Join the beta

Privacy policy

Effective October 21, 2026.

This policy covers Covenant OS (cOS): the cOS account, the free cOS apps, the cOS church plan, Churchgoer and covenantos.com. It says what we collect, what we do with it and the choices you have.

1. The company

Ministry Marketing LLC, doing business as Church Posting, a limited liability company organized in Kansas, makes and runs Covenant OS. This policy calls it "we". Church Posting also publishes churchposting.com, a free resource site for churches with jobs, hymns and guides, which has its own privacy policy at https://churchposting.com/privacy.

Write to us at hello@churchposting.com.

2. What this policy covers

  • covenantos.com and its list for the December 1, 2026 opening
  • the cOS account and sign-in
  • the free cOS apps: Chord Charts, Graphics, Social, Sermon Clips, Websites, Newsletter, Events, Sign-Ups, Prayer Requests and Texting, plus cOS Presenter on the desktop and its phone remote
  • the cOS church plan, the staff app for churches that pay for it
  • Churchgoer, the member app on iPhone and Android for churches on the church plan
  • church websites that Covenant OS hosts, at an address such as {church}.covenantos.com or at a church's own domain
  • texts and emails sent through Covenant OS

Berean Blue (berean.blue/privacy) and cOS Texting at freechurchtexting.com (freechurchtexting.com/privacy) each publish a notice for what is particular to them. Where they use your cOS account, this policy covers the account.

Where this policy describes how a feature handles information, that description applies from the day the feature is available to you, and it binds us from that day.

3. One cOS account

A person signs in to every Covenant OS app with one cOS account, the way one account opens every app from the same company elsewhere. The account holds your name, your email address, your verified sign-in methods and the apps you use.

Each free app keeps its own list in the workspace of the person or church using it. A sign-up sheet in cOS Sign-Ups and a contact list in cOS Texting stay separate. When a church moves to the cOS church plan, the church chooses to bring that work over, and the church plan joins it into one record of each person and household.

Churchgoer is only for members of churches on the cOS church plan. A member sees their own church and nothing from the free apps.

4. Whose records they are

A church that uses Covenant OS decides what it records about its people and how it uses those records. For those records, which this policy calls church data, the church is in charge, and we handle them on the church's instructions. On the church plan, the Data Processing Agreement sets those instructions, and a church accepts it when it starts the church plan. In a free app, the person or church using the app decides what goes into its workspace, and we handle that data only to run the app for them.

A church member who wants to see, correct or delete what a church holds should ask that church. Covenant OS gives every church the tools to answer, and we pass any request we receive to the church it concerns.

We decide how our own records are used, and this policy says how. Our own records are cOS accounts, the people who join our list on covenantos.com, and the people who write to us.

5. What we collect

Church data a church enters or imports

  • People and households: names, contact details, birth dates, membership status, photos, notes and the custom fields a church adds.
  • Giving: gifts, funds, pledges and statements. Card and bank numbers go straight from the giver to Stripe. We keep Stripe's reference, the card brand, the last four digits and the expiry date, and for a bank account the bank's name.
  • Children's ministry: check-in and check-out times, rooms, the adult who dropped off and the adult who picked up each child, allergy and medical alerts, authorized and blocked pickup lists, and custody notes.
  • Care: pastoral care notes, prayer requests, church discipline records and benevolence records.
  • Volunteers: teams, schedules, training records, the result and date of a background check, and any report file the church uploads. We never copy a report from the screening company.
  • Messages: texts and emails sent through Covenant OS, the replies to them, and each person's texting consent and opt-out record.
  • Worship: service plans, songs with their CCLI numbers, chord charts, slides, sermon recordings and transcripts.

Free app workspaces

What a person or church puts into a free app: contacts, sign-up sheets and the names on them, event registrations, prayer requests, newsletters and their recipients, posts, graphics, chord charts, website pages and sermon clips. cOS Sermon Clips works on the video inside your own browser, and the video does not come to our servers.

Account data

Name, email address, phone number if you add one, church role, sign-in records, passkeys and second-factor settings.

Data from services a person connects

When a church imports from Planning Center or another system, we copy the records the church's administrator chose to bring over. A person who connects a Google account gives us the access section 10 describes, for the features that person turned on.

Data about use

The pages and features used, device type, IP address, error reports and security logs.

covenantos.com

When you join our list, we keep the email address you give, and the name, church and role if you add them. We also keep:

  • the app pages you joined from
  • the version of the consent wording you saw, and the time you agreed to it
  • the time you signed up
  • the browser's user agent, a line of text that names the browser and device
  • a code made from your IP address with a secret key, which lets us stop repeated automated signups. We never store the IP address itself.
  • the reference HighLevel gives your contact, and whether our emails to you went out

Your contact in HighLevel holds your email address, and your name and church if you add them.

Our sites load no advertising code. Cloudflare, which hosts them, keeps ordinary request logs.

6. How we use it

We use church data and free app data to run Covenant OS for the church or person it belongs to: storing and showing it, sending the texts and emails they approve, taking gifts through Stripe, running check-in, backing it up, securing it, and giving support when they ask for it.

We use account data and data about use to run, secure and improve Covenant OS, to bill churches on the church plan, and to tell people about their accounts.

We use the covenantos.com list for one purpose: a confirmation email shortly after you join, and one email on December 1, 2026, when the church plan beta and the free cOS apps open. We send both through HighLevel, Church Posting's email system. If HighLevel cannot take your signup when you join, the site keeps it, and a job that runs every 10 minutes tries again, waiting longer after each failure, until HighLevel confirms it. After repeated failures the job alerts our team.

We sell no personal information and use no church data for advertising. Reports that cover more than one church use counts, and they never name a person or show one church's members to another.

7. Drafts and transcripts

Some Covenant OS features use automated software to sort incoming messages, prepare drafts for staff, answer questions in Help and turn a sermon recording into a transcript. When a church uses these features:

  • Children's records, custody notes, health information, background checks and payment details never go to them.
  • Care notes, prayer requests, discipline records, benevolence records and giving records go to them only after the senior pastor opens that kind of record in the church's settings.
  • A named staff member approves each drafted message before it goes to a list. The one exception is an announcement or reminder that a church admin chose to send as a machine-translated copy, which is labeled as a translation. Care, giving, sensitive and children's messages are always reviewed.
  • We do not use church data to develop, train or improve software that learns from data, and we name each provider that runs these features in section 11 before we turn it on.

8. Texts

Two kinds of texts go through Covenant OS, and each has its own consent.

  • Covenant OS account texts: sign-in codes and the account notices a person turns on. The texting terms govern them, and the opt-in page shows the exact words a person agrees to.
  • Texts from a church: a church using cOS Texting or the church plan texts its own people under its own name and its own texting terms, only after the person has agreed to texts from that church.

A reply of STOP ends that sender's texts at once. We keep a record of when and how each person agreed and when they stopped.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Section 11 explains which providers store these records for us, and for what purpose.

9. Email

When a church sends bulk email through Covenant OS, each one carries an unsubscribe link and the church's postal address. Unsubscribing from a church's news leaves its receipts, giving statements and volunteer reminders in place. Covenant OS does not track who opens a church's email or who clicks its links.

Every email from the covenantos.com list carries an unsubscribe link. One click on the button on that page takes you off the list. We then mark your signup unsubscribed in our database, send no more email from this list, remove the covenantos.com list tags from your HighLevel contact and add a tag that keeps you out of the December 1 email. If you unsubscribe at the moment your confirmation email is going out, that one email can still arrive. Other Church Posting email you signed up for carries its own unsubscribe link. You can also reply to either email or write to hello@churchposting.com, and our team takes you off the list by hand.

10. Google and Microsoft accounts

A person can sign in with Google. When the Google features below are available and a staff member connects a Google account, Covenant OS asks for the access each feature needs.

  • Sign in with Google: the person's name, email address and profile photo.
  • Google Drive: only the files the person opens with Covenant OS or picks in Google's file picker.
  • Gmail, sending: sending mail the person writes in Covenant OS from the person's own address.
  • Gmail, inbox: reading, labeling and archiving the messages in the person's inbox, so the person can work them from inside Covenant OS.

Covenant OS's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

For Gmail in particular:

  • Covenant OS reads received mail when the person opens it and stores no text from it. It keeps the mail the person writes in Covenant OS, on the record the person filed it to.
  • No one on our team reads a person's mail, unless the person asks us to look at a specific message for support, or a law or a security investigation requires it.
  • Gmail content is never used to develop, train or improve software that learns from data, ours or anyone else's.
  • Gmail content is transferred to no one, except as needed to run the feature the person uses, to comply with the law, or as part of a merger or sale that section 11 describes.

Microsoft mail and files are planned. The same rules will apply when a staff member connects a Microsoft account.

11. Service providers and disclosures

We use these service providers, each for the part of the service shown beside it.

Provider What it does
Cloudflare Hosting, databases, file storage, queues and sign-in email
HighLevel Church Posting's email system: our own contact list, and the emails we send to people who join our list on covenantos.com
Stripe Card and bank payments for gifts, event registrations and church plan subscriptions
Twilio, or the texting account a church connects Delivering texts and receiving replies
Amazon Web Services Delivering church email through Amazon SES
Apple Push Notification service and Firebase Cloud Messaging Delivering notifications to Churchgoer on iPhone and Android
Backblaze An independent, encrypted backup copy of church data, kept no more than 35 days

Cloudflare and HighLevel run today. We bring each of the others in as the feature that needs it turns on, and we add any new provider to this table and tell church admins before it handles church data.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

In the two carrier sentences in this policy, shared means given to another company for its own use or for marketing. We sell and give consent records to no one for those purposes. Cloudflare stores them as our host, and once the backup copy turns on, Backblaze holds encrypted copies, so that Covenant OS can run and recover. We give them to these providers for that purpose alone.

Planning Center and Google receive or send data only when a church or a person connects them.

We disclose data when a law, subpoena or court order requires it. When a demand asks for a church's records, we send it to that church and tell the church about it, unless a court order forbids us.

If Covenant OS is sold or merges with another company, the new owner takes on this policy for the data it receives, and we tell church admins before the change.

12. Children

Covenant OS is not for children under 13, and our sites are not directed to them. We do not knowingly create a cOS account for a child under 13. If we learn that one exists, we close it and delete its data within 30 days. The covenantos.com list is for adults who lead or serve in churches. A child's record in a church's Covenant OS comes from a parent, a guardian or church staff.

  • Allergy and medical alerts print on the child's label and on the room roster, and they stay out of the directory and out of other households' views.
  • Custody notes are visible to the kids director, the senior pastor and anyone the church gives the pastor role, and every read is logged.
  • A parent's pickup tag prints a random code, a signed QR code, the church's name and the date, and no child's name.
  • A child's photo stays out of the directory by default.

13. Care records and prayer requests

Care notes, health details and custody notes are encrypted one field at a time, and each kind of record has its own role. A person who sends a prayer request chooses who may read it, and the pastors are the default. In cOS Prayer Requests, a request from someone under 18 goes to the pastors only. Every read of a care note or custody note is logged, and the senior pastor can review the log.

14. Security

  • Each church's data sits in its own database.
  • Staff confirm a passkey or an authenticator app before they open church records. A text code alone never opens them.
  • Care notes, health details and custody notes are encrypted one field at a time. Every read of a care note or a custody note is logged, and each role opens only the kinds of records the church gives it.
  • No backup copy of church data is kept more than 35 days.
  • Church Posting support opens a church's records only with access the church approves for one support case and a set time of no more than 72 hours. The church's owner, an admin or the senior pastor approves it. When that access would read children's records or a sensitive kind of record, a second person at Church Posting must approve it too. The approval, and every read under it, is logged. A legal demand under section 11 or a breach under section 15 follows the steps those sections describe.
  • No Covenant OS system stores a card number or a bank account number.

15. Breach notice

If we determine that church data was exposed to someone who should not have it, we tell the church's admins within 72 hours of that determination, with what we know at the time, and we help the church notify its people as the law requires.

16. How long we keep it

  • Church data stays while the church uses Covenant OS, except where a period below ends sooner, and a church can export all of it at any time in open formats. A church can keep any record longer than the period below.
  • Giving records stay 7 years after the end of the gift year.
  • Check-in, check-out and pickup records stay until the child's 25th birthday. Incident reports stay for the life of the church's account. Custody notes and pickup blocks stay while they are in force, and then until the child's 25th birthday.
  • For a background check, the result and its date stay for the life of the church's account, and a report file the church uploads stays 5 years after the decision.
  • Messages stay for the period the church chooses, from 90 days to 7 years, and 2 years if it chooses none. Messages in a youth room and messages someone reported stay at least 3 years.
  • Help conversations stay 180 days, unless the church sets a period from 30 to 365 days.
  • We keep proof of texting consent and opt-out for 4 years after the last message or the opt-out, whichever is later, because carriers and the law can ask for it. The opt-out itself stays on file while the church uses Covenant OS, so that number or address never gets that church's messages again.
  • When a church closes its account, the account stays read-only for 30 days so the church can export it, and the export lists the giving, safety and consent records the church should keep and the date it may discard each. On day 30 we delete the church's records, and every backup copy expires by day 65. Three kinds of record stay with us after day 30, each with its end date and reason recorded: our own billing records for the church, for 7 years after the billing year; proof of consent for texts sent under our texting registration, for 4 years after the last message; and any record under a legal hold, until the hold is released.
  • When a person's records are erased, three kinds stay, each until its period above ends: records under a legal hold, the giving records the church has to keep for tax purposes, and child-safety records. A legal hold stops the erasure until a pastor and an admin release it. When a child-safety record names the person, the person's name and birth date stay sealed, readable only by the church's safety role, until the last of those records expires. The erase screen lists what stays and until when before the church erases the rest.
  • The covenantos.com list ends on December 31, 2026. If you unsubscribe sooner, we keep your email address and the time you left until then, so the list does not write to you again, and that record is deleted with the list. After December 31, a scheduled job removes the covenantos.com list tags from your contact record in HighLevel and deletes your signup from our database. The job does not delete the HighLevel contact record itself, which keeps any other tags and lists it has. That contact stays in Church Posting's HighLevel account until you ask us to delete it, as section 17 describes. A change sent to HighLevel can reach it late, so for up to 7 days we keep your email address, your HighLevel contact reference and the time your signup was removed. At least 24 hours after that removal, the job looks up your contact again, removes any covenantos.com list tag it finds, and deletes that last record. If that second step keeps failing for 7 days, the job deletes that last record anyway and logs the failure for our team.
  • Our own billing records stay 7 years after the billing year.

17. Your choices and rights

  • Church members: ask your church to see, correct, export or delete your records.
  • cOS account holders, free app users and site visitors: write to hello@churchposting.com to see, correct, export or delete your data. We confirm that we received your request and answer within 30 days. Depending on your state, you can appeal our answer by writing to the same address with "Appeal" in the subject line.
  • Texts: reply STOP to any text.
  • Email: use the unsubscribe link in any email from our list or in any bulk email a church sends through Covenant OS. You can also reply to an email from our list, and our team takes you off by hand.

We sell no personal information and run no targeted advertising, so there is no sale or targeted advertising to opt out of.

18. Changes to this policy

We email church admins and cOS account holders at least 30 days before a material change takes effect, and the effective date at the top of this page changes with each version.

Effective October 21, 2026. This version replaces the policy of October 13, 2026.