Privacy Policy

Last updated: Oct 11, 2026

This is an English translation. If it differs from the 繁體中文版 (the Traditional Chinese version), the Traditional Chinese version prevails.

Martha, sit (the “Service”) is a serving schedule tool for church team members, made up of an iOS app, an Android app, and a web app. This policy explains what data the Service collects, why, where it’s stored, how long it’s kept, who can see it, and how you can delete it.

1. Who runs the Service

The Service is run by an individual, Hsueh-Han Lee (the “Operator,” “we,” or “us”), not by a company or a church organization.

Each church’s admins decide which team members to add to the church and whom to put on the schedule. Admins are responsible for their own church’s team member data. See the Terms of Service for details.

2. Where your data is stored

The Service uses Google Firebase. Apart from accounts, the main data (team member data, schedules, church settings, and church logos) is stored in the Google Cloud asia-east1 (Taiwan) region.

The following Google services are processed on Google’s global infrastructure, so data may be stored or processed outside Taiwan (for example, in the United States): Firebase Authentication (sign-in), Google Analytics for Firebase (usage analytics), Firebase Crashlytics (crash reports), Firebase Cloud Messaging (push notifications), and Gemini on Google Cloud Vertex AI (photo recognition). All of these are covered by Google’s data processing terms and security measures. By using the Service, you understand that your data will be processed in these regions.

3. Data we collect and how we use it

3.1 Account data

What: Your name and email when you sign in with Google, Apple, or email. If you sign up with email, you also have a password, which Firebase Authentication stores as a hash; the Operator can’t see it. If you use Apple’s “Hide My Email,” we receive only the forwarding address Apple provides. We also store your language setting.
Purpose: Signing you in, identifying you, and showing your name in the churches you join.
Where: Firebase Authentication and users/{uid} in Firestore.
Kept until: You delete your account.

3.2 Team member data in a church

What: In each church: your name, email, status (for example, admin), permission groups, the services and roles you’re assigned to, notification settings, and when you joined.
Purpose: Listing the team members to choose from when planning the schedule, deciding who can plan which schedules, and sending you the notifications you’ve chosen to receive.
Where: Firestore, asia-east1 (Taiwan).
Kept until: You leave the church, an admin removes you, you delete your account, or the church is deleted.

3.3 Schedules

What: Dates, services, roles and the names of the team members serving in them, and occasion tags.
Purpose: Letting team members view and plan the schedule.
Where: Firestore, asia-east1 (Taiwan).
Kept until: A church admin or a team member who can plan schedules deletes it, or the church is deleted. After you delete your account, your name stays on schedules you were already on as plain text; see Section 6.

3.4 Church data

What: The church name and church logo (uploaded by an admin and resized to 512px).
Purpose: Showing the church in the app. The church name is also used to check for duplicates: when someone creates a church with the same name, they see a notice that a church with that name already exists.
Where: Firestore and Firebase Storage, asia-east1 (Taiwan).
Kept until: The church is deleted (it can be restored within 30 days of deletion, then it’s permanently deleted).

3.5 Push tokens

What: One push token per device, generated by Firebase Cloud Messaging.
Purpose: Sending notifications to your device. You can turn off notifications in your device’s system settings.
Where: users/{uid} in Firestore. Only you and our backend can read it; church admins can’t see it.
Kept until: You sign out, you delete your account, or the push service reports that the token is no longer valid.

3.6 Usage analytics

What: Usage events recorded by Google Analytics for Firebase (GA4), such as which screens you opened and which features you used, plus what Google collects automatically: device model, operating system and app version, approximate region, and a random installation ID. We also attach your user ID (uid) and the ID of the church you’re currently in (church_id) to count users and measure how active each church is. Analytics data doesn’t include your name, email, or schedule contents.
Purpose: Understanding daily and monthly users, retention, and which features get used, to improve the Service.
What we don’t do: We don’t track your activity in other apps or websites, use it for advertising, or sell data. That’s why the iOS app doesn’t ask for App Tracking Transparency (ATT) permission.
Opting out: There is currently no setting in the app to turn off usage analytics. If you don’t agree, please don’t use the Service, or email us.
Kept until: Deleted after at most 14 months, per our Google Analytics data retention setting.

3.7 Error logs

What: Records from when the app crashes or hits an error: user ID (uid), church ID, the error stack trace, and device model, operating system and app version. Names, emails, and schedule contents aren’t recorded.
Purpose: Finding and fixing bugs.
Where: Firebase Crashlytics for the iOS and Android apps; Google Cloud Logging for the web app and our backend.
Kept for: About 30 days in Cloud Logging, and 90 days in Crashlytics under Firebase’s rules.

3.8 Google Calendar connection (only for admins who connect a calendar)

What: When an admin chooses to connect Google Calendar, we receive a Google OAuth refresh token and the events on the calendar the admin selects. Scopes: calendar.events (read and write events) and calendar.calendarlist.readonly (list calendars so the admin can pick one). Signing in with a Google account alone doesn’t grant calendar access.
Purpose: Showing and editing the church calendar in the app. All reads and writes go through our backend, which caches events briefly so they load faster. The Service’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Where: The refresh token is stored encrypted on our backend. Neither the app nor other team members can get it.
Who can see it: That church’s team members can see the calendar’s events in the app.
Retention and deletion: Cached events are kept for at most 10 minutes before being read from Google again. When an admin disconnects the calendar or the church is deleted, the authorization and the cache are deleted together. You can also revoke access at any time on the “Third-party apps & services” page of your Google Account.
Google API: The Service’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.9 Photo recognition

What: Photos of schedules uploaded when a team member who can plan schedules chooses “Import from photo.” The photos may show team members’ names.
Purpose: The photo is sent to Gemini on Google Cloud Vertex AI to read the text and turn it into a schedule. Under Google Cloud’s terms, Google doesn’t use this content to train its models. We also record how many photos each church uses per month, to manage limits.
Kept for: The photo is sent to Google only at the moment it’s read; the Service doesn’t keep it. Google may cache it in memory for up to 24 hours to respond faster, and if Google’s automated systems flag the content as possible abuse, it may be kept for up to 90 days for review, then deleted.

3.10 Tips and subscriptions

What: Tips and subscriptions in the iOS and Android apps are paid through the Apple App Store and Google Play. We never receive your payment details (such as your card number).
Where: Whether you’re a supporter is determined only on your device and isn’t sent to our servers. Apple and Google notify us of each transaction’s amount, item, and time, which we use to calculate the cost progress shown publicly on our website. These notifications don’t include your account or name.

3.11 Webhooks (only for churches that set one up)

What: A church admin can set a webhook URL. When the schedule changes, the Service sends the change to that URL, including the church name, date, role, the names of team members added or removed, and the name of the team member who made the change.
Purpose: Letting the church sync schedule changes to its own systems, such as a group chat or a spreadsheet.
Who’s responsible: The church admin chooses and manages this URL. Once data is sent, the receiving end handles it under its own policies. The admin can delete the webhook at any time to stop sending.

4. Who can see your data

You: your own account data, team member data, and push tokens.
Admins of the same church, and team members who can plan schedules: the team member data of everyone in that church, including email.
Other team members in the same church: schedules (including the names on them) and the church name and logo.
People in other churches: none of your data in this church.
The Operator: accesses data only as needed to run the Service, handle problems, deal with abuse, or resolve disputes over duplicate names. The Operator’s admin console can rename a church, suspend a church, and transfer admin rights.

We don’t sell your data. Data is handled only by the service providers needed to provide the Service:

Google: Firebase (database, sign-in, file storage, push notifications, analytics, error logs), Google Cloud (backend, logging), the Gemini API (photo recognition), and Google Calendar (only for churches that connect a calendar).
Apple and Google: Sign in with Apple, Google sign-in, and app store payments.
Webhook recipients set up by a church: only for churches whose admin has set up a webhook; see Section 3.11 for what is sent.

Where required by law, we may provide data to the authorities.

6. Deleting your data

Leaving a church

If you’re not an admin, you can leave a church yourself in the app. This deletes your team member data in that church. Your account remains.

Deleting your account

You can delete your account yourself in the app. This removes:

your sign-in account (Firebase Authentication);
your account data in users/{uid}, including the push tokens for all your devices;
your team member data in every church.

Names already on schedules are kept as plain text, because they’re part of the church’s serving records. To have them removed, contact that church’s admin. If you’re the only admin of a church, you need to hand admin over to someone else before you can delete your account.

Deleting a church

A deleted church is kept for 30 days. During that time, the church’s admins see “Restore church” when they open the app. After 30 days, all of the church’s data is permanently deleted.

Backups and logs

Error logs and usage analytics expire automatically according to the retention periods in Section 3. We don’t make separate database backups; backups inside Google’s systems are cleared within a period of time under Google’s policies.

7. Your rights

Depending on the law where you live (Taiwan’s Personal Data Protection Act, Hong Kong’s Personal Data (Privacy) Ordinance, or Malaysia’s Personal Data Protection Act 2010), you can usually:

ask about or review your personal data, or request a copy;
ask us to complete or correct inaccurate data;
ask us to stop collecting, processing, or using it, or withdraw your consent;
ask us to delete your data.

You can leave a church or delete your account directly in the app; without the app, you can make a request by following How to delete your account. For other requests, contact us as described in Section 11. We’ll reply within 15 days to requests to inquire, review, or get a copy, and within 30 days to requests to correct, stop using, or delete data. If necessary, we may extend this once by the same number of days, and we’ll tell you why. Data on a church’s schedules is managed by that church’s admins, so we may ask you to contact the admin first.

8. Data security

All data in transit is encrypted with HTTPS.
Database access rules keep each church’s data separate, so only that church’s team members can read it.
Google Calendar refresh tokens are stored encrypted.

No system can guarantee absolute security. If an incident affects your data, we’ll notify you as required by law.

9. Children

The Service is a tool for church team members and isn’t directed at children under 13. If you’re under 13, please don’t use it. If you’re 13 or older but a minor, or below the age at which local law lets you consent to the processing of your personal data yourself (as in some cases in Hong Kong and Malaysia), please use the Service with the consent of a parent or legal guardian. Church admins shouldn’t add children under 13 as team members. If we learn that we’ve collected data from a child under 13, we’ll delete it.

10. Changes to this policy

We may change this policy. When we do, we’ll update the “Last updated” date on this page; for significant changes, we’ll post a notice on the Service’s website at least 7 days before they take effect. If you keep using the Service after a change, you agree to the updated policy.

11. Contact

Email: hansli112871114@gmail.com
Report a problem: GitHub issues (public, so please don’t post personal information)