Privacy Policy

Effective date: July 4th, 2026 Applies to: the GraceChords website (https://gracechords.com) and the GraceChords mobile app (collectively, the "Service").

GraceChords ("GraceChords," "we," "us," or "our") is a free, non-commercial worship tool operated by Ryan Moore, an individual based in the U.S. state of Georgia. We take your privacy seriously and collect as little information as the Service needs to work. This policy explains what we collect, why, and the choices and rights you have.

We are not a commercial business and do not profit from your data. We do not sell it, share it for advertising, or use it to track you.

1. Information we collect

Account information. When you create an account, we collect:

Your email address
Your first and last name

You may create an account directly (email + password) or through Sign in with Google or Sign in with Apple. When you use those options, the provider shares your name and email with us so we can create your account. If you use Sign in with Apple, you may choose Apple's "Hide My Email" feature, in which case we receive a private relay address instead of your real email. We do not receive your password from these providers.

Content you create. To provide the Service, we store the content you make within it — for example, your setlists, song key preferences, view settings, and reading-plan progress. This is stored so it's available to you across your devices.

Technical information (infrastructure). We do not run analytics or tracking. However, like any online service, our hosting and infrastructure providers automatically process limited technical data — such as your IP address and standard request logs — to deliver content, keep the Service secure, and prevent abuse. This is not used to profile or track you, and we do not build advertising or behavioral profiles from it.

Microphone (instrument tuner). The mobile app includes a guitar tuner that uses your device's microphone solely for real-time, on-device pitch detection. The audio is analyzed in memory on your device and immediately discarded — it is never recorded, stored, or transmitted, and no audio ever leaves your device. The microphone is active only while the tuner screen is open, and the app asks for microphone permission only when you first use the tuner. You can revoke this permission at any time in your device settings; the rest of the app works without it.

Essential storage / cookies.

On the website, we use a strictly necessary cookie to keep you signed in. It is not used for tracking or advertising.
In the app, we use secure on-device storage for the same purpose.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies.

2. What we do NOT do

To be clear about our practices, we do not:

Run analytics or usage tracking
Show advertising of any kind
Use remarketing or retargeting services
Sell, rent, or share your personal information
Record, store, or transmit audio from your microphone (the tuner analyzes audio on-device only)
Send marketing, newsletter, or promotional emails
Knowingly collect information from children under 13

The only email we send is an account verification link when you sign up or when needed to secure your account.

3. How we use your information

We use the limited information above only to:

Create and maintain your account
Authenticate you and keep you signed in
Save and sync the content you create in the Service
Send account-related emails (e.g., email verification)
Keep the Service secure and operational

4. Legal bases for processing (GDPR / UK GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data on these legal bases:

Performance of a contract — to create your account and provide the Service you requested.
Legitimate interests — to keep the Service secure and prevent abuse, balanced against your rights.
Consent — where consent is required (for example, certain uses of storage/cookies), which you may withdraw at any time.

5. Service providers (sub-processors)

We rely on a small number of trusted providers to run the Service. They process data only to provide services to us and are bound by their own privacy and security obligations:

Provider	Purpose
Supabase	Account authentication and database (stores your account info and content)
Cloudflare	Website and app hosting, content storage/delivery, and backend functions
Google	Authentication, only if you choose "Sign in with Google"
Apple	Authentication, only if you choose "Sign in with Apple"
Telegram	Delivering exports to Telegram, only if you choose to link your Telegram account

We do not sell or share your information with any party for advertising or marketing.

6. International data transfers

Our providers store and process data primarily in the United States. If you access the Service from outside the U.S. (including the EEA or UK), your information will be transferred to and processed in the U.S. Where required by law, such transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

7. Data retention

We keep your account information and content for as long as your account is active. If you delete your account, we delete your associated personal information and content, except where we are legally required to retain limited records. Backups are purged on a routine cycle.

8. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS) and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your rights

If you are in the EEA or UK (GDPR / UK GDPR)

You have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your data ("right to be forgotten")
Restrict or object to certain processing
Portability — receive your data in a portable format
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with your local data protection authority

If you are a California resident (CCPA / CPRA)

You have the right to:

Know what personal information we collect and how it's used
Access and receive a copy of your personal information
Correct inaccurate personal information
Delete your personal information
Opt out of the sale or sharing of personal information — we do not sell or share your personal information, so there is nothing to opt out of
Limit the use of sensitive personal information — we do not collect sensitive personal information for such purposes
Non-discrimination — we will never treat you differently for exercising your rights

For reference, the only category of personal information we collect under the CCPA is identifiers (name and email address). We collect it to provide the Service, retain it as described above, and do not disclose it for any commercial purpose.

Exercising your rights

You can exercise any of these rights — including deleting your account and data — by emailing [email protected]. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request.

10. Account deletion

You may delete your account and associated data at any time:

In the app: through the in-app account deletion option in Settings.
By email: contact [email protected] and we will delete your account.

Deleting your account removes your personal information and content from the active Service, subject to the retention exceptions in Section 7.

11. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact [email protected] and we will delete it.

If you are in a jurisdiction where the minimum age for data consent is higher than 13 (for example, parts of the EEA), you must meet your local minimum age, or have parental consent, to create an account.

12. "Do Not Track" and CalOPPA disclosures

Do Not Track. Some browsers send a "Do Not Track" signal. Because we do not track users across websites or over time, our behavior is the same regardless of whether this signal is present.

Third parties tracking you on our Service. We do not permit third parties to collect personal information about your online activities across different websites when you use the Service.

Categories collected and shared. As described above, we collect name and email, and share it only with the service providers listed in Section 5 solely to operate the Service.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the "Effective date" above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

14. Contact us

If you have any questions about this policy or your information, contact:

Ryan Moore — GraceChords Email: [email protected] Location: Georgia, USA