Privacy Policy

Who we are

Selah is operated by Selah (TODO — registered company name and address), based in TODO — jurisdiction. This policy covers the Selah mobile app (Android package com.selah.app) and this website.

If you have any question about this policy, email support@selah.app.

Information you give us

• Account details: your email address, full name and password (stored only as a salted hash, never in readable form).
• Profile image, if you choose to upload one.
• Content you upload: audio recordings, album cover art, lyrics, chords, song metadata, announcements and event details.
• Messages you send us, such as support requests.

Information we collect automatically

• Device push notification tokens, so we can deliver announcements and new-song alerts through Firebase Cloud Messaging.
• Authentication and security logs, including the IP address and timestamp of sign-ins, password resets and email verifications. We keep these to detect and investigate account abuse.
• Basic technical information needed to serve the app, such as request logs.

How we use your information

• To create and secure your account, and to sign you in.
• To show you the choirs, songs and albums you have access to, and to enforce whether content is public, members-only or admins-only.
• To send you the notifications you have enabled, and transactional emails such as email verification and password resets.
• To keep the service secure, investigate abuse, and meet our legal obligations.

Who can see your content

Visibility is set per song and per album by your choir's administrators. Public content can be seen by anyone using the app. Members-only content is visible to people your administrators have admitted to that choir. Admins-only content is restricted to administrators of that choir.

We do not sell your personal information, and we do not use your uploaded recordings for anything other than delivering the service.

Service providers

We share the minimum data necessary with providers who run parts of the service on our behalf:

• Cloud hosting and database for the application and your account data. (TODO — name the hosting provider and region.)
• Object storage and CDN for audio files and images. (TODO — name the storage provider and region.)
• Google Firebase Cloud Messaging, to deliver push notifications to your device.
• An email delivery provider, for verification, password reset and support email. (TODO — name the email provider.)

How long we keep it

We keep your account data for as long as your account exists. Authentication and security logs are kept for a limited period for fraud and abuse investigation. (TODO — state the retention period, for example 12 months.)

When you delete your account we remove your personal data as described on the account deletion page. Content you uploaded to a choir may be retained by that choir where it forms part of the choir's shared library; where that applies, it is disassociated from your account.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to your local data protection authority.

To exercise any of these rights, email support@selah.app. To delete your account, follow the steps on our account deletion page.

Children

Selah is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, contact support@selah.app and we will remove it. (TODO — confirm the correct minimum age for your jurisdiction and your Play Store content rating.)

Security

Passwords are stored hashed, sessions can be listed and revoked from within the app, and multi-factor authentication is available on your account. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Changes to this policy

If we make material changes we will update the date at the top of this page and, where appropriate, notify you in the app.