Privacy Policy

Overview

We run a public Christian event directory. We collect what we need to operate that directory, run accounts, send messages you ask for, and understand how the site is used. We do not sell personal information. We do not use analytics data for third-party advertising.

Information you provide

• Launch notifications. If you ask to be notified when the site launches, we store your email for that purpose.
• Listing requests and support. If you email us to add an event or ask a question, we receive whatever you send (typically name, contact details, and event information).
• Accounts. Email address, optional display name, a hashed password if you set one, whether you signed up to submit events or represent an organizer, and invite details if you used an invite. We send sign-in codes, verification, and password-reset messages to your email.
• Profile preferences. A default search location, and optional email-update choices (opt-in, weekly or monthly cadence, event types and denominations). Those choices are saved for when email updates are available. We do not currently send those digest emails.
• Inquiries. If you message an organizer from a listing, we email them your message plus your name and email so they can reply. We store that you sent an inquiry (which listing, which account, when) so we can rate-limit abuse. We do not store the message body in that log.
• Organizer listings. Event details and images you upload. Listing pages are public.

Information collected automatically

We use first-party analytics (stored by us, not sold to ad networks) to count visits, see which listings people open, and improve the Service.

• Pages and actions. Page views and product events such as searches, filter changes, listing impressions and clicks, Featured impressions and clicks, outbound clicks to organizer sites, and notify-me signups.
• Search text. If you search, we may store the query (trimmed, up to 200 characters). We drop values that look like an email address or phone number.
• Anonymous visitor id. A random identifier in a first-party cookie named `visitor_id` (about 90 days, refreshed when you visit). It is not your name or email. It lets us count unique browsers and connect actions in the same browser. We set this cookie when you browse the Service.
• Session id. A random id in the browser’s session storage for the current tab, used to group analytics events.
• Signed-in analytics. If you are logged in, analytics events may also include your account id.
• Approximate location. Country, region, and sometimes city, derived from your IP address using our host’s headers and/or ipapi.co. We do not store raw IP addresses in our analytics database. We may process IP briefly for geolocation, rate limiting, and abuse prevention.
• Location cookie. A short-lived cookie named `visitor_geo` (about one hour) may store only country, region, and city so we do not repeat IP lookups on every request.
• Map and “Your location.” City or address search may be sent to Nominatim (OpenStreetMap) to resolve a place. If you opt in to browser location for the map, the page uses those coordinates to set the visible map area; those map bounds may appear in the page URL. Viewing a map loads tiles from OpenStreetMap, which may see your IP address.
• Technical details. Timestamps and the path you came from on our own site, as needed for aggregates and debugging.

Cookies and similar technologies

We use cookies and similar storage for:

• Necessary. Sign-in session and security. If we give you a preview link before public launch, a cookie lets you see the full site. A short-lived cookie may show a confirmation after you create an event.
• Analytics. `visitor_id` and `visitor_geo`, described above.

We do not currently use cookies to build an interest profile or to reorder Featured or promoted listings based on your browsing. We do not currently offer a cookie preference center. You can block or delete cookies in your browser; clearing cookies resets `visitor_id`. Sign-in will not work without necessary cookies.

Information from public websites

To build the directory we collect event information that organizers (or their platforms) have posted publicly — for example titles, dates, places, and links. That is public listing content, not a profile of you as a visitor. See the Terms of Service for how we treat copyrighted descriptions and images.

How we use information

• Operate the directory: search, maps, event pages, Featured placements, and organizer tools
• Create and maintain accounts, send sign-in codes and other transactional email
• Forward inquiries you choose to send, and prevent abuse of that form
• Send launch notifications you requested
• Honor profile preferences, including future event-update emails only if you opt in
• Measure how the Service is used (including Featured cards) and improve it
• Protect the Service (rate limits, security) and comply with law

How we share information

We do not sell, rent, or trade personal information. We share information only as follows:

• Organizers. Inquiry messages include your name and email. Listings and images you submit are public.
• Service providers that process data for us (see below).
• Legal. If we are required to by law or to protect rights, safety, or the Service.
• Aggregates. Counts and trends that do not identify you may be used internally (for example how a listing performs).

Service providers

We use vendors to run the Service. They process information only to provide their services to us. Examples:

• Hosting and database providers that store the website, accounts, listings, and analytics
• Transactional email (currently Amazon SES, and sometimes a similar provider such as Resend or Brevo) for sign-in codes, inquiries, and notifications
• Cloudflare R2 for organizer event images
• ipapi.co for approximate IP-based location
• Nominatim / OpenStreetMap for geocoding addresses and map tiles

We currently operate the Service from the United States. If you use it from another country, your information may be processed in the United States.

How long we keep information

• Raw analytics events: about 13 months, then deleted
• `visitor_id` cookie: about 90 days, refreshed on visit
• `visitor_geo` cookie: about one hour
• Aggregated daily counts: kept longer; they are not tied to your name
• Accounts, profile preferences, and listings: until you or we delete them
• Launch-notify emails: until you ask to be removed or we no longer need the list for that announcement
• Inquiry log rows (listing, account, time): kept to enforce rate limits

Your choices and rights

• Update location and email preferences on your Profile page when signed in
• Turn off marketing opt-in on Profile (digest emails are not sent yet)
• Ask us for access, correction, or deletion of account data
• Ask us to remove a listing or stop collecting from a website you operate
• Clear cookies to reset the anonymous visitor id
• Opt out of launch notifications by emailing us (there is no self-serve unsubscribe link on that form today)

We do not currently offer a self-serve account-deletion button. Email privacy@christianthingstodo.com and we will help. We may retain limited records we need for security, rate limiting, or law.

Children

The Service is not directed at children under 13. Listings may include youth or family events, but we do not knowingly collect personal information from children under 13. Organizers are responsible for their own registration and youth-protection practices.

Security

We use reasonable measures to protect personal information (for example hashed passwords and access controls). No method of transmission or storage is completely secure.

Changes to this policy

We may update this policy as the Service changes. The “Last updated” date at the top will change when we do. Material changes will be posted on this page. If we add interest-based personalization cookies or a cookie preference center, we will describe them here before those features go live.

Contact

Privacy questions: privacy@christianthingstodo.com. Terms questions: legal@christianthingstodo.com.