The 99 Privacy Policy

Churches enter people onto rosters and record who attends. We store that for the church and do nothing else with it. We do not sell it, we run no advertising, and we run no analytics or tracking of any kind. We use no AI and send your data to no AI provider. If your information is in The 99 and you want to see it or have it removed, you can write to us directly, even if you never made an account.

Leaders and administrators hold accounts and sign up themselves. Everyone else on a roster, including most youth, is entered by a leader and may have no account at all. The 99 is built for youth ministry, so minors are recorded in it by design.

The church decides who goes on its rosters and what is written about them. We do not choose who is recorded, and we do not contact people on a roster. For the people involved, that means information about you may be in The 99 because your church put it there.

When a leader or administrator creates an account, we collect a name, and either an email address and password or a phone number, depending on how they sign in. Passwords are stored hashed by our authentication provider; we never see them. Some members sign in by text message, which sends a one-time code to their phone.

For a person on a roster we may hold:

• name;
• email address and phone number, where a leader adds them;
• date of birth and whether the person is a minor;
• for a minor, a parent or guardian’s name, email, and phone number;
• free-text notes a leader writes about the person;
• a record of attendance over time;
• messages sent in a group’s chat, where the church uses that feature.

The notes and the chat are free text. A leader can write anything there, and we do not read or filter it. If you lead a group, treat those fields with care: write only what serves the ministry, and keep out health details or family circumstances that do not need to be recorded.

A parent or guardian’s contact details are kept apart from the rest of a roster and are visible only to the church’s leaders and administrators, and to the person themselves. A regular member of the church cannot see another person’s parent contact information.

Be clear-eyed about what a church roster and its attendance history are: together they are, in practice, a record of religious participation for named people. We treat them accordingly, as sensitive information, and we use them only to provide The 99 to that church.

The 99 is not for children under 13. We do not knowingly let anyone under 13 create an account, and a church should not enter a child under 13 onto a roster. If we learn that we hold information collected from a child under 13, we will delete it. If you believe a child under 13 is in The 99, write to us at support@the-99.co and we will remove it.

For minors aged 13 and older, a parent or guardian may ask us what The 99 holds about their child and ask us to remove it. You can write to us directly, as described below.

We use a small number of service providers. Each handles information only to provide its service to us, and none of them receives this data for their own purposes:

• Supabase — accounts, database, and file storage.
• Vercel — hosting. Receives standard server-log information such as IP address and the page requested.
• Stripe — subscription payments for churches. Card details go to Stripe directly and never touch our systems; we keep only Stripe’s identifiers and a subscription’s status.
• Twilio — sends the one-time codes used for signing in by text message.
• Sentry — error reports. Configured not to collect personal information, with emails and phone numbers stripped from error text before it is sent, and with session recording turned off.
• Web Push — delivers browser notifications to members who turn them on.

Some Elo Labs staff can see customer data in order to operate and support the product.

We do not sell your information or share it for anyone else’s marketing. We run no analytics and no advertising trackers anywhere in The 99. There is genuinely nothing of that kind in our code. The 99 uses no artificial intelligence and sends nothing to any AI provider. The only cookies we set keep you signed in.

We keep information while a church’s account is open and for as long as it is needed to provide the product. A church can remove a person from its roster, and can ask us to delete its account. When an account is deleted we remove its data, apart from anything we are required to keep. Attendance history may be retained for a church’s own records until the church removes it.

Colorado law gives residents the right to access, correct, delete, and obtain a copy of personal data we hold, and to opt out of its sale or its use for targeted advertising. We do neither. Colorado also treats information about religious beliefs, and information from a known child, as sensitive, and we handle it on that footing. Similar rights apply if you are in California. If you are in the European Economic Area or the United Kingdom, you have rights of access, rectification, erasure, restriction, portability, and objection.

You do not need an account to ask, and you do not have to go through your church first. If your information is in The 99 because someone entered it, you can still write to us, and we will not treat you differently for asking. Because a church controls its own roster, we may also point you to your church, but you are free to start with us.

We take reasonable measures to protect what we hold, including keeping parent and guardian contact details restricted to a church’s leaders. No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your information, we will tell you as the law requires and as plainly as we can.

If we change this policy, we will post the revision here and update the date above. If we ever start using this information in a way this policy does not describe, we will say so before we do.

Questions, or a request about your information, including on behalf of a child: support@the-99.co.