Privacy policy

Last updated 16 October 2026

PHTRACK helps churches follow up the people they meet. Those people trust the church with their details, and the church trusts us. This page explains what we keep, why, and how we look after it, in plain English.

The short version. Your church owns the information it puts in PHTRACK. We only use it to run PHTRACK for that church. We never sell it, never use it for advertising, and never share it with other churches. Old records are deleted automatically.

Who we are

PHTRACK is a small Australian service run by Keanu, its founder. “We” and “us” on this page mean PHTRACK. You can contact us with the contact form on our home page.

Your church is in charge of its information

When a church uses PHTRACK, the church decides what goes in and who can see it. We look after that information on the church’s behalf. If you were followed up by a church and have a question about your details, the quickest way is to ask that church directly. You can also contact us and we’ll pass it on and help.

What PHTRACK keeps

About people a church is following up (entered by the church’s team, or by the person on the church’s QR connect card):

name, and a phone number and/or email address
how and when the church met them (for example “First-time visitor” or “Prayed with”), and whether they are under 18
brief notes, the history of follow-up calls and messages, and next steps they have taken (for example “Joined a group”)
whether and when they agreed to be contacted, and whether they asked not to be contacted

Some of this can show a person’s religious beliefs or affiliation, which Australian privacy law treats as sensitive information. That is why PHTRACK asks for consent before someone is added, and why each church’s information is kept separately and seen only by its own team.

About church team members who sign in: name, email address, role, an encrypted (hashed) password, reminder preferences, and, if they turn on phone notifications, the technical details their browser needs to deliver them.

About churches who ask to join the pilot (the form on this website): name, church, email, optional phone number, church size and message.

How it is used

to show the church’s team who needs follow-up, and to send them daily reminders and a weekly summary
to keep the service secure, working and backed up
for pilot sign-ups: to contact you about the pilot

We don’t use it for anything else. We don’t sell it, rent it, use it for advertising, or combine it with other information about you.

Who else handles it

We use a few trusted providers to run PHTRACK. They handle information only to provide their service to us:

PythonAnywhere hosts the PHTRACK app and its databases, on servers in the United States.
Google (Gmail) sends reminder, summary and sign-in emails.
Apple, Google or Mozilla deliver phone notifications, if a team member turns them on. Notifications say how many people need follow-up, or a new visitor’s name.
Cloudflare hosts this website.

Because the app is hosted in the United States, information is stored outside Australia. We choose providers with strong security, and we only share what they need.

How it is protected

Everything travels over encrypted (HTTPS) connections.
Each church has its own separate database. Team members only see their own church, and workers only see the people assigned to them.
Passwords are stored hashed, never in plain text. Repeated wrong passwords lock the login for a while.
People marked under 18 can only be followed up by the church’s leaders.
The database is backed up daily. Backups are kept for 14 days and are readable only by us.

No system is perfectly secure. If a breach ever affected your information, we would tell the affected church and, where the law requires, the people affected and the Office of the Australian Information Commissioner.

How long it is kept

People who have finished every follow-up step, or have not responded, are deleted automatically after the period the church chooses (12 months unless the church changes it). Someone marked “Do not contact” is kept so they aren’t contacted again. Deleted records disappear from backups within 14 days. If a church stops using PHTRACK, we delete its information when asked, and in any case within 90 days, after offering the church a copy.

Cookies

The PHTRACK app uses one cookie to keep you signed in. There are no advertising or tracking cookies. This website doesn’t use analytics scripts or cookies; our host, Cloudflare, keeps basic visit counts (such as the number of visitors and the countries they come from) that don’t identify you.

Seeing, correcting or deleting your information

You can ask to see, correct or delete information about you. Ask your church, or send us a message with the contact form. You can also ask a church at any time not to contact you again.

Questions and complaints

Please contact us first and we’ll do our best to fix it. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell churches using PHTRACK first.