Privacy Policy

What we collect

• Your sign-in identity (Google profile, email, or a linked Planning Center account).
• The questions you ask and the AI's answers.
• Your progress through a sermon's devotional (which days you mark complete).
• Bookmarks you save.
• Problem reports you submit, including the content you reported and your identity (so admins can follow up).
• How far through a sermon you listened, so you can pick it back up.
• How far through a sermon you read, and whether you finished it, so you can pick it back up. The page you reached is yours alone — no church surface shows it.
• The terms you search for.
• Needs you send to your church's needs wall, if your church uses one — the text and the initials shown on the card.
• Your private-group membership and invitations, and the praises and prayer requests your group chooses to keep — including the text and the name of the person it is for.
• If a group leader links a Planning Center group, the names and available email addresses on that group's Planning Center roster, and its scheduled event information. Rewind uses this data to display the group roster, match existing members, offer invitations, and show a Church Center handoff when an event is scheduled tonight. A shared roster snapshot expires after 20 seconds; Rewind does not keep it in the church database.
• During a live Together night, the names members mark present and any guest names they add. For a linked non-confidential Planning Center group, it can include the names and IDs of roster people marked present. That named roster is temporary: it is stripped when the leader ends the night or automatically after 12 hours, and only the attendance count remains with the night.
• If a church administrator's governance change is interrupted, the browser keeps the operation UUID, action, and tenant/member/group UUIDs so Rewind can finish that exact change. Replay eligibility expires after seven days; the record is removed when the change reaches a final result or the next time Rewind reviews an expired record. Rewind separately keeps a tenant-scoped server receipt for up to 14 days so the same operation cannot be applied twice. That receipt contains the actor and target UUIDs, action type, a request fingerprint, timestamp, and closed result metadata; account erasure removes receipts tied to that account. Neither record contains names, email addresses, prayer or Ask content, devotional activity, or attendance data.
• If you are on a teaching or planning team: the sermon drafts, comments, planning notes, and practice recordings you create in Studio.

Who can see what

The content of your conversations is private by default. Your church's admins cannot see your Ask count, which sermons you asked about, your devotional-day history, or either of those activities in your named member timeline. A down-rated answer may appear without your identity in the church's quality review. If you explicitly report a problem, the report and the identity you submitted with it are shown so an admin can investigate and follow up.

What your church's admins can see in your named member timeline is your activity on that church's sermons: that you opened, played, or finished a particular sermon, what you bookmarked, that you searched and how many results came back (never the words you typed), and any problem you reported. Reading and listening are the same to it — finishing a sermon by reading it is recorded exactly as finishing it by listening. Where you are inside a sermon is not: the page you read to and the point you listened to stay yours. The completion figures your church sees elsewhere count completions, not people — one person finishing a sermon twice counts twice.

Problem reports include your identity because the admin will likely want to follow up. If you don't want your identity attached, don't submit a report.

Group prayer lists are visible only to members of that exact group. Being a church administrator does not by itself grant access. Prayer text and the person's name are encrypted together at rest with a key dedicated to group prayers. We do not put prayer-list content in church-admin or operator dashboards, search, analytics, error reports, exports, or AI prompts.

A live Together roster is likewise visible only inside that exact group. It is a room-presence aid, not a permanent attendance record: Rewind removes the names and guest labels at the end of the night or after the 12-hour abandoned-room cutoff.

A linked Planning Center roster is shown only inside its linked Rewind group. If Planning Center marks the member list confidential, only the Rewind group leader can see those imported names. Available email addresses are used to match members and are offered for invitations only to a group leader; the roster response does not show addresses to other group members. Rewind does not write attendance to Planning Center.

Church administrators may see a Groups governance report containing group names and status, eligible leaders, aggregate member and pending-invitation counts, capacity warnings, and whether and when a group has used Together within retained session history. That report never contains prayer text, shared Ask questions or answers, individual devotional activity, or named attendance history. Governance access does not make an administrator a member of the group.

When an administrator must choose a new leader for one specific group, Rewind shows the name and email contact label of eligible current members of that group so similarly named people can be distinguished. That purpose-limited choice is not a church member list and does not expose anyone outside the group.

External services

Members and administrators who choose Planning Center sign-in are redirected to Planning Center. Rewind receives their Planning Center user and organization identifiers and display email.

When a church administrator connects Planning Center Groups and a group leader links a group, Rewind reads that group's roster and events from Planning Center. The connection is read only. Opening the handoff takes the member to Church Center to complete any attendance action there.

Sermon transcripts come from publicly available YouTube captions or, for sermons without captions, from transcribing the church's own podcast audio with Deepgram (sermon content only — never your data). Church administrators may also connect Google Drive, Microsoft OneDrive, or SharePoint and manually select or watch locations containing sermon recordings. Rewind reads only the recordings the church authorizes and copies them into its Cloudflare R2 storage so it can validate and resume transfers, extract audio from video, transcribe the sermon, and generate the church's Rewind materials. Rewind does not modify or delete the church's original cloud-storage files; an imported video copy is removed after its audio has been extracted. We send the transcript and your questions to Anthropic's Claude API to generate responses. We send chunk-level transcript text to OpenAI's embedding API, along with the search terms and questions you type, so what you type can be matched against the sermons. Bible passage text comes from api.bible. Errors are reported to Sentry with credentials and identifying tokens scrubbed. The application and its database are hosted on Render, and generated media (such as shareable sermon clips) is stored on Cloudflare R2.

Data deletion

Delete your account from settings. Your conversations, devotional progress, bookmarks, listening and reading progress, preferences, and private sermon drafts are hard-deleted immediately. Practice recordings are removed from the app immediately. If Rewind already issued an upload link for a recording, the link cannot be revoked; storage deletion starts after that link expires and is repeatedly reconciled so a late-finishing upload is also removed.

Text you wrote as yourself is removed, not just unlinked. We delete the text of problem reports you submitted, the text of any need you sent to your church's needs wall from your phone, and the initials shown on cards you wrote. The church keeps the surrounding record — that a report was made, that a card sat on the board — so its own history stays intact.

In a group prayer list, we replace prayer text and the person's name with a fixed removed-content notice while keeping the fact that an item was a praise or request and whether it had been answered. If you shared an Ask question with a group, both the question and its answer are replaced with removed-content notices in the group's night history.

The deletion reaches every church where you left that text, including ones you have since left or been removed from. You do not have to still be on a church's roster for it to be removed there.

One limit on that, stated plainly. If planners had already built a sermon series around a need you wrote, that sentence stays in the church's record of that series — and in the planning and drafts that came out of it — because by then it had become part of the church's plan rather than a message from you.

Work you produced on behalf of your church is treated differently. If you were on a teaching or planning team, the sermon drafts, comments, and planning notes you contributed belong to the church and stay with it, no longer linked to your account. Search terms are kept so churches can see what people are looking for, with the link to your account removed.

Group prayer items expire on a rolling 12-month window. An item answered recently is kept for at least one month after it was answered so the group can carry the praise report into its next meeting. Authors and group leaders may delete an item sooner, and permanently deleting a group also deletes its prayer and session history.

No tracking pixels, no ads

We don't run advertising and we don't embed third-party tracking pixels. Fonts are served from our own servers. The third-party requests on these pages are the YouTube embed for sermon video playback, scrubbed error reporting to Sentry, and — for some churches — the church's own brand fonts or logo from their provider.

Last updated: 2026-09-28.