Privacy Policy

• We do not sell your family's information, and we do not show ads.
• We do not use analytics or advertising trackers.
• A parent sets up the family and decides who is in it. Children use Doorpost only through a profile a parent creates.
• When AI features are on, children's names are swapped for placeholders such as “Child 1” in what the assistant, calendar sorting, forwarded emails and the Scripture coach send. Private prayer requests, children's own words, photos, and the ages and grades used to sort the calendar go only after a parent turns that on.
• A parent can download a copy of your family's information, or delete the family, from Settings at any time.

Your sign-in. Your name, email address and sign-in details, handled by our sign-in provider, Clerk.

Your family. The family name, each person's first name, colour and role, and, if you add them, a child's birthday and school type. Your time zone, state and Sabbath day. Children's wall PINs are stored only as a one-way hash.

What you put in. Calendar events, chores, rewards, meals, courses, lessons and attendance, memory verses, devotion notes, prayer requests, photos, Vault logins, and anything else you type or upload. Children can add some of this themselves on the wall, such as finishing a chore, a request to a parent, or a prayer.

Connected calendars. If you connect Google, Outlook or iCloud, we store the sign-in tokens (or, for iCloud, the app-specific password you give us) encrypted, and copy the events we read. If you subscribe to a calendar link, we store the link encrypted.

Forwarded email. If you forward an email to your family's Doorpost address, we keep the sender, the subject and a short excerpt so you can turn it into an event.

Care sheets. If you write a care sheet for a sitter, it can hold a child's allergies, medications, conditions, the doctor's name and phone number, and bedtime and comfort notes. You choose what to write, and you can clear it at any time.

Devices. If you turn on phone alerts, the push address your browser gives us. If you pair a kitchen tablet, a record of that device.

Usage counts. How many AI requests each family made each day, so we can keep costs in check. We do not log what was asked or answered.

Waitlists. If you ask to hear when something opens, your email address.

To run Doorpost for your family: to show your calendar, chores and records, to send the emails and alerts you choose, to sync the calendars you connect, and to keep the service working and secure. We do not use your family's information for advertising, and we do not sell it.

Some features use AI: the family assistant, meeting reflections, turning a forwarded email or a photo of a flyer into an event, sorting calendar events to the right person, sermon summaries, lesson plans, recipe ideas and the Scripture coach. These send the text or image the feature needs to Anthropic's Claude models, through Vercel's AI Gateway (or, in some configurations, directly to Anthropic). AI features run only when we have switched AI on for Doorpost; while it is off, the AI buttons are hidden and nothing is sent.

Children's names. In the assistant, meeting reflections, calendar sorting, forwarded emails and the Scripture coach, children's names are replaced with placeholders such as “Child 1” before anything is sent, and the real names are put back in the answer you read. This happens whether or not the switches below are on.

Two switches, both off until a parent turns them on, in Settings → Privacy:

• Share private prayer requests with the assistant. Until it is on, private prayer requests are never sent.
• Let AI use the children's details. Until it is on, children's ages and grades are not used to sort calendar events, children cannot use the Scripture coach, and a photo cannot be turned into an event.

Forwarded emails do not need either switch: when you forward an email to your family's Doorpost address, its sender, subject and text are sent so we can turn it into a draft event, with children's names replaced first. If you do not want an email read this way, do not forward it. Lesson ideas send the topic you type, the grade level you choose and, if you pick one, the course's name.

Sermon audio. If you record or upload a sermon, the audio is sent through Vercel's AI Gateway to OpenAI to be turned into text, and the text is then summarized as described above. The audio is deleted as soon as the text is ready; we keep the text and summary with your sermon notes. If turning it into text fails, the audio is kept so you can press Retry, and deleting the sermon deletes it. Use it for sermons only, not for recordings of family conversations.

We share information only with the service providers below, only for running Doorpost, and only what each one needs.

• Vercel — hosting, photo storage and the AI Gateway.
• Neon — our database.
• Clerk — sign-in and account security.
• Resend — sending email, and receiving the emails you forward to Doorpost.
• Anthropic — the AI features described above.
• OpenAI — turning sermon audio into text, only if you record or upload a sermon. The audio is deleted once the text is ready.
• API.Bible and Crossway (ESV) — Bible text. They receive only the passage being looked up, not who is reading.
• Google, Microsoft and Apple — only if you connect their calendars, and only to read (and, if you turn on two-way, write) those calendars.
• Browser push services (from Apple, Google or Mozilla, depending on your browser) — only if you turn on alerts.
• Apple Music and YouTube — when you look up a song, we search their catalogues with the song's title. They receive the title, not who asked.
• Instacart — only where Doorpost offers “Send to Instacart” and you use it: the items on your grocery list, so Instacart can fill a cart. You finish there, under Instacart's own privacy policy.

When a parent pins a song, the Spotify, Apple Music or YouTube player loads from that company, under its own privacy policy. The wall's art screensaver loads public-domain images from the U.S. National Gallery of Art. The wall's weather comes from the U.S. National Weather Service (weather.gov), which receives the map coordinates of the town you choose, not who you are.

We may also disclose information if the law requires it, or to protect someone's safety.

Children do not sign up for Doorpost. A parent creates each child's profile and controls it. Our Children's Privacy Notice explains what we collect about children, how it is used, and a parent's choices. A parent confirms that notice when adding a child under 13.

• Clerk's cookies keep you signed in.
• Doorpost's own cookies keep a paired kitchen tablet connected and hold a child's short wall session (it lasts 15 minutes).
• Your browser's local storage keeps small things, such as a half-finished setup, on your device.

We use no analytics or advertising cookies.

Connected-calendar sign-ins, calendar links, iCloud passwords and Vault passwords are encrypted (AES-256-GCM) before we store them, with a key held on our servers. Children's PINs are hashed. Photos are stored privately and are shown only to your family. No system is perfectly secure.

We keep your family's information while your family uses Doorpost, until you delete it or ask us to delete it. When a parent deletes the family, you have seven days to change your mind; after that, your family's records, photos and calendar connections are removed for good, and the access you gave Google or Microsoft is withdrawn. We are setting shorter limits for some records, such as forwarded emails, and will list them here when they are in place. Deleted information can stay in our database provider's backups for a short time before it is overwritten.

• Edit or remove most things you have added, at any time.
• Turn AI sharing on or off in Settings → Privacy.
• Disconnect a connected calendar at any time.
• Download a copy of your family's information: a parent can do it in Settings → Family → Your family's data. You get one file with your calendar, chores, school records, prayers, notes and settings, and a list of your photos. Passwords and connection keys are left out.
• Delete your family: a parent can do it on the same page. It waits seven days so it can be undone, then everything goes for good. Deleting the family does not close your sign-in account; write to hello@doorpost.app and we will close that too.
• One child's information: on the same page a parent can download everything Doorpost keeps about one child, or remove that child's information while keeping the rest of the family.
• Anything else, or if you would rather we did it for you: write to hello@doorpost.app.

If we change this policy in a way that matters, we will ask you to read and accept the new version the next time you open Doorpost. The version date is at the top of this page.

Questions or requests: hello@doorpost.app.