This Privacy Policy describes how 1000888462 Ontario Ltd., operating as CJS Digital ("we", "us", "our", or "CJS Digital"), collects, uses, stores, and protects your personal information when you use the Stones mobile application and related services (collectively, "the App"). By using Stones, you agree to the practices described in this policy.

Stones is operated from Ontario, Canada, and is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Information We Collect

We collect the following categories of information when you use the App:

Account Information

• Email address (used for sign-in and account communications)
• Display name (visible to other users)
• Hashed password (stored securely; we never see your plain password)
• Optional profile photo
• Optional bio text

Content You Create

• Stones (testimony posts) — text, category, optional scripture reference, optional photo
• Prayer requests — same fields as stones, with a request flag
• Encouragement messages you send to other users' stones
• Prayer commitments — which stones you have committed to pray for
• Circles you create or belong to, including membership status (pending or approved) and your role (member or admin)
• Follow relationships — users you follow and users who follow you
• Invites you send via email

Engagement & Activity Data

• Stones you have prayed for and encouraged
• Badges earned (e.g., First Stone, Faithful Witness, Intercessor)
• Daily streak — count of consecutive days the App has been opened
• Account creation date and last activity timestamps

Technical Information

• Push notification token (delivered by your device when you grant notification permission)
• App version and basic device information needed for support and troubleshooting

Donation Information

• If you choose to make a donation, payment is processed by Stripe. We do not receive or store your full credit card number. We receive a confirmation that a payment succeeded, the amount, and a Stripe customer reference.

2. How We Use Your Information

We use your information to operate and improve Stones:

• Display your stones, prayer requests, profile, and badges to other users of the App in accordance with the visibility rules (public Wall, Circle-only posts, etc.)
• Send push notifications related to your activity (see Section 7)
• Send transactional emails (account confirmation, password reset, invite emails you initiate)
• Show you your personal Journey timeline, Prayer Queue, and Badges
• Calculate and display your daily streak as a personal engagement record
• Provide moderation, support, and address issues you report
• Maintain the security of the App and detect abuse
• Process donation payments and acknowledge them

We do not use your data for advertising, behavioural profiling, or sale to third parties.

3. How Your Information Is Shared with Other Users

Stones is a community app, so some information is shared with other users by design:

• Public stones appear on the community Wall and are visible to all signed-in users
• Circle stones are visible only to members of that specific Circle
• Your display name and profile photo appear next to your stones
• Prayer counts and encouragement counts are visible on each stone
• Follow lists (who you follow / who follows you) are visible from your profile
• When you commit to pray for a stone, the stone's author is notified
• When you send encouragement, the stone's author is notified
• Circle administrators see the list of members and pending requests for their Circles

You can delete any of your own content at any time, which removes it from these views.

4. Service Providers

We do not sell, trade, or rent your personal information. We share limited data with the following service providers who help us operate the App. All providers are bound by their own privacy and security commitments:

• Supabase — secure database, authentication, and Row Level Security enforcement
• Cloudinary — photo storage and content delivery
• Expo — push notification delivery infrastructure
• Render — backend application hosting (Node-RED API)
• Stripe — donation payment processing (we never see your full card details)
• Resend — transactional email delivery (account confirmations, invite emails, password resets)

5. Data Storage and Security

Your data is stored on infrastructure provided by Supabase and Render, both of which use industry-standard encryption in transit (TLS) and at rest. Your password is hashed using a one-way cryptographic function and is never stored in plain text or accessible to us.

We use Supabase's Row Level Security (RLS) to ensure each user can only access data they are permitted to see. API credentials and secrets are stored as environment variables, not embedded in the App or our source code.

While we take reasonable steps to protect your information, no method of online storage or transmission is 100% secure. We cannot guarantee absolute security, and you use the App at your own risk.

6. Photos

Photos you attach to stones are uploaded to Cloudinary's cloud storage. Photos on public stones are visible to all signed-in users of the App. Photos on Circle stones are visible only to members of that Circle. You may delete your stones at any time, which removes the associated photos from the App's display; deleted photo files may persist in Cloudinary's caches for a short period before being purged.

7. Push Notifications

We send push notifications only for the following purposes:

• When another user prays for one of your stones
• When another user encourages one of your stones
• When a stone you committed to pray for is marked as answered
• When someone requests to join a Circle you administer
• When your request to join a Circle is approved or denied
• When a Circle admin adds you to a Circle
• Monthly reminder of stones you have committed to pray for
• On the anniversary of a stone you have placed

You can disable push notifications at any time through your device's notification settings or from the Settings screen within the App.

8. Donations & Payments

Stones is free to use. Users may optionally make donations to support the App's ongoing operation. Donations are processed by Stripe, which has its own privacy policy governing payment data. We receive only a confirmation of the transaction (amount and timestamp), not your full payment details. Donations are non-refundable. Donations are not a fee for service and are not tax-deductible charitable receipts unless 1000888462 Ontario Ltd. specifically issues one in writing.

9. Children's Privacy

Stones is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. Users aged 13–17 should have a parent or guardian's permission before creating an account. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

10. Your Rights

Under PIPEDA and other applicable privacy laws, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correct — request that we correct inaccurate or incomplete information (much of which you can edit directly in the App)
• Delete — permanently delete your account and all associated data at any time using the Settings → Delete Account feature within the App. Deletion is immediate and irreversible.
• Withdraw consent — stop using the App and delete your account at any time
• Export — request a copy of your data in a portable format by emailing us
• Object — to any specific use of your data that concerns you, by contacting us

To exercise any of these rights, use the in-App tools where available, or contact us at the email below.

11. Data Retention

We retain your account information and content for as long as your account remains active. When you delete your account, your personal information and all your content (stones, prayer requests, encouragements you sent, circle memberships, badges, follow relationships, owned Circles and their members) are permanently deleted immediately via the App's Delete Account flow. Cached copies on service providers (e.g., Cloudinary's CDN) may persist briefly before being purged.

Donation transaction records may be retained by Stripe in accordance with their own retention policy and applicable accounting and tax record-keeping laws.

12. International Users

Stones is operated from Canada and your data is processed primarily in Canada and the United States (where our service providers operate). If you are using the App from outside Canada, you consent to the transfer of your data to these jurisdictions.

European Union (GDPR): if you are located in the EU, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local data protection authority.

California (CCPA): if you are a California resident, you have additional rights under the California Consumer Privacy Act. We do not sell personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Material changes will be communicated through the App or by email. Continued use of the App after a change constitutes acceptance of the updated policy.

14. Contact Us