About this policy
Stoplight is software for churches. It helps clergy and church staff keep track of pastoral care — who has been visited, who is unwell, who has just joined, who nobody has spoken to in a while. This policy explains what the app holds, who can see it, and what leaves the system.
It applies to the Stoplight Ministry mobile app and to the Stoplight web application.
Your church controls its records
Your church controls its own records. Spritz Solutions, LLC builds and operates Stoplight on the church's behalf. We do not decide what goes into your church's records, we do not use them for our own purposes, and we do not share them with anyone outside the arrangement your church has with us.
In data-protection language: the church is the controller and Spritz Solutions is the processor. If you are a parishioner asking what is held about you, ask your church — they hold the record and they can answer. We will help them answer.
Who can use Stoplight
Only church staff and volunteers whose accounts have been created by an administrator at their own church. There is no public sign-up. Every login belongs to exactly one church and can see only that church's information.
Information Stoplight holds
Information your church enters about the people in its congregation:
- Names, contact details, and home addresses
- Dates a church keeps: birthdays, wedding anniversaries, baptisms, and dates of death
- Household membership and family relationships
- Whether someone is a member, a regular attender, or new
- Pastoral care records — that a person is in hospital, bereaved, recovering from surgery, or going through a family crisis, together with notes written by staff
- A record of contact: visits, calls, texts, cards, meals delivered, prayers requested
- Tasks assigned to staff and volunteers, and who completed them
Some of this is sensitive. Notes about someone's health, their family circumstances, or a conversation held in confidence are treated as such — see below.
About the people who use the app, we hold an email address, a name, a role, and which church and ministry teams they belong to.
Who can see what
Stoplight does not show everyone everything, and this is enforced by the database rather than by the screen. If someone is not entitled to see a record, the record is not sent to their device at all.
- Staff see the people and cases belonging to the ministry teams they are on.
- Notes marked clergy-confidential can be read only by clergy, or by someone a church has explicitly authorised. Anyone may write one — so that a person can pass something on in confidence — but writing one does not grant the ability to read it back.
- Administrators can see their own church's records. They cannot see any other church's.
Where information is stored
In a Postgres database hosted by Supabase, in Canada, encrypted at rest and in transit. Access to the production database is limited to Spritz Solutions staff who need it to operate and support the service.
Sign-in is handled by Supabase Auth. We never see your password. Churches may require two-factor authentication for their staff, and we recommend it.
What leaves the system
Crash and error reports
When the app fails we send a diagnostic report to Sentry so the fault can be fixed. These reports are deliberately stripped of anything identifying before they are sent:
- Names, email addresses, phone numbers, addresses, birthdays and note text are removed.
- Web and database addresses are cut back to the shape of the request, so that record identifiers and search terms do not travel with it.
- Screenshots and screen-content capture are switched off, because a screenshot of this app is a picture of somebody's pastoral notes.
- The report identifies the church and the role of the person using the app, and a staff account number — enough to diagnose a fault, not enough to name anyone.
- IP addresses are not stored.
Nothing else
Stoplight contains no advertising, no analytics or tracking software, no social media components, and no third-party code that collects information about you. We do not sell, rent or share congregational information with anyone, and we never use it to train machine-learning models.
If your church has connected Stoplight to another system it already uses — a church management package, for example — information moves between those systems at your church's instruction.
Retention and deletion
Records are kept for as long as your church wants them, because they are your church's records. When a church stops using Stoplight, we delete its data within 90 days of the request, except where we are required to keep something by law.
Deleted records are removed from backups within 30 days.
Your rights
Depending on where you live you may have the right to see what is held about you, to correct it, to ask for it to be deleted, or to object to how it is used. Ask your church first — they control the record. If you would rather come to us, or your church cannot help, write to the address below and we will respond within 30 days.
Children
Stoplight is used by adults on behalf of a church. A church may record a child's name, birthday or baptism date as part of its ordinary parish records, with the consent of a parent or guardian. The app is not intended for use by children and we do not knowingly collect information directly from them.
Changes to this policy
If this policy changes in a way that matters, we will tell the churches using Stoplight before the change takes effect, and update the date at the top of this page.
Contact
Spritz Solutions, LLC
developer@spritzsolutions.com
If you are a parishioner with a question about your own record, your church is the fastest route — they hold it and they can act on it immediately.