Effective date: October 28, 2026
Zero to One is a product of Zero to One Ministries LLC, a Nevada limited liability company ("Zero to One Ministries," "we," "us"). Zero to One Ministries is the data controller for personal information collected through Zero to One.
This Privacy Policy explains what we collect, why, who helps us process it, and the choices you have, when you use the believer app, Hub surfaces, and related services (the "Service").
1. What we collect
Account: the email you sign in with (or your Google account email if you choose Google sign-in), your username for child accounts, and sign-in records. Profile: full name, display name, gender (optional for children), city, birthday (used to set your age group), and profile photos you upload. Faith and church life (religious information): journeys and journey events, prayers and prayer requests, testimonies, Scripture notes, highlights and bookmarks, church memberships and relationships, group participation, next steps, and serving interests. Because this shows your religious beliefs, we treat it as sensitive and only share it as you choose in the product. Messages: private prayer messages and group or partnership posts you send. AI conversations: questions you ask the Faith Companion and its replies. Children's information: for a child account a parent creates, the information above plus the parent link and the parent's consent record (see section 5), and, if the child adds one (from age 13), the child's own email address (only the child can add and verify it; the parent can see it). Invitations and referrals: if you open an invite link, we store the inviter's code in a first-party cookie (z2o_ref, plus z2o_to for the invite destination) for up to 400 days. When you sign up, we record who referred you in our referrals table (the inviter's account and yours, and when). Partnership invites you send store the invitee's email and an invite code. Church care notes: if you are an adult member of a church, that church's Owner and Admins can keep private care notes about you and hold a care conversation with you. Care notes are visible only to them; the conversation is visible to you and to them. Care notes are not kept for known minors. Copyright notices: if you send a copyright or counter notice, we keep your name, email, postal address, phone number (if given), the details of the notice, your signature, your account ID if you are signed in, and a one-way keyed hash of your IP address (not the address itself), which we use to limit repeat submissions. Support email: if you email our support address, we keep your email address, the subject, and the message. Payments: if a church subscribes, Stripe customer and subscription IDs and billing status. Card details are held by Stripe, not by us. Technical: error reports from the app, which store your user ID, the page you were on, the error message, and your browser's user agent (browser and device type), and the IP address, browser, and device information that our hosting provider receives with each request. We use cookies to keep you signed in, remember settings, and remember an invite link you opened (above). At sign-up, a birthday of 13 or older is kept in a cookie (z2o_signup_dob) for up to 1 hour, only until the account is created. If a birthday under 13 is entered, a cookie (z2o_signup_age_block) on that browser's sign-up page blocks another sign-up attempt for 30 days; it does not affect signing in. After an under-13 sign-up is closed, a cookie (z2o_parent_handoff) lets that screen show the parent link again until the 30-day erase date. We do not use advertising or analytics cookies.
2. How we use it
To run the Service: sign you in, show your content to you and to the people you choose, operate church Hub tools, send the emails you expect (such as sign-in links and subscription confirmations), keep people safe (including automated screening of content for abuse and crisis signals), fix problems, enforce our Terms and Statement of Faith, and meet legal obligations. We do not sell personal information and we do not use it for advertising.
3. Who we share it with
People you choose: content you mark as shared is visible to the people or church you share it with. Church Hub staff can see information you share with that church. Service providers: companies that process data for us under contract, only to provide the Service: Supabase, Vercel, Stripe, Resend (sending email and receiving email sent to our addresses), Google (only if you use Google sign-in), OpenRouter (AI), TypeSafe/Jev (safety screening), YouVersion and Crossway (Bible text), YouTube and Vimeo (embedded videos). The current list, with what each receives, is at /legal/subprocessors. Legal and safety: when required by law, or to protect someone's safety or the rights of others.
4. AI features
The Faith Companion sends what you type to an AI model through OpenRouter to generate a reply. Do not share information you do not want processed this way. The Faith Companion is not available to children under 13. Safety screening: text that other people can see is checked automatically for abuse and crisis signals before or when it is shared. This includes prayers and prayer requests, testimonies, group posts and group pages, care messages, serving opportunities, profiles and personal pages, church pages and Hub teaching, and any content reported to us. TypeSafe (Jev) runs this check and, when needed, an AI model through OpenRouter. Content that passes is shared right away. Content that may harm someone is held until our staff review it. When something suggests a person may be in crisis, it stays visible and our team is alerted so a person can follow up. Text written by a child under 13, or by someone whose age we do not know, is never sent to these services; a member of our staff reviews it instead before anyone else can see it. Support replies: when you email our support address, we may send only your email address (the sender) and the subject line to an AI model through OpenRouter to prepare a suggested reply; the body of your message is not sent. A person reviews every suggested reply; nothing is sent automatically.
5. Children
Children under 13 cannot create their own account. If someone signs up and is under 13, we close that account, lock sign-in, and show a message that a parent needs to sign up for them. This applies whether the person signs up with email or with Google. On that screen the child can type a parent's email address so we send the parent an invite link, or show a parent a link in person. We use that email address once, only to send the invite, and do not save it; our email provider (Resend) delivers the message. To limit repeat sends, we keep a one-way keyed hash of the IP address the invite was sent from (not the address itself). The link is the only way to take over the closed sign-up: each link works once, until the erase date. A parent or guardian whose own account shows they are 18 or older, and was created before the link was sent, can open the link and take over the closed sign-up. Our only check that this person is an adult is the birthday they gave for their own account; we cannot confirm it is true or that they are the child's parent. When a parent does, the account reopens as a child account linked to that parent (display name private, with the same protections as any child account), the scheduled erase is canceled, and we record the parent's consent and the claim. Every invite and claim attempt is recorded. If no parent claims it, that closed sign-up's email, birthday, and name are erased 30 days later; after that it cannot be reopened, and a parent can create a new child account instead. A parent or guardian can also create a child account from Children. Either way, we record the parent's consent: who consented, when, which version of this policy applied, and the exact consent text shown. When a parent creates a child account, the parent picks a first password; the first time the child signs in, the child must choose their own password, and the parent's password stops working. The parent can still see the child's account through the parent link but cannot sign in as the child. A parent can reset a child's password only while the child is under 13. From the child's 13th birthday, only the child can change their password; if they cannot sign in, our staff can reset it after checking that the request comes from the child, and every staff reset is recorded with a reason. If a parent or our staff resets a child's password, the child must choose their own password again at the next sign-in, any email the child verified is marked unverified, and the child gets a notice in the app. A child can add and verify their own email only from age 13, after choosing their own password at 13 or older; an email verified before that is marked unverified. If the child replaces a verified email, we send a notice to the old address and tell the child in the app. The first time a child adds and verifies their own email, we tell the child in the app and send a one-time notice to every email address that was ever verified on that account. The child's Settings show the verified email, with a link to contact support if it is not theirs. If one of these notices fails to send, we try again about once a day, up to 8 times in all (about a week). One risk remains: someone who knows the child's current password, for example a parent who knows a password the child never changed, can sign in as the child, and we cannot tell them apart. These notices are how the child or a previous address owner finds out. The child owns the account. The parent link lets the parent view the child's activity (read-only) and manage the account. When the child turns 18, the parent link ends automatically and the child is told in the app. A parent can close a child's account: it is hidden from everyone and sign-in is locked. The parent can restore it from Children. For a child under 13, a closed account that is not restored is deleted from our systems within one year, unless we are required to keep it longer to comply with the law or protect a child's safety. If you ask us to delete your child's account, we remove it from the service right away and delete it from our systems within one year, unless we are required to keep it longer to comply with the law or protect a child's safety. This applies to a child under 13. For a child aged 13 to 17, the same request removes the account from the service. We may retain certain information as needed to comply with legal obligations, resolve disputes, prevent fraud and abuse, keep our community safe, and enforce our terms. You can cancel a request from Children within 30 days. Parents can download a copy of a linked child's data while the child's account is open and the parent link is active (section 7). To download a closed child's data, restore the account first. The download contains exactly what the child can see in their own account.
6. How long we keep it
We keep your information while your account is open. When you close your account, it is removed from the service. We may retain certain information as needed to comply with legal obligations, resolve disputes, prevent fraud and abuse, keep our community safe, and enforce our terms. To ask about restoring a closed account, contact support@0to1.faith. A parent's request to delete a child's account is handled as described in section 5. Under-13 sign-ups are erased as described in section 5. Download files are removed after 7 days.
7. Your choices and rights
Access and download: Settings → Your data → Download my data gives you a file with your information and photos. Parents can do the same for a linked child from Children while linked. Downloads leave out other people's private details, such as invite codes and invitee emails, and care notes staff wrote about other people. Turning 18: when a child account turns 18 the parent link ends, any pending erase is canceled, every signed-in session is signed out, and the password the parent set stops working. The account stays locked until the account owner signs in with a link sent to the email the child verified before turning 18, and then must set a new password. Only the child can add and verify that email, from their own account in Settings, with a code sent to that inbox; from age 16 we remind them to add one. For safety, an email can be used this way only once 30 days have passed since it was verified. If there is no verified email, the account stays locked: contact us, and our staff will help after verifying it is you; every such recovery is recorded with a reason. Correct: you can update your profile in the Service. Close: Settings → Close account. Other requests about your information: contact us. We may need to verify your identity.
8. Security
We use access controls, encryption in transit, and database security rules so people only see what they are allowed to see. No system is perfectly secure.
9. Where data is processed
Zero to One Ministries operates the Service from the United States, and our providers may process data in the United States and other countries.
10. Changes
We may update this policy. The version shown on this page is the controlling version. If a change needs your agreement, we will ask you in the product.
11. Contact
Privacy questions may be sent to support@0to1.faith.