Effective 18 September 2026 · Updated 31 October 2026 · Applies to the congregation.app sites and the Congregation Maps app for iPhone, iPad and Android
Congregation.app gives each congregation its own private site for scheduling, territory maps and ministry records, and an app that carries the territory maps into the field. This page explains what information those tools hold, who can see it, and the choices you have.
Congregation.app is built and hosted by Onsitech (“we”, “us”). Each congregation that uses it has its own site, at an address under congregation.app or a domain of its own choosing, and its information is kept separate from every other congregation's.
Your congregation decides who gets an account, which territories and records exist, and how long they are kept. In privacy terms your congregation is the controller of that information and we process it on the congregation's behalf. The sites are invitation-only: there is no public sign-up, and accounts are created by your congregation's coordinator.
For questions about what your congregation has recorded, or to have something corrected or removed, start with your coordinator. We will always help, and you can also contact us directly using the details at the end of this page.
Territory maps and interest records are about householders, not about you. When you record a visit, an interest, or a note, that information describes another person. It is visible to the publishers and admins your congregation has given access to, and to nobody else.
Enter only what your congregation's guidelines allow and what the person would reasonably expect. Keep notes factual and brief.
The app asks for your location the first time it needs it: when you first open a map on iPhone and iPad, or first use the location button on Android. It uses your location only while you are using the app. Your phone lets you say no, and everything except the “where am I” features keeps working.
Your location is used to show your position on the territory map and to sort your interests by distance. While a territory map is open, your position is also shared live with the other publishers who have that same territory open, so a group working together can see where each person is. That live position is relayed through our realtime messaging provider and is not written to your congregation's database. Close the map and sharing stops.
Your location is never used for advertising, never sold, and never shared outside the people working the same territory.
The Congregation Maps app is built to work without a signal. To do that it keeps, on your device:
Territories that leave your list are cleared from the device after seven days. Signing out removes everything the app keeps for your site, and the site forgets the device's push address: the sign-in token, your territories, addresses, interests and notes, and the downloaded map tiles. The same happens the next time the app connects if your account is removed. Deleting the app removes everything. On Android, what the app keeps is left out of Google's device backup and of transfers to a new phone. Changes you make offline are queued on the device and sent to your congregation's site when you are back online; if you sign out before they are sent, they are lost, and the app warns you first.
We use a small number of providers to run the service. Each receives only what its job requires, and we use only providers whose terms require them to protect it to at least the standard of this policy.
| Provider | What it does | What it receives |
|---|---|---|
| Hosting and backup providers | Run the sites and keep encrypted backups | All site data |
| Email delivery provider | Sends account, reminder and assignment emails from your site | Your email address and the content of each message |
| Mapbox | Draws the maps and serves map tiles | Map requests, including the area you are viewing. The Mapbox software in the app also collects anonymised usage and location statistics by default; the (i) button on any map lets you turn that off. |
| Ably | Realtime updates and browser notifications | Update signals so the app and open pages refresh promptly, your notifications (title and text), and live positions of publishers while a territory map is open |
| Apple | App distribution for iPhone and iPad, Look Around street imagery, notifications | The coordinate you view in Look Around. If you allow notifications, each notification's title and text and your unread count, on their way to your device. Apple holds an undelivered notification for up to a day. |
| App distribution for Android, Street View imagery, notifications | Google Play installs and updates the Android app under Google's own terms. Street View sends Google the coordinate being viewed. If you allow notifications, each notification's title, text and link, and a signal when you have read one, on their way to your device. Google holds an undelivered notification for up to a day. | |
| Web font and code library services | Deliver fonts and code libraries used by some site pages | Your IP address and browser details, as with any web request |
Your congregation's site and its backups are stored in Australia. Some of the providers above operate outside Australia, mainly in the United States and the United Kingdom, so what they receive may be handled there. Coordinators can ask us for the current list of providers.
Your congregation's records stay for as long as the congregation uses the service and keeps them. Coordinators can remove interests, notes and accounts at any time. When a congregation closes its site, its data is deleted.
We handle personal information in line with the Australian Privacy Principles. If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
All traffic between your device and the sites is encrypted with HTTPS. Passwords are hashed, passkeys use your device's own lock, such as Face ID, Touch ID or a fingerprint, and every request is checked against the permissions your congregation gave you. Each congregation's data is kept separate, so one congregation can never see another's. Access to the servers is limited to the people who operate them.
When this policy changes we will update the date at the top of this page. Significant changes will also be announced on your congregation's site.
Questions or requests: privacy@congregation.app