Privacy notice
Version 1, effective 16 October 2026. Covers the DiscipleTrack mobile app and this website.
DiscipleTrack is being prepared for a pilot with one church. It is not open for registration and is not available on the app stores. This notice describes how the app handles information once a church begins using it.
1. Who operates DiscipleTrack
DiscipleTrack is developed and operated by Karl Edu Martin Gomez, an independent developer, at 77 Liberty Road, Aparente St, General Santos City (Dadiangas), 9500 South Cotabato, Philippines. Contact: ddotbone1@gmail.com.
Liberty Church is a church using DiscipleTrack; it does not operate the software. Each participating church decides who it adds, which ministry roles its members hold, and what ministry records its members enter. The operator provides, maintains and hosts the software.
2. Information the app holds
| Information | Purpose and source |
|---|---|
| Account and profile | Your email, authentication credentials, name, optional mobile number and avatar preset support sign-in and identification. Supabase Auth manages authentication. A church can also record a member's name and optional mobile number before that person has an app account. |
| Church and group relationships | Your church records membership, roles, placements and Discipler assignments to organise ministry and determine access. |
| Meetings and lesson progress | The assigned Discipler records meeting dates, lessons, outcomes and optional shared notes. Lesson completion is recorded separately; a Coordinator can act for an active Disciple who has no assigned Discipler. |
| Scheduled meetings | The Discipler enters an agreed time and optional note to show the plan and enable reminders on each person's phone. The Disciple does not confirm the schedule in the app. |
| Workbook answers | You write drafts on your device. Explicit sharing saves an answer snapshot and its sharing record on the server for discussion with your assigned Discipler. Blanks are checked against the book; answers do not determine lesson completion. |
| Follow-ups and care notes | Consecutive recorded absences can create a care case. Responsible ministry members record actions, notes and resolution. |
| History and technical records | The app records actions, who took them and when, for accountability within the church. The service providers (Supabase for the app, Resend for email, GitHub for this website) keep technical logs, such as IP addresses, request times and email delivery events, under their own practices. |
3. How information is used
The app uses these records to show church relationships, lessons, meetings, progress and follow-ups. Monitoring uses explicitly recorded absences, not missing records or elapsed time. A follow-up assigns responsibility for human care; sharing answers never approves them or completes a lesson.
The app has no advertising or analytics SDK and does not request access to your location, contacts or photo library. Free-text answers and notes can still contain personal information; include only what is needed.
4. Who can read it
- You can read your own profile, journey and saved answers, subject to your current access.
- Your currently assigned Discipler can read your journey and the answer snapshots you explicitly shared for that assignment. Ending the assignment ends that answer access. A replacement Discipler needs a new explicit share, even if the same person returns later.
- Leaders and Coordinators have scoped access to members, progress, meetings and follow-ups. Their titles alone do not grant access to workbook answers.
- Care notes are restricted ministry information; they are not automatically visible to the Disciple concerned.
- Platform Super Admin status alone grants no ministry-data access in the app. It permits setting up churches and access to church-level information, including Coordinator names and emails.
Database access rules enforce these church and relationship scopes. Administering the backend is separate from in-app roles: Karl Edu Martin Gomez is the only person with administrative access to the production backend, and that access can technically reach stored information. It is used to run, secure and support the service and to handle the requests described in section 8.
Service providers process information to run DiscipleTrack: Supabase (authentication and database), GitHub (this website) and the email delivery service described in section 6. DiscipleTrack does not sell personal information or share it for advertising. Information may be disclosed where the law requires it.
5. Storage and device copies
The app stores its data with Supabase. The production database is hosted in Southeast Asia (Singapore), region ap-southeast-1. The current hosting configuration does not include provider-maintained backups that can be restored. If backups are introduced, this notice will be updated to say so.
Downloaded lessons and a limited copy of profile and group information can be read offline. Sign-out clears those copies on that device. Lesson drafts and reading positions are kept per account across sign-out; completing account deletion in the app clears them on that phone. An offline phone can retain older information until it reconnects or its local data is removed.
Reminders are scheduled on the phone after it loads the schedule. They are not remote push notifications.
6. Email and this website
Account verification and password-reset emails are sent by Supabase Auth through Resend, from noreply@discipletrack.site, and carry a six-digit code. Resend processes your email address and the message in order to deliver it.
This website contains no sign-in form, advertising, analytics scripts or tracking cookies. The verification page does not exchange tokens or create an app session. The website is hosted on GitHub Pages, which logs visitors' IP addresses for security purposes.
7. Deletion and retention
You can delete your own account in Profile after any held responsibilities have ended. Sign-in credentials are removed, identifying profile fields are cleared and membership is archived. Shared answer text is redacted and scheduled-meeting notes are cleared. See account deletion for what is removed and what history remains.
Membership, meeting, progress, care, sharing and audit history remain so the church's ministry records stay complete. Free-text notes and service logs may still identify a person. Deleting an account does not erase all historical information.
8. Account deletion and privacy requests
You can edit your name, mobile number and avatar under Profile. You may request access to, correction of, or deletion of your personal information by contacting DiscipleTrack support at ddotbone1@gmail.com. Your church's Coordinator can help identify the ministry records involved.
We will verify your identity before processing a request, for example by replying to the email address registered on the account. If someone asks on another person's behalf, we will verify their authority to make the request. We securely document each request and the action taken. For a request concerning a minor, we will involve a parent or guardian where appropriate, without limiting any rights the minor has under applicable law. Information will be deleted or retained according to applicable legal requirements and legitimate retention needs. Some ministry records may remain where retention is justified; we will explain any information that cannot be deleted and the reason for retaining it.
If you cannot access your account, you may submit a request through the support email. Do not send passwords or verification codes with a request.
If you are not satisfied with how a request is handled, you may contact the National Privacy Commission of the Philippines.
9. Members without accounts and minors
A church can register someone without an app account and record that the member was informed.
DiscipleTrack intends to include minors only with the consent of a parent or guardian and with appropriate safeguards. The app does not currently record age, verify parental or guardian consent, or provide features designed specifically for children. Minors will not be registered until those safeguards are in place, and this notice will be updated before then.
10. Updates to this notice
When this notice changes, the updated version will be posted on this page with a new date. The app does not notify users of changes to this notice.