BuzzerReady is a Bible-quizzing practice platform operated by Conyers Apostolic Church ("we", "us"). This policy describes what we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it.
Most of our users are children. How we handle their information is set out in our Children's Privacy Notice, which is part of this policy. If you are a parent or guardian, read that one.
1. What we collect
From the person who holds the account
- Name and email address, when you create an account or join our launch list.
- Church or team name, if you give it.
- Your password, stored only as a cryptographic hash by our authentication provider. We never see it.
From a quizzer profile — including a child's
- A display name chosen by the account holder. It does not have to be a legal name, and for a child we recommend it is not.
- A division (Cadet, Beginner, Junior, Intermediate, or Experienced).
- Practice activity: which drills were run, which questions were answered correctly or incorrectly, how long an answer took in milliseconds, and how far into a question the quizzer interrupted. This is the practice record — it is what produces a quizzer's progress and a coach's report, and it is the main thing the product is for.
- Recording ratings: a quizzer can mark a sung or read-aloud Scripture recording with a thumbs-up or a thumbs-down. A thumbs-down carries one reason chosen from a fixed list of six — "Hard to understand", "Too fast", and the like — and there is no box to type in anywhere in this flow, so a rating is only ever a tap, never words. Ratings are stored with the quizzer's profile, one per recording: a changed mind replaces the old rating rather than adding to it.
A child's profile carries no email address and no login of its own. This is enforced in our database, not merely as a policy: the constraint that forbids it is part of the schema.
Automatically
Settings and a copy of the question bank, stored in your own browser so the app works offline and so we do not have to ask you the same questions twice. This stays on your device.
This local storage acts as a persistent identifier. We use it only to support the internal operations of the service — specifically: to keep you signed in, to remember your settings, to deliver the question bank offline, to maintain and analyze whether the app is working, and to protect the security and integrity of the service. We do not use it to build a profile of anyone, to track anyone across other websites, or for advertising, and we do not permit anyone else to.
- If the app crashes, an automatic error report: the error message, the script file and line, the app version, the screen you were on, your window size, and a coarse device family such as "iOS/Safari". It carries no name, no email, no account identifier, no verse text, and no question or answer text — the report is scrubbed before it is sent and anything still matching our own content is dropped entirely.
- If you use the "Improve the app" form: the category you pick, what you write, and your email address only if you choose to give it.
- Server logs kept by our hosting provider, which include IP addresses, for security and troubleshooting. See section 4 for how long.
The one thing we ask and do not keep
When you create an account we ask for the month and year you were born, once. We ask because a child must not be able to open an account and then consent on their own behalf — the whole of this notice rests on the account holder being an adult. We check the answer and we throw it away in the same moment. It is not written to your account and it is not written to any log.
If the answer is under eighteen we create nothing: no account, no record of the attempt on our servers, and not the email address that was typed before the question. Your own browser remembers that it asked, so the question is not put to the same child twice on that device — that is a single date kept on the device, it says nothing about who you are, and it never reaches us.
What we do not collect
We do not store a date of birth or an age, and we do not ask for or store a home address, a phone number, a photograph, or any biometric identifier. We use no advertising or analytics trackers, and there is no chat anywhere in BuzzerReady.
We do not sell or share personal information, as those terms are defined under applicable state privacy laws, including for cross-context behavioral advertising.
If any of that ever changes, we will update this policy and tell you before the change takes effect.
2. Why we hold it
- To run your account and let you sign in.
- To show a quizzer their progress, and a coach or parent the reports they subscribed for.
- To keep the service working — to know when it breaks, to protect it from abuse, and to answer you when you write to us.
- To take payment for a subscription, when payments are available.
- To learn which recordings quizzers find hard to listen to, so we can replace them with better ones. That is the whole use: replacing a recording is a decision a person makes by reading the ratings — a rating never hides a recording, never reorders a list, and never changes anything in the app by itself, and it is not used for recommendations or personalisation of any kind.
- To meet our legal obligations.
We do not use anyone's practice record or recording ratings — a child's least of all — for advertising, profiling, or any purpose other than the practice, reporting, and recording-replacement features described here. We do not use either to develop, train, or evaluate any artificial intelligence system.
3. Who else sees it
We use a small number of service providers. Each holds only what its job requires, each is bound by a written agreement to keep it confidential and secure, and none of them is permitted to use it for their own purposes.
| Provider | What it handles | Children's data? | Purpose |
|---|---|---|---|
| Supabase | Database and sign-in — accounts, profiles, practice records, recording ratings | Yes | Storing and serving the data the product runs on |
| Netlify | Hosting and delivery of the site and app; server logs | Yes (IP address in logs) | Delivering the app; security and troubleshooting |
| Stripe | Subscription payments, when available. Card details go to Stripe directly and never reach us. | No | Taking and managing payment from the adult account holder |
| Cloudflare | Serves the verse audio from audio.buzzerready.com, and receives the IP address of the device requesting it | Yes (IP address) | Delivering the read-aloud and sung Scripture audio |
| GitHub | Holds "Improve the app" submissions and automatic crash reports as internal, private records | No | Tracking bugs and suggestions |
| Brevo | Sends the confirmation email to a parent after they create a quizzer profile, and the message that lets them undo it | Yes (the parent's email address) | Confirming parental consent, and giving the parent a one-click way to withdraw it. Brevo's servers are in the European Union — see "Where we operate" below. The confirmation email does not contain the child's name. |
These are the only third parties that receive personal information from BuzzerReady. We do not disclose a child's personal information to anyone else, and we will not do so without first obtaining the parent's separate, verifiable consent.
Who can see a quizzer's practice record: the account that owns the profile, and — only if the account holder links the profile to a roster and turns the setting on — that team's coach, and that team's quizzers. Both settings are off unless the account holder turns them on, and either can be turned off at any time. Household accounts never expose one family's children to another. There are no public leaderboards for children.
We will disclose information if the law requires it, and we will tell the account holder unless we are forbidden to.
4. How long we keep it — our retention policy
We do not keep personal information indefinitely. This is our written retention policy. We apply it whether or not anyone asks us to, and the full policy is set out in this notice rather than somewhere else.
| What | Why we keep it | How long |
|---|---|---|
| Account details (name, email, church/team) | To run the account and let you sign in | While the account is open, then deleted within 30 days of closure |
| An active quizzer profile and its practice record | To show progress and produce coach and parent reports — the purpose the information was collected for | While the account is open and the profile is in use |
| An inactive profile and its practice record (revoked seat, or no activity) | So a quizzer who changes church or team does not lose their history | 24 months after the last activity, then deleted. We email the account holder 60 days before, and one click keeps the profile |
| A profile the account holder or parent asks us to delete | — | Deleted within 30 days, no reason required |
| A recording rating (a thumbs-up or thumbs-down, with its fixed-list reason) | To know which recordings to replace | While the profile is in use. The app's clear control deletes it at once, a changed mind replaces it, and deleting the profile deletes its ratings with it |
| Payment records (held by Stripe; we hold only Stripe identifiers) | Tax and accounting obligations | 7 years, as the law requires |
| Crash reports | To find and fix defects | 90 days |
| "Improve the app" submissions | To act on the report and to answer you | 24 months after the report is closed |
| Server logs (including IP addresses) | Security and troubleshooting | 30 days |
| Security event records (entitlement and redemption; no IP address) | To detect and investigate misuse | 12 months |
| Launch-list contacts | To tell you when BuzzerReady opens | Until you unsubscribe, or 12 months after launch, whichever is first |
| Consent records for a child's profile | To prove we obtained parental consent, as the law requires us to | For the life of the profile, then 12 months |
| An invitation we sent a parent that was never accepted (the parent's email address, the team, nothing about any child) | So a coach's invitation can reach a parent and be accepted | 30 days, then deleted — address and all |
| Correspondence with us (support and questions you write to us) | To answer you, and to answer you again if you write back about the same thing | 24 months |
| Scholarship and sponsorship records | Amount and date are an accounting record; the note explaining why a family needed help is not | Amount and date 7 years; the reason is deleted at 24 months, and no coach or other parent can ever see it |
| A request you make to us about your child (to see, correct, export, or delete their information) and the date we satisfied it | To prove we did what you asked, within the time we promised | 24 months after we satisfy it. A request we have not satisfied is never deleted, however old — the unanswered one is the record that matters most |
Deletion reaches our backups on their normal expiry cycle, within 90 days. Where we must keep something longer to meet a legal obligation or to defend a legal claim, we keep only that, and only for as long as it is needed.
5. What you can ask us to do
Write to outreach@buzzerready.com and we will:
- tell you what we hold about you or a profile on your account;
- correct anything wrong;
- delete an account, a profile, or a practice record;
- export a quizzer's practice record in a portable format;
- withdraw your consent to any collection that depends on it, and stop that collection;
- stop emailing you — every non-essential email carries an unsubscribe link.
We will not make you argue for it, and using any of these rights never degrades your service or costs you anything. We verify that a request comes from the right person before we act on it. We respond within 30 days.
If you are a parent asking about a child's information, see the Children's Privacy Notice — your rights there are unconditional.
If you believe we have handled your information wrongly, you may complain to your state attorney general or to the U.S. Federal Trade Commission at ftc.gov/complaint.
6. Security
We maintain a written information security program covering the personal information we hold, including children's. It is proportionate to the size of our operation and the sensitivity of the data, and it includes:
- a named person responsible for it — currently Juan Alvear;
- a risk assessment at least once a year, covering internal and external risks;
- documented safeguards designed to address those risks;
- regular testing and monitoring of how well those safeguards work;
- an annual review, and changes when our practices, our providers, or the risks change.
In practice today that means: sign-in and data access are protected by row-level security in the database, so one account cannot read another's records; traffic is encrypted in transit; we store no card details; access to production is limited to the people who operate the service; and we obtain written assurances from every provider that receives personal information.
No system is perfect. If a breach affects your information, we will notify you, and any regulator we are required to notify, without unreasonable delay and as the law requires.
7. Where we operate
BuzzerReady is operated from the United States, and we store personal information in the United States — with one exception, which we would rather name than bury.
The confirmation email we send a parent is delivered by Brevo, whose servers are in the European Union. That email is addressed to the parent, not the child. What reaches Brevo is the parent's own email address and a link that lets them undo the profile they just created. It does not contain the child's name, the child's practice record, or anything else about the child. Brevo is bound by a written agreement to keep it confidential and secure, to use it only to deliver our message, and never for its own purposes.
Everything else — every account, every quizzer profile, every practice record — is stored in the United States. If you use the service from elsewhere, your information is processed in the United States.
8. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect, and we will update the version and date above. We will not quietly widen what we do with a child's information, and we will not apply a change retroactively to information already collected about a child. Previous versions are kept at https://buzzerready.com/legal/archive.
9. Contact
Conyers Apostolic Church
PO Box 501
Conyers, GA 30012
(770) 483-9454
outreach@buzzerready.com