DRAFT. This is for Michael's review only. Do not publish. This is a working draft, not legal advice. Please have a qualified attorney review it before it's used, especially the sections on sensitive data, subscriptions, retention, and CCPA/GDPR. This policy covers the iOS App only. Bracketed items need a decision or a confirmation.

BATON iOS App: Privacy Policy

Draft, Oct 23, 2026

1. Introduction

BATON ("we," "us," or "our") is committed to protecting your church's data. This Privacy Policy explains what information the BATON app for iPhone and iPad (the "App") collects, how we use it, and how we protect it. Questions or concerns? Contact us at mike.tanner@baton.website.

2. Demo Mode

You can explore BATON through the Live Demo without creating an account. The Live Demo uses sample data for a fictional church, "Covenant Community Church."

• Demo data is stored only on your device. It is never sent to our servers or to anyone else.
• We collect no personal information in Demo Mode.
• You can clear demo data at any time from More > Reset demo data, or by deleting the App.

3. Accounts and Sync

When you create an account, you get your own private workspace and church profile. Workspaces aren't shared with other users. We ask you to confirm your email address before your account becomes active. Your workspace is stored and synced through our hosting provider, Google Firebase (Firebase Authentication and Cloud Firestore), so you can use it on more than one device.

What we collect when you're signed in:

• Email address and password, used for your login account and the email confirmation step. We don't collect your name. Firebase Authentication stores your password in protected form, and we never see it.
• Church profile: church name, church city, church state, denomination, and congregation size.
• Workspace content you create:

- task status

- candidate assessment scores and saved composite scores

- prayer reflections you add

- Getting Started checklist progress

- timeline setup (length and start date)

- your role preview choice

• Account and security data handled by Firebase:

- Firebase Authentication generates an account identifier.

- It uses your IP address and device user-agent information to secure sign-up and sign-in and to prevent abuse. Firebase states that it keeps logged IP addresses for a few weeks.

- Firebase SDKs may also send Google a technical "user agent" (device, operating system, app bundle ID, and platform). Firebase states this is never linked to a user or device identifier.

Candidate profiles and documents in the App are sample content built into the App. They aren't uploaded to or synced with our servers.

Sensitive information. Prayer reflections, your church's denomination, and candidate assessment scores may reveal religious or philosophical beliefs. We treat this content as sensitive and use it only to provide the App's functionality to you.

How we use it. We use this information only to provide the App's functionality:

• signing you in and confirming your email
• storing and syncing your workspace
• verifying your subscription
• keeping the service secure

We do not use it for analytics, advertising, or any other purpose. The App contains no analytics, advertising, or crash-reporting tools.

Where it's stored and how it's secured.

• Your data is stored with Google Firebase.
• Firebase states that it encrypts data in transit using HTTPS, and that Cloud Firestore and Firebase Authentication also encrypt data at rest.
• Security rules limit your workspace so that only you, signed in to your account, can access it.
• You can lock the App with Face ID (Section 6). Face ID is handled entirely by your device, and we never receive your face data.
• Signing out clears your data from the device. The synced copy stays in your account until it's deleted.

Data you share from the App. You can export or share documents with the iOS share sheet, for example by email, through Messages, or by saving to Files. Once shared, those copies leave BATON and are controlled by you and the app or person you shared them with. They're subject to those services' privacy terms, and deleting your BATON account doesn't delete them.

Sharing. We do not sell your data. We share it only with our service providers:

• Google Firebase, which hosts and authenticates.
• Apple, which processes subscriptions (Section 4).

We also share data when required by law or a court order, or to protect against fraud or harm. We do not share your data for marketing or advertising.

4. Subscriptions and Payments

BATON's full workspace requires an annual subscription purchased through Apple's App Store as an in-app purchase. Apple processes all payments.

• We never receive your card or payment details.
• We receive only the subscription information that Apple provides to confirm your access, such as the product purchased, its status, and its renewal and expiration dates.
• You manage or cancel your subscription in your Apple ID settings (Settings > [your name] > Subscriptions).
• Use Restore Purchases in the App to restore an existing subscription.

5. Deleting Your Account in the App

You can delete your account at any time from inside the App, as Apple's App Store guideline 5.1.1(v) requires.

How:

1. Go to More > Account > Delete Account.

2. Confirm the deletion when asked. This step is permanent and can't be undone.

You don't need to email us. You can still contact mike.tanner@baton.website if you need help.

What gets deleted, and when: Deletion happens immediately, with no waiting period. It removes your login account, your church profile, and your workspace data, and data on your device is cleared too.

• Backups: Our current hosting plan doesn't keep managed database backups, so deleted workspace data can't be recovered.
• Firebase's own processes: Firebase states that after an account is deleted, authentication data is removed from its live and backup systems within 180 days, and that logged IP addresses are kept for a few weeks.

Only your data is affected. Workspaces aren't shared, so deleting your account affects only your own login, profile, and workspace data. If shared multi-member workspaces are added in the future, deleting a member's account will remove only that member's own access and content.

Important: deleting your account does not cancel your subscription. Apple bills subscriptions. To stop future charges, cancel in Settings > [your name] > Subscriptions before or after you delete your account. The App shows this reminder during deletion.

6. Face ID and Device Permissions

The App can be locked with Face ID if you turn this on. iOS asks for your permission the first time. Face ID matching happens on your device, and BATON never receives biometric data. You can turn the lock off in the App or in iOS Settings.

The App doesn't send push notifications. Apart from Face ID, it doesn't ask for access to any device features: no camera, photos, location, contacts, calendar, or microphone.

7. No Tracking, No Ads

• BATON shows no advertising.
• It uses no analytics tools (we don't include Google Analytics for Firebase), and no advertising pixels or behavioral tracking.
• We do not sell your data.
• We do not track you across other companies' apps or websites. That's why the App never shows Apple's App Tracking Transparency prompt.

8. Retention and Account Cleanup

• Active accounts: Your data stays in your account while your account exists.
• Accounts whose subscription has ended:

- Each month, we review a report of accounts whose subscription has ended.

- We delete an account and its data only after its subscription has ended [DECISION NEEDED: the grace period after expiration before deletion, for example 90 days, and whether you're emailed first].

- We never delete an account while its subscription is active.

• Your choice comes first: You can delete your own account immediately at any time (Section 5). This cleanup process doesn't delay or replace it.

9. Children's Privacy

BATON is designed for church leadership professionals and is not intended for use by individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has given us information, contact us and we will delete it.

10. Your Rights

You have the right to access, correct, or request deletion of your personal information, and you can delete your account directly in the App (Section 5). Depending on where you live, laws such as the California Consumer Privacy Act (CCPA) or the EU/UK General Data Protection Regulation (GDPR) may give you more rights, including:

• Data portability.
• Objecting to or restricting processing.
• Withdrawing consent.
• Not being discriminated against for exercising your rights.

We do not sell or "share" personal information as the CCPA defines it. To exercise these rights, contact us at mike.tanner@baton.website. [Legal review: the GDPR legal basis and explicit consent for sensitive (religious) data, and international transfers to Google's servers.]

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify account holders of material changes by email. The date at the top of this page shows when the policy was last updated.

12. Contact

Privacy questions or concerns should be sent to: mike.tanner@baton.website. App support: info@baton.website.