Privacy Policy — SoapBox Super App

🔒 Privacy First for Explorers

If you're exploring faith privately — whether you're new to Christianity or navigating a sensitive personal situation — SoapBox has specific protections built for you:

Private Mode: No public profile. Your account is invisible to other users unless you choose to connect.
ORA Conversations: All conversations with ORA (our AI companion) are private and never shared with other users or third parties.
Private Journal: Your SOAP journal entries are encrypted and visible only to you.
No Social Discovery: With Private Mode on, you won't appear in search results or community directories.
Opt-in Community: You control what communities you join, and your membership can be kept private.

1. Who We Are

SoapBox Super App ("SoapBox," "we," "us," "our") is a faith community platform founded in 2023. We can be reached at support@soapboxsuperapp.com.

This Privacy Policy applies to the SoapBox mobile application (iOS) and website at soapboxsuperapp.com.

2. What We Collect

Information you provide

Account registration: name, email address, optional phone number for verification
Profile information: display name, photo, bio, faith journey details (all optional)
Content you create: prayer requests, journal entries, community posts, messages
Church-related data (for pastors): member information, giving records, event data

Information collected automatically

Device information: device type, operating system version, app version
Usage analytics: features used, session duration, app interactions (anonymized)
Location: approximate location for finding nearby churches (only when you grant permission; never stored)
Push notification tokens (for sending notifications you opt into)

What we do NOT collect

We do not sell your data to advertisers
We do not build advertising profiles
We do not read your ORA conversations for marketing purposes
We do not share your private journal entries with anyone

3. How We Use Your Information

To provide the service: Authenticate your account, deliver features, sync your data across devices
To personalize your experience: Show relevant communities, verses, and content based on your preferences
To communicate with you: Send push notifications you opt into (prayer reminders, community activity)
To power ORA: Your questions to ORA are sent to our AI provider to generate responses. They are not stored for training purposes.
To improve the app: Aggregated, anonymized usage data helps us understand what's working
For security: Detect and prevent fraud, abuse, and unauthorized access

4. Sharing Your Information

We do not sell your personal information. We share data only in these limited circumstances:

Service providers: Supabase (database), Stripe (payments), Apple APNs (push notifications), Anthropic (AI). These providers are contractually bound to protect your data.
Church administrators: If you're a member of a church on SoapBox, the church admin can see your membership status and public profile. They cannot see your private journal, ORA conversations, or private mode activity.
Legal requirements: We may disclose information if required by law or to protect the safety of users.
Business transfers: In the event of a merger or acquisition, your data would transfer subject to the same privacy protections.

5. Data Security

We use industry-standard security measures including:

TLS encryption for all data in transit
Encryption at rest for sensitive fields (journal entries, private messages)
Row-level security policies on our database (each user can only access their own data)
Regular security reviews and access controls

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@soapboxsuperapp.com.

6. Your Rights & Choices

Access: You can view all your data within the app at any time
Correction: Update your profile and preferences from the Me tab → Settings
Deletion: You can permanently delete your account directly within the app at Settings → Delete Account. Deletion is immediate and removes all associated data, including your profile, journal entries, prayer requests, community posts, and memberships. This action cannot be undone.
Notifications: Manage notification preferences in the app or your device settings
Location: Location access can be revoked in iOS Settings → SoapBox → Location
Private Mode: Toggle private mode on/off at any time from your profile settings
Data export: To request a copy of your personal data, email support@soapboxsuperapp.com

In accordance with Apple App Store requirements, you may delete your account at any time from within the SoapBox app without needing to contact us.

7. Children's Privacy

SoapBox is designed for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at support@soapboxsuperapp.com and we will promptly delete the account.

8. Developer API, MCP Server & AI Agents

SoapBox offers a public developer API (the "Faith Content API") and a remote Model Context Protocol (MCP) server so third-party AI agents and developers can use SoapBox faith tools. This section explains the data involved.

What agents send and receive. Agents may send queries such as scripture quotes, study questions, search terms, and approximate location coordinates (to find nearby churches). They receive public-domain Scripture, study answers, public church-directory data, and — only where a creator has opted in — purchasable sermon content.

API keys & usage. Developers self-serve API keys; we store only a hashed form of each key and meter per-call usage (including an anonymized IP hash for key-less calls) for rate-limiting, abuse prevention, and billing.

Acting on your behalf (consent tokens). An agent can take an action for you — post a prayer, make a donation, or read your "faith context" — only with an explicit, scoped, revocable consent token you generate in the SoapBox app. Tokens are bound to a specific agent and enforce per-transaction and monthly limits. The faith context an agent may read is limited to your name, denomination, preferred language, faith-journey stage, and ministry interests — it does not include your prayers or journal entries. You can revoke a token at any time in the app.

Cryptocurrency (USDC) payments. Some purchases may be paid in USDC on the Base network. To verify a payment we process the on-chain transaction hash, wallet address, and amount. SoapBox does not custody your funds; where a hosted crypto checkout is used, Coinbase Commerce processes the payment under its own policy.

Content marketplace. Pastors and creators may opt their content in for sale to people and AI agents; purchases are metered per key or account, and creators receive the majority of net proceeds. Donations are separate from content sales and are always passed through to the church.

Third-party agent handling. Data you allow an agent to access is also governed by that agent operator's own privacy policy. We instruct agents not to store or reuse your data beyond what you have permitted.

Retention & developer contact. API usage logs are retained for up to 24 months for security and billing; consent tokens persist until they expire or you revoke them. Developer or security questions: support@soapboxsuperapp.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll notify you via a push notification or in-app banner. Continued use of SoapBox after changes constitutes acceptance of the updated policy.

10. Contact Us

Questions about privacy? We're here.

📧 support@soapboxsuperapp.com

SoapBox Super App · Santa Maria, CA

Your privacy matters.