Privacy Policy (v0.2 DRAFT)

Draft Notice

This document is a first-pass structural draft (v0.2) prepared as scaffolding for the attorney who will finalize it. It supersedes the v0.1 placeholder. It is NOT effective and is NOT a binding policy. Both entities act as "joint controllers" with respect to user data and have entered into the data-handling arrangements required by applicable law.

1. Information We Collect

• Account information — name, email, password hash, phone (optional), profile photo, account type (giver/org/church/admin).
• Giving and financial information — Contribution amounts, top-up history, Grant Recommendations, DAF Account balance and ledger, recurring-gift configuration, tax-receipt records, and payment-method tokens stored by our payment processor (we do not retain raw card numbers).
• Engagement information — posts viewed, posts saved, prayer interactions, navigation patterns, push-token state.
• Device and technical information — device model, OS version, app version, IP address, approximate location (city-level unless precise location is granted), crash reports.
• Voluntary information — content the user submits (posts for orgs/churches; preferences for givers; F.I.G.S. attestations for orgs).

2. How We Use Information

We use information to: (a) operate and improve the service; (b) process Contributions and disburse Grants; (c) issue tax acknowledgments and statements; (d) maintain DAF Account records; (e) prevent fraud and abuse; (f) comply with applicable law including IRS reporting; (g) communicate with users regarding their accounts; and (h) any analytics or aggregated reporting use.

3. DAF Donor Identity & Anonymity Option

By default, an Advisor’s display name accompanies their Grant Recommendation as attribution to the Recipient organization; the grant itself is always made by Xerish Storehouse as grantor-of-record. An Advisor may opt into anonymity in account Settings, in which case no individual identity is disclosed and the Recipient receives the grant from Xerish Storehouse without Advisor attribution. Xerish Storehouse may disclose Advisor identity where required by law or by Sponsor governance policy.

4. Information Sharing

We share information only with the following categories of third parties. We do not sell personal information.

• Payment processors — Stripe, Inc. for charge processing and Stripe Connect payouts to Recipient accounts.
• Cloud infrastructure — Supabase (database, authentication, edge functions) operating on AWS us-east-1.
• Email delivery — transactional email provider.
• Push notifications — Expo push service (expo-server-sdk) and Apple Push Notification service / Firebase Cloud Messaging at the platform layer.
• AI providers — Anthropic (Claude API) for the stewardship-insights surfaces, subject to the data-handling terms in the AI Voice doctrine.
• Analytics — none beyond first-party at v1; any addition will trigger a Privacy Policy update.
• Professional advisors — counsel, auditors, accountants under confidentiality obligations.
• Government / legal — when required by law, subpoena, or valid governmental request.

5. Cookies + Tracking

The website (xerish.com) uses cookies for session management and basic analytics. The mobile app uses local storage and secure storage on-device. We do not use third-party advertising trackers at v1.

6. Data Retention

We retain account and giving records for the periods set forth in the Document Retention Policy, including a permanent record of donor giving history necessary for tax substantiation and DAF audit. These records support the contemporaneous written acknowledgments issued by Xerish Storehouse as donee of record; see the Donor Advisory Agreement, "Tax Receipt — Donee of Record (IRC §170(f)(8))." Other categories are retained only as long as needed for the purposes stated above, except where a longer period is required by law.

7. Your Rights

Depending on jurisdiction, users may have rights including access, correction, deletion (subject to retention obligations), portability, restriction, opt-out of certain processing, and the right to lodge a complaint with a supervisory authority.

• California residents (CCPA / CPRA): the rights described under California law.
• Other U.S. state laws (Virginia, Colorado, Connecticut, Utah, Texas, etc.) as applicable.
• Whether the service is offered into the EU/UK/EEA and, if so, the GDPR/UK GDPR basis of processing — current operating assumption is U.S. only at v1.

8. Security Practices

We use commercially reasonable administrative, technical, and physical safeguards, including: encryption in transit (TLS) and at rest, role-based access control via row-level security in Postgres, audit logging, and least-privilege service accounts. No system is perfectly secure; we cannot guarantee against all risks.

9. Children’s Privacy (COPPA)

The service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it. Parents may contact privacy@xerish.com regarding any such concerns.

10. International Transfers

To be finalized by counsel — including disclosure of any non-U.S. data processing by subprocessors and the legal basis for any cross-border transfer if the service expands beyond the U.S.

11. Contact for Privacy Concerns

Privacy questions or requests: privacy@xerish.com. Postal address: to be confirmed.

12. Changes to This Policy

We will post material updates to this Policy and, where feasible, notify users through the service. Continued use after the effective date constitutes acceptance.

13. Effective Date + Version

Document Key: privacy_policy. Version: v0.2 (first-pass draft for counsel review). Draft Date: 2026-05-27. Effective Date: none; this draft is not yet effective.