, by confirming through the email on the account. An authorized agent must provide your signed written permission, and we may still ask you to verify your identity directly.
• Appeals. If we deny a request, we will explain why, and you may appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.
• "Shine the Light." California Civil Code §1798.83 lets California residents ask whether we disclosed personal information to third parties for their direct marketing. We do not.
• Equal treatment. We will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right.

14. Children's information

Churches may use the Service to check in and manage information about minors, including young children, at the direction and under the responsibility of the church and with parental or guardian consent obtained by the church. The church is responsible for obtaining any consents required by law (including COPPA where applicable) and for its own child-safety policies. KnowCore does not knowingly collect personal information directly from children under 13 (or under 16 where that is the applicable age) except as a processor on the church's behalf, and our website and marketing are directed to organizations, not children. If you are a parent or guardian and believe a child's information was provided without proper consent, contact the church first; if that does not resolve it, contact us at the address in Section 18 and we will help the church delete it.

15. International data transfers

We are based in the United States and store and process data on U.S.-based infrastructure. If you use the Service or website from outside the United States, your information will be transferred to and processed in the United States. See Section 12 for the safeguards we use for EEA, UK, and Swiss data.

16. Links to other sites and services

The Service and our website may link to sites and services we do not operate, including integrations a church enables and links a church places on its own pages. We are not responsible for their content or privacy practices; review their policies before providing information to them.

17. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated "Last updated" date and, where appropriate, communicated to church account owners before they take effect. Continued use after a change takes effect means you accept it.

18. Contact

Greg Bolewitz, doing business as KnowCore 1260 Freeport Road, Kittanning, PA 16201, USA Email: hello@knowcore.app

Church members: please contact your church first about your data. EEA and UK residents may also contact their supervisory authority (EEA authorities are listed by the European Data Protection Board; the UK authority is the Information Commissioner's Office).