Privacy policy

Itineracy is built and operated by one person — me, Wilson Pruitt, through Wroot Labs LLC. This page covers the App (binder.itineracy.app), this marketing site, and the free Commons. I've written it in plain language on purpose; if anything here is unclear, ask me directly.

The short version

The App stores the facts your church tells it — who holds which account, who's certified through when, what's in the transition plan. It never stores a password, a bank PIN, an alarm code, or any other secret; those stay in your church's own systems, and the App only records a pointer to where they live. The Commons requires no account and collects nothing beyond ordinary web traffic. There is no advertising, no ad tracking, and no analytics script running anywhere on this site.

What the App collects

When your church signs up, the people you designate as administrators enter data about the church into the App: names, emails, and phone numbers of staff and volunteers; account and vendor records; certification dates; transition notes. This is data your church chooses to enter — I don't collect it independently, and it's only as accurate or complete as what your church puts in.

Signing in uses a one-time code sent to your email — there's no password to create or for me to store. Supabase, our authentication provider, sets a session cookie so you stay signed in; that's the only cookie the App sets, and it isn't used for tracking.

What the App deliberately does not collect

This is a hard rule, not a policy that might change: the App never stores a password, PIN, security code, or any other credential. The account registry records who holds a key or a login and where the real secret is kept (your church's own password manager, a sealed envelope, whatever you already use) — never the secret itself. The certification tracker records dates and a pointer to where a document lives, never the contents of a background check. The transition module prompts a handoff conversation between an outgoing and incoming pastor; it does not record what was said in it. No pastoral-care notes are collected anywhere in the product.

Who can see your church's data

Each church's data is walled off from every other church's at the database level — access is denied by default and only granted through the App itself, not by a shared login or a support backdoor. Within your church, who can see what is controlled by the roles your administrators assign (admin, viewer, and so on).

As the operator, I can access data to provide support, investigate a bug, or respond to a request from your church — I don't browse church data without a reason to. I never sell data, and I don't share it with anyone outside the services below that make the App run.

Who else touches it

Running the App means a small number of infrastructure providers process data on my behalf, under their own security commitments:

• Supabase — hosts the database and handles sign-in.
• Vercel — hosts and serves the App and this site.
• Resend — sends certification reminders, invitations, and any other church-directed email.
• Cloudflare — manages DNS for itineracy.app.

None of them are authorized to use your church's data for their own purposes. I don't run analytics, ad networks, or any other third-party tracking script on the App, the Commons, or this site.

How long data is kept

Your church's data stays in the App for as long as your church has an active account. If your church stops using Itineracy, write to wilson.pruitt@gmail.com and I'll delete it — normally within thirty days, sooner on request.

Children's data

Itineracy is a tool for church administrators, not a service directed at children, and it isn't meant to collect data about anyone under 13.

Changes to this policy

If this policy changes in a way that matters — a new subprocessor, a change in what's collected — I'll update this page and note the date above. For something substantial, I'll also email churches with an active account.

Questions

Write to wilson.pruitt@gmail.com — see the contact page for more.