Security and Privacy

Security and Privacy

Study notes (journals)

• Default: TLS in transit + database encryption at rest (hosting provider standard).
• Optional E2E (later): user opt-in; disables server-side search on encrypted notes; important for users in restrictive regions.
• Offline notes use CRDT sync (Sync and Offline); server holds merge state unless E2E is enabled later.

Church admin visibility

• Default: aggregate metrics only (participation, streaks at church level).
• Individual data: only with explicit user consent.

Audit logging

• Log access to sensitive records for all readers except the owner (mentors, admins, support with policy).

Minors and PII

• Guardians select the minor’s account type, which governs what PII is stored (Identity and Access).
• Collect the minimum needed for the chosen type; minors do not self-submit PII the guardian has not authorized.

Account deletion

See Identity and Access.

• Private study data: deleted.
• Person record: anonymized.
• Forum content: retained; author anonymized as required.
• Shared mentorship threads: content retained; author anonymized.

Identity verification data

When Identity verification ships:

• Retention: Delete ID and face capture media after verification; only brief operational retention for dispute/abuse review (exact window TBD).
• Storage: Encrypt captures in transit and at rest; access restricted to the verification pipeline and break-glass support per policy.
• Church admin: No access to ID media. At most an aggregate or consent-gated “verified member” flag — never scans or document numbers.
• Audit: Log staff access to verification records (see Audit logging).
• Deletion: Follow Account deletion for artifacts and derived ID PII.

Authentication

• Web: HttpOnly cookies (Architecture).
• All app features require login; marketing is a separate site.

Accessibility and i18n (v1)

• English only; structure code for future i18n.
• Accessibility improvements encouraged; include in code review checklist (WCAG not a hard v1 gate).