Privacy policy

1. Who we are

ReachThem is run by SILOAM DESIGN LIMITED, the data controller for ReachThem accounts and for the information in this policy. You can reach us about your information through the people who run your organisation on ReachThem, who will pass your message to us.

ReachThem is used by organisations such as churches, clubs, charities and festivals to run their events, teams and rotas. Each organisation decides what it asks its members, volunteers and attendees, and is responsible for that information; we hold and process it for them, following their instructions and this policy. If you have a question about how a particular organisation uses your information, you can also ask that organisation.

For a church, this includes who has asked to join and who it has approved as a member, its member directory, messages people send to its contacts (such as Pastoral care), its notices and church page, its youth groups, the consent of parents and carers, DBS check records, and the records its Safeguarding Officers keep. The church is responsible for that information and we process it for the church. We are responsible for your account itself, including the answer you give to our date-of-birth question, and for the protections that apply across ReachThem to everyone under 18.

2. What we collect

• Your account: your name, email address and, if you add them, a phone number and a photo. We also record how you sign in: with a code or link sent to your email, with Google, or with Apple. When you use Google or Apple we receive the name and email address they share with us (and, from Google, your profile picture).
• Your age: we ask everyone for their date of birth once. If you are 18 or over, we keep only the fact that you told us you are 18 or over, and when; we do not keep your date of birth. If you are 13 to 17, we keep your date of birth until you turn 18, then delete it and keep only that you are 18 or over. If the date shows you are under 13, we close the account (see Children's information).
• Churches you join or visit: if you ask to join a church on ReachThem, we store your request, how you found the church (for example its QR code, its join code, a search, or an email invitation), your name, email address and phone number, and, if you are 18 or over, an optional short message. If the church approves you, we record when. If you choose “Just visiting”, we store which church you added to Home and when you last looked at it.
• Messages to a church's contacts: messages you send to, or receive from, one of a church's contacts (such as Pastoral care or the Office), and when they were read.
• Parents and carers: when a young person aged 13 to 17 asks to join a church's youth groups, we store the name, relationship, email address and (if given) phone number of the parent or carer they name; whether and when that person gave, refused or withdrew consent; whether it was given by email link or on paper; the version of the words they agreed to; and which leader met them and the young person in person.
• Church pages, notices and podcasts: what a church's staff publish on its church page and in its notices, including pictures and links, and who posted or changed them. If a church shows its podcast, we copy the titles, dates and descriptions of its newest 100 episodes from its podcast feed.
• Organisations and teams: the organisations and teams you belong to and your role in them, the rota shifts you are on or volunteer for, your replies to shifts, cover and swap requests, availability answers, tasks, and skills your organisation has recorded for you.
• Events: when you register for an event we store the details you give: your name and email, a phone number if the organiser asks for one, the names of people you register with you (for example a partner, or your children's first names and ages), your answers to the organiser's questions, your ticket, whether you have paid (we never take card payments ourselves) and whether you checked in. Feedback you give after an event is stored with the event.
• Messages: messages and poll votes you post in team chats, group chats and youth groups, and any report you make about a message or a person. In a youth group, or any chat that includes someone under 18, when a message is changed or deleted we keep the earlier wording for the church's Safeguarding Officers (see Young people aged 13 to 17).
• People added by an organiser: a team's organisers, or its organisation's coordinators, can add someone who does not use the app, with their name and the email address or phone number they give us, so that person can receive rota emails with one-tap links. If you later sign up with the same email address, that information joins your account.
• Safeguarding: if your organisation records a DBS check for you, the limited details described in DBS checks. A church's Safeguarding Officers also keep concerns people send them, reports that involve someone under 18, and any records they decide must be kept for longer to protect someone (a “safeguarding hold”).
• Your devices: if you allow notifications, the app stores a push notification token for your device, whether it is an iPhone or an Android phone, and the app version. The app uses your camera only to scan tickets at check-in (no photos or video are kept) and your photo library only when you choose a picture to upload.
• Picking from your contacts: when you add someone and choose “Pick from contacts”, your phone shows its own list and the app reads only the one contact you pick: their name, phone numbers and email addresses, to fill in the form. Nothing else in your address book is read or uploaded, and nothing is sent to us unless you save the form. On Android your phone asks for permission the first time.
• Adding to your calendar: when you choose “Add to calendar” for a turn, an event or a ticket, the app opens your phone's own “new event” screen filled in with its title, time and place and a short note (the turn's notes, or a line saying your ticket is in the app), and you choose whether to save it. Where that screen isn't available, an event or ticket opens its calendar file from our website instead, and a turn doesn't offer the button. The app never reads your calendar, and nothing from it is sent to us.
• Technical records: sign-in and security records, counters that stop abuse (email addresses in them are stored only as a one-way code), and reports of errors in the website or app, with links shortened so that private tokens in them are not kept.

3. How we use it, and why

• To provide ReachThem (to perform our agreement with you): your account, registrations, tickets, teams, rotas, chat and tasks.
• To send the messages you would expect (our and your organisation's legitimate interests): tickets, reminders about events and shifts, requests to confirm a shift or cover for someone, and a weekly summary. You can change which notifications you get, and how, in the app or from the link in any email.
• So organisations can run their events and teams (the organisation's legitimate interests): for example so a team's organisers can see who is on the rota and contact them.
• To keep ReachThem safe and working (legitimate interests): preventing abuse and fraud, securing accounts, fixing faults and dealing with reports.
• To protect young people (our legal duties under the Online Safety Act 2023, and our legitimate interest in keeping everyone on ReachThem safe): asking everyone's date of birth, closing the accounts of people under 13, and applying the protections for people aged 13 to 17 described in Young people aged 13 to 17.
• So churches can run their membership, contacts, notices and youth groups (the church's legitimate interests and, for youth groups, its safeguarding duties): for example so the church's staff can approve people who ask to join, and so its Safeguarding Officers can keep young people safe.
• News and updates only if you opt in (consent), which you can withdraw at any time.
• Where the law requires it (legal obligation), for example to respond to a lawful request.

Religious belief. Asking to join a church, or being one of its members, can show your religious belief, which the law treats as a “special category” of information needing extra care. A church uses it as a not-for-profit body with a religious aim, only about its members, former members and people in regular contact with it, and does not share it outside the church without consent. We process it only to provide ReachThem to the church. We never use it for advertising or to build a profile of you. A network of churches that a church joins sees numbers, never a list of the church's members. When you ask to join a church or add it to your Home, we ask you to agree that the church and ReachThem can hold that you did.

4. Who can see your information

In a church, a team's organisers and assistant organisers are called its team leaders and helpers, and coordinators are called staff.

• Other members of your organisation see your name and photo.
• The organisers and assistant organisers of a team you are in can see your contact details so they can reach you about the rota.
• Your organisation's owners, administrators and coordinators can see the contact details of its members.
• An event's organisers see the registrations for that event. Stewards checking people in see first names only for children.
• Messages in a team chat are seen by the members of that team.
• If you ask to join a church, its staff who look after membership see your first name and how you found the church, and, once they open your request, your name, email address and phone number. You are told this before you ask.
• A church's member directory is off unless the church turns it on, and you appear in it only if you choose to. Your email address and phone number show there only if you choose that as well. Only the church's approved adult members can see the directory; visitors and people under 18 cannot, and people under 18 are never listed.
• A message to one of a church's contacts is read only by you and the people behind that contact, each of them only from the day they were added. You are told who they are before you write. The church's other staff, owners and administrators cannot read it. The church's Safeguarding Officers can read a conversation that involves someone under 18 or that someone has reported; each time they do, it is recorded and the church's other Safeguarding Officers and owners can see that they did.
• Everyone in a youth group sees its messages. The church's Safeguarding Officers can also read youth groups and any chat with someone under 18, including the earlier wording of messages that were changed or deleted. Each reading is recorded and visible to the other Safeguarding Officers and the church's owners.
• Anything a church publishes on its church page for “Anyone”, and notices for “Anyone”, are public: anyone can see them, including on the web and without the app. Pictures on ReachThem are stored at web addresses that are hard to guess but not secret.
• DBS details are seen only by your organisation's Safeguarding Officers (see below).
• Our service providers, listed next, process information only to provide their service to us. We may also share information where the law requires it.

5. Service providers we use

These companies process personal information on our behalf, only for the purpose described:

• Railway — hosts the website, the app's server and the database where ReachThem's information is stored.
• Resend — delivers our emails (sign-in links and codes, tickets, reminders and summaries, and the emails that ask a parent or carer for consent and confirm their choice), so it receives the email address and the message.
• Expo — delivers push notifications to the app. It receives your device's push token and the notification text, not your account details, and passes notifications on to Apple and Google.
• Google — “Sign in with Google”, if you use it, and Firebase Cloud Messaging, which delivers notifications to Android phones.
• Apple — “Sign in with Apple”, if you use it, and the Apple Push Notification service, which delivers notifications to iPhones.
• OpenRouter — powers the optional page designer that organisers can use to style an event page. It receives only what the organiser types and the event page being designed (and any image the organiser adds), not attendees' information.

Some of these providers process information outside the UK, including in the United States. We use providers that offer the safeguards UK data protection law requires for those transfers.

Podcasts. When you play a church's podcast episode, your phone's browser opens a ReachThem page that plays the audio straight from the church's podcast host. That host, and Apple Podcasts or Spotify if you choose to open them, will see your device's internet address, as they would for any podcast. They are not our service providers and their own privacy policies apply. To show a church's episodes, our server reads the church's public podcast feed; it sends no information about you.

6. Children's information

ReachThem is for people aged 13 and over. We ask everyone their date of birth when they sign up, or, for accounts that already exist, the first time they open the app after this change. If the date shows someone is under 13, we close the account straight away, sign it out everywhere and delete it 30 days later, unless a parent or carer tells us the date was wrong. So that the same email address cannot sign up again, we keep a one-way code made from it (not the address itself) for one year, then delete that too.

Children under 13 do not need an account. When a parent or carer registers for an event, the organiser may ask for the first names and ages of the children coming, so they can plan numbers, activities and safety.

• Children's ages are visible only to the event's organisers. Stewards checking people in see first names only.
• Children's details are used only for that event and are never used for marketing.
• Children's names and ages are kept with the registration until the organiser deletes the event, the registration is cancelled and removed, or you delete your account. We are introducing automatic deletion a set period after each event, and this policy will say when it applies.
• A parent or carer can ask us, or the event's organiser, to see, correct or delete their children's details at any time.

7. Young people aged 13 to 17

If you are 13 to 17, ReachThem works differently for you, to help keep you safe. This is what happens.

• Your date of birth is kept until you turn 18. Then we delete it and keep only that you are 18 or over.
• Your settings start private. Message previews on your lock screen and read receipts start switched off; you can turn them on in Me. You never get marketing from us.
• No private chats with adults. Nobody over 18 can have a private, one-to-one conversation with you anywhere in ReachThem. Once your church is set up for young people, you can join its youth groups, where two leaders with a DBS check for work with children are always there, and its serving teams. You can use a team's chat only while two such leaders are in the team; otherwise you stay on the rota but the team chat is closed to you. You can't join other group chats.
• Your details stay hidden. Other people can't see your email address, phone number or photo, except the church's Safeguarding Officers. The checked leaders of your youth groups can see your photo. Leaders see your parent's or carer's contact details instead of yours. You are never shown in a member directory, and you can't see other people's email addresses or phone numbers.
• Your parent or carer has to agree before you join a church's youth groups, either by clicking a link we email them or by signing a form. A leader will meet you and them in person first. We tell your parent or carer which youth groups and teams you are in and who leads them, and they can withdraw their consent at any time; if they do, you leave the church's groups. Your parent or carer can't read your messages.
• Who can read your chats. Everyone in a youth group sees its messages. The church's Safeguarding Officers can read your youth groups, any chat you are in, your conversations with the church's contacts, and anything someone reports, including messages that were changed or deleted. They do this only to keep people safe, and each time they read a chat it is recorded. We keep the earlier wording of changed or deleted messages for 2 years, or longer if a Safeguarding Officer needs it to protect someone.
• If something worries you, use “Tell a Safeguarding Officer” in the app. It goes straight to the church's Safeguarding Officers, not to your leaders. You can also talk to Childline, free and at any time, on 0800 1111 (childline.org.uk), or report something that happened online to CEOP (ceop.police.uk).
• You have the same rights as everyone else (see Your rights), and you can use them yourself.

If you are a parent or carer named by a young person, we use your name, relationship, email address and phone number (if given) to ask for your consent, record your choice, send you a receipt, tell you which youth groups and teams they join and who leads them, and let you withdraw consent. The church is responsible for this information. We keep it while your consent is in place and for 3 years after it ends, then delete your details and keep only a record that consent ended.

8. DBS checks

Organisations that work with children or vulnerable adults may record that a volunteer has a DBS (Disclosure and Barring Service) check. Because this relates to criminal records, we keep as little as possible and protect it more closely than anything else:

• We store only the level of the check, the workforce it covers, its issue and renewal dates, whether it is on the DBS Update Service, the organisation's notes and the last four characters of the certificate number. We never store a copy of the certificate or what it says.
• Only the organisation's appointed Safeguarding Officers can see these details, and every time they do it is recorded. ReachThem's own administrators cannot see them.
• A team's organisers and its organisation's coordinators see only whether someone is cleared for a role that needs a check, and until when — never the details. DBS status never appears on printed rotas or in activity feeds.
• DBS details are deleted when your organisation removes them or when you delete your account. What remains is a record for the Safeguarding Officers that a record was deleted, with no details.

9. Churches: membership, contacts and notices

• Joining a church. You ask to join; the church's staff decide. Until they approve you, you see only what the church shows to anyone. If they decline, you can ask again after 30 days.
• Notices. A church's notices go to its members unless the church chooses otherwise. You can switch off notifications about a church's notices in Me › Your membership. Notices that a church publishes for “Anyone” are public.
• Contacts. Only approved members can message a church's contacts. Visitors see only the email address or phone number the church has published for that contact.
• Podcasts. Episodes play in your phone's browser (see Service providers we use).
• Networks. If your church belongs to a network of churches on ReachThem, the network sees counts (for example, how many new members joined in the last 30 days, shown as “fewer than 5” when small). It never sees anything about young people, consent, ages, contacts, messages, visitors, the directory or requests to join, and never a list of members.

10. Giving and tickets

When your church, or another organisation, takes card payments through ReachThem (gifts, regular gifts and paid places at its events), this is how we handle them.

• Who you pay. You pay the organisation, through its own Stripe account. Stripe takes the card payment and holds your card details as an independent controller under its own privacy policy. ReachThem never sees, stores or sends your card or bank details, and takes no fee.
• What we keep. The name and email address you type, how much you gave or paid, when, what it was for (the fund, or the places you bought), whether it is a one-off or regular gift, the receipts and notices we sent, and Stripe's reference numbers for the payment (never your card). For places at an event, also the answers to the organiser's questions.
• Gift Aid. If you tick Gift Aid, we keep your title, first and last name, house name or number and postcode (or your address, if you live outside the UK), the words of the declaration you agreed to and when. Gift Aid is claimed only on gifts made in your own name.
• Who sees it. Only the people the organisation chose to look after money, and its Owners, see who gave and how much. The people who run an event see who bought places, as they see registrations. A network of churches sees counts (and, only if the church chooses, a monthly total, rounded and never when fewer than 5 people gave), never a person.
• Your religious belief. Giving to a church can show your religious belief. The church uses this information for its own activities as a religious body, about the people who give to it, and we process it for the church. We never use it for advertising.
• Sharing an email address. We know givers by email address. If you share one with someone, you will each see the gifts made with it on the page that manages your giving, and receipts go to that address.
• Under 18s. You must be 18 or over to give or to buy places. Accounts of people under 18 can't give or buy, and if places are bought on the website with the email address of someone under 18, the payment is refunded and nothing is added to their account.
• How long we keep it. Payment records (gifts, orders, refunds, disputes and Gift Aid) are kept for 7 years, because the organisation must keep its accounts and Gift Aid records that long, even if it stops using ReachThem. Your name and email are removed from your gifts 7 years after your last gift, once nothing of yours is still running; a buyer's 7 years after the order. A Gift Aid declaration is kept for 7 years after the last claim made with it.

11. Employees, policies and expenses

When your church, or another organisation, uses ReachThem for the people it employs, for documents it asks people to read and agree to, or for expense claims, this is how we handle them. The organisation decides how they are used, as your employer or the body you volunteer for; we hold them for it.

• What we keep about employees. Your job title, when you started and finished, your hours, your holiday allowance, the time off you asked for and what was decided, and your absences (only the kind and the dates: never a reason, a diagnosis or a medical detail). Contracts usually hold pay and an address, so every contract is stored encrypted and only you and the people who look after employees can open it. We never keep bank details or National Insurance numbers in ReachThem's own records.
• Who sees it. You, the people the organisation chose to look after employees (who first agree to keep employee information confidential), and your line manager, who sees your time off and your absences (those still going on and those that ended in the last 12 months) but not your contract. Being an Owner doesn't show anyone your absences or contracts. Each time someone opens your employee record it is logged, and you can see who. Everyone else only ever sees “Off” or “Away”, never why.
• Sickness and family leave. These are health and family information, which the law protects specially. The organisation keeps them to meet its duties as an employer (sick pay and statutory maternity, paternity, adoption and other family leave), under the UK GDPR Article 9(2)(b) and the Data Protection Act 2018. After 3 years they become a plain “Absent”.
• Documents you agree to. Which version you read, when you opened it, when you agreed, how (in the app, on the website or on paper) and the words you were shown, so the organisation can show it was agreed. Checklists for someone new record which steps are done and by whom.
• Expenses. Your claims, their lines and amounts, the journeys you claim mileage for, and photos of your receipts, stored encrypted. They are seen by you, the budget holder who decides, the people who look after money and the organisation's Owners. We never keep your bank details: the organisation pays you another way.
• Away dates. When you mark dates you're away, we keep the dates only, never a reason. The people who plan where you serve see that you're away, nothing more.
• Under 18s. People under 18 can't be employees, line managers or budget holders and can't claim expenses. They can mark dates they're away, agree to documents given to a whole group of at least 3 people (never with a personal note), and follow a getting-started checklist run by cleared leaders.
• Where it never goes. None of this reaches a network of churches (not even as a count), the weekly summary, or another organisation. Notifications never say why someone is off, how much a claim is for, or what a note says.
• Why we may hold it. Employee records: the employment contract and the employer's legal duties. Expense claims and receipts: the organisation's legal duty to keep accounts, and its legitimate interests. Away dates and agreements to documents: the organisation's legitimate interests in running its activities safely.
• How long we keep it. Employee records, holiday records and contracts are kept for 6 years after the holiday year in which the employment or the record ended, because employers must keep them that long, even if the organisation stops using ReachThem. Notes on time off are deleted after 90 days. Paid and approved expense claims and their receipts are kept for 6 years after the end of the financial year they were paid in; rejected or withdrawn claims for a year; unfinished claims are deleted after 90 days. Agreements to documents are kept for 6 years after the later of the document changing and you leaving (longer if the organisation's document says so); checklists for 2 years after they finished; away dates for 30 days. Something under a legal claim or an enquiry is kept until it is settled.

12. How long we keep information

• Your account information is kept for as long as you have an account.
• Registrations stay with their event so organisers keep accurate records; if you delete your account they are anonymised (see below).
• Records of notifications we sent are deleted after 180 days (chat notifications after 7 days).
• Activity records, which show who changed what in an organisation, are deleted after 2 years.
• Error reports are deleted after 90 days without the error recurring.
• Sign-in codes expire after 10 minutes and sign-in links after 24 hours, and both are removed shortly afterwards. One-tap links in emails stop working when they expire and are removed 30 days later.
• Push notification tokens are removed when you sign out of the app or delete your account.
• Chat messages and polls, in every chat (team chats, group chats, youth groups, event and crew chats), are deleted 2 years after they were sent, unless a safeguarding record needs them longer: a Safeguarding Officer's hold, a hold ReachThem places to deal with a report, a complaint or a suspension, or a report that is still open or was acted on. The earlier wording of a changed message goes with it once that is 2 years old too.
• Your date of birth (13 to 17 only) until you turn 18; then only that you are 18 or over.
• Accounts closed because the person is under 13 are deleted 30 days after closing; the one-way code of the email address is deleted after one year.
• Requests to join a church that were declined, cancelled or expired, and “Just visiting” records you have ended, are deleted after 90 days.
• Conversations with a church's contacts are deleted 2 years after the last message, or, if they involve someone under 18, 2 years after the last activity.
• The earlier wording of changed or deleted messages in youth groups and chats with someone under 18, messages sent to young people outside chats (kept for the Safeguarding Officers), and earlier versions of notices are deleted after 2 years.
• Concerns sent to Safeguarding Officers and reports involving someone under 18 are deleted 6 years after they are closed.
• A parent's or carer's consent is kept while it is in place. When it ends (withdrawn, ended or refused) we keep it for 3 years, then delete the parent's or carer's details and keep only a record that consent ended. Links in consent emails stop working as soon as they are used, refused or expire.
• Invitations to youth groups and teams are deleted a year after they end.
• Archived notices are deleted after 13 months, with their pictures.
• Podcast episodes: we keep the newest 100 per church.
• Gifts, orders and Gift Aid declarations: see Giving and tickets.
• Employee records, agreements to documents, checklists, expense claims and away dates: see Employees, policies and expenses.
• Safeguarding holds. A church's Safeguarding Officer can place a hold on the records about a person, a group or a conversation when they are needed to protect someone. Held records are not deleted, even when an account is deleted, until the Safeguarding Officer lifts the hold. Every hold is reviewed at least once a year.

13. Deleting your account

You can delete your account at any time in the app (Me → Delete account) or on the website (Profile → Delete account). Deleting your account explains exactly what happens: your upcoming shifts are withdrawn and your teams' organisers are told, future registrations are cancelled, past registrations are kept for the organiser without your name or contact details, messages you sent stay in their chats as “Former member”, and your DBS details are deleted.

If you were in a youth group, in a chat with someone under 18, or in a conversation with a church contact that involved someone under 18, the church's Safeguarding Officers keep a record of your name alongside what you wrote there, for as long as those records are kept (see How long we keep information). Records under a safeguarding hold are kept until the hold is lifted. A parent's or carer's consent given for you is kept for 3 years after it ends, without your account.

An organisation you worked for or claimed expenses from keeps your employment and expense records, and your agreements to its documents, with your name, for as long as the law asks (see Employees, policies and expenses). Your away dates, unfinished claims and any time off still waiting for an answer go with your account.

14. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you;
• have inaccurate information corrected (you can change most of it yourself in your profile);
• have your information deleted;
• object to, or ask us to restrict, how we use your information;
• receive your information in a format you can take elsewhere;
• withdraw consent you have given, for example to news and updates.

If you are 13 or over you can use these rights yourself. A parent or carer can also ask for a young person, where the young person agrees or cannot understand the request themselves.

Some records kept to protect children and others, such as the records a church's Safeguarding Officers keep, may be kept or withheld when you ask to see or delete them, where the law allows, for example to protect someone else or because they are needed for legal claims. If that happens we, or the church, will tell you unless doing so would put someone at risk.

To use any of these rights, ask the people who run your organisation on ReachThem to pass your request to us. We will reply within one month. If you want to complain about how we have handled your information, please tell us first, through Help and complaints in the app or at www.reachthem.co.uk/complain (you don't need an account). We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. If you are still unhappy you can complain to the Information Commission (ICO) at ico.org.uk.

15. Cookies and app storage

On the website we use only the cookies ReachThem needs to work: a sign-in cookie that keeps you signed in, cookies that protect the sign-in form, and a cookie that remembers which of your organisations you last looked at. We do not use advertising or analytics cookies.

The app keeps you signed in with tokens stored in your phone's secure storage (the iOS Keychain or Android Keystore), and keeps a copy of recent information on your phone so it works with a poor signal.

16. Keeping information safe

Information travels over encrypted connections. Sign-in codes, sign-in links and the one-tap links in our emails are stored only in a form that cannot be turned back into the original. Access inside an organisation follows the roles its owners give, and sensitive actions are recorded.

17. Changes to this policy

We will update this page when we change how we handle information, and change the “last updated” date above. For significant changes we will also let you know in the app or by email.

18. Contact us

SILOAM DESIGN LIMITED — ask the people who run your organisation on ReachThem, who will pass your message to us.