Privacy Policy

Plain-English summary: My Shepherd needs your account details, the questions you ask, and limited technical and usage information to provide Scripture-based AI conversations, protect the service, and manage subscriptions. We do not sell your personal information or use your questions or answers to train Anthropic’s models or our own models. You can ask to access, correct, or delete your information by contacting us. My Shepherd is intended for teens and families; children under 13 need verified parental consent before providing personal information.

1. Introduction and Scope

Effective date: August 15, 2026

Bar Above LLC ("Bar Above," "we," "us," or "our") operates My Shepherd, including the web application at app.myshepherdapp.church, related websites, and our iOS and Android applications when available (collectively, the "Service"). Our mailing address is 523 California Ave, Oakdale, CA 95361-3005.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Service or contact us.

2. Information We Collect

We collect information you provide directly, information generated as you use the Service, and information supplied by service providers that support the Service.

Information you provide

Depending on how you use My Shepherd, we may collect:

• Account information. Your email address when you sign in through a magic link. If you choose Google Sign-In, we receive the information Google makes available for authentication, such as your name, email address, and Google account identifier or profile information needed to establish and maintain your account.
• Questions and conversations. The questions, prompts, feedback, and other material you submit, and the AI-generated answers and Scripture citations shown in your conversations. Conversations are stored on our servers so we can operate the Service, maintain your history, and address support or safety issues.
• Church affiliation. If you elect to provide or connect it, information about your church affiliation or related organization.
• Communications. The contents of messages you send to support, including your contact details and any information you include.
• Subscription information. Your selected plan, subscription status, billing history, transaction identifiers, and limited payment-related records. Stripe processes payment card details; we do not receive or store your full card number, CVV, or other PCI payment-card data.

Please avoid including sensitive personal information in prompts, including protected health information, financial account credentials, government identification numbers, passwords, or information you would not want processed by our service providers.

Information collected automatically

When you use the Service, we may automatically collect:

• Device and log information, such as browser type, device type, app version, access times, error logs, and general location inferred from your IP address.
• IP address and security information used to secure accounts, investigate abuse, apply rate limits, and maintain Service integrity.
• Usage and analytics events, such as sign-in events, feature use, plan changes, daily question counts, and interaction patterns. We use PostHog for these analytics.
• Cookie and local-storage data described in Section 6.

We do not seek to collect precise geolocation, biometric data, or full payment-card information.

3. How We Use Information

We use personal information only as reasonably necessary to operate, improve, secure, and support My Shepherd. This includes using information to:

• create and authenticate your account;
• provide Scripture-based AI responses and retain your conversation history;
• count questions and apply plan limits, including Free (three questions per day), Plus (twenty questions per day), and Enterprise (fifty questions per day);
• detect potential self-harm or suicide language and present crisis resources, including the 988 Suicide & Crisis Lifeline;
• process subscriptions, maintain billing records, and prevent payment fraud;
• respond to support requests and communicate important Service, account, security, or policy notices;
• understand usage, diagnose errors, improve features, test Service reliability, and develop aggregated or de-identified insights;
• enforce our Terms of Service, protect users and our Service, and comply with applicable obligations.

We do not use your questions, conversation content, or AI answers to train Anthropic’s models or to train our own AI models. We send prompt content to Anthropic only as needed to generate a response through Anthropic’s API. Our use of Anthropic’s API is subject to Anthropic’s applicable API terms and policies, which state that customer content submitted through the API is not used to train Anthropic models absent the customer’s separate permission.

4. How We Share Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not knowingly disclose it to advertising networks for targeted advertising.

We may share information with carefully selected providers that process it on our behalf and under our instructions:

• Anthropic generates AI responses from the prompts submitted to the Service.
• Stripe processes subscription payments and related fraud-prevention functions.
• SendGrid sends magic-link, transactional, account, and Service emails.
• PostHog provides product analytics and helps us understand how the Service is used.
• Cloudflare provides security, network, performance, and protective services.
• Railway hosts application infrastructure and related data-storage services.

We may also disclose information when reasonably necessary to comply with a valid request from a court or government authority; enforce our agreements; investigate fraud, abuse, or security incidents; protect the rights, safety, and property of users or others; or as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. If ownership changes, the successor will be required to honor this policy or provide notice of material changes.

5. Safety-Related Processing

My Shepherd may use automated systems to identify language suggesting self-harm, suicide, or an immediate mental-health crisis. When detected, the Service may show an urgent message directing you to contact the 988 Suicide & Crisis Lifeline or emergency services. This automated detection can be inaccurate and is not a monitoring, counseling, emergency-response, or crisis-intervention service. Do not rely on My Shepherd to recognize or respond to an emergency.

6. Cookies and Similar Technologies

We use cookies and local storage to keep the Service working, secure sessions, remember certain preferences, and measure Service usage. These may include session tokens, authentication state, rate-limit or security data, and PostHog analytics identifiers.

You can usually control cookies through your browser settings and may be able to clear local storage in your browser or device settings. Blocking or removing these technologies may prevent parts of the Service from working properly, including login and account features.

7. Children and Teens

My Shepherd is designed to be useful to teens and families. Users aged 13 through 17 may use the Service with a parent’s or guardian’s permission and involvement. Parents and guardians should discuss safe and appropriate use with minors and should not rely on the Service as a substitute for pastoral, clinical, or emergency support.

We do not knowingly collect personal information from a child under 13 without verified parental consent, as required by the Children’s Online Privacy Protection Act (COPPA). A child under 13 may not create or use an account unless a parent or guardian has provided verified consent through a process we make available. We encourage parents and guardians to supervise use and to contact us if they believe a child has supplied personal information without the required consent.

A parent or guardian may review, correct, or request deletion of an under-13 child’s information, and may refuse further collection or use, by emailing support@myshepherdapp.church. We may take reasonable steps to verify the requester’s identity and authority before acting. We also seek parental involvement where California or Texas law provides additional protections for minors.

8. Your Privacy Choices and Rights

All users

You may request access to, correction of, or deletion of personal information we hold about you by emailing support@myshepherdapp.church. You may also request account deletion through support. We may need to verify your identity before fulfilling a request and may retain limited information where necessary for security, fraud prevention, billing, recordkeeping, or other permitted purposes.

California residents

If you are a California resident, you may have the right to request that we disclose the categories and specific pieces of personal information we collected about you, the sources and purposes for collection, and categories of recipients; to request correction or deletion; and to opt out of sale or sharing for cross-context behavioral advertising. We do not sell or share your personal information as those terms are defined under California law. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit under the CPRA.

To submit a California request, email support@myshepherdapp.church with the subject line "California Privacy Request." You may authorize an agent to submit a request for you. We will require reasonable proof of the agent’s authority and may verify your identity directly. We will not discriminate against you for exercising applicable privacy rights.

Texas residents

If you are a Texas resident, the Texas Data Privacy and Security Act may provide rights to confirm processing and access your personal data; correct inaccuracies; delete personal data; obtain a portable copy when technically feasible; and opt out of certain targeted advertising, sale, or profiling activities. We do not sell personal data or use it for targeted advertising or qualifying profiling.

To exercise a Texas privacy right, email support@myshepherdapp.church with the subject line "Texas Privacy Request." If we deny your request, you may appeal by replying to our decision within 60 days with the subject line "Texas Privacy Appeal." We will review the appeal and respond within the period required by applicable law. If your appeal is denied, our response will explain how to contact the appropriate Texas consumer-protection authority, where applicable.

EU and UK visitors

My Shepherd is primarily offered in the United States. If you visit from the European Economic Area, Switzerland, or the United Kingdom, we process personal information to provide the Service you request, pursue legitimate interests in securing and improving the Service, comply with obligations, or with consent where required. You may request access, correction, deletion, restriction, objection, or portability by contacting us. You may also have the right to complain to your local data-protection authority. Personal information may be processed in the United States and other locations where our providers operate.

9. Retention and Deletion

We retain account information and questions and answers until you delete your account or your account has been inactive for 24 months, whichever occurs first, unless we need the information for a legitimate and permitted purpose such as resolving a dispute, meeting tax or accounting duties, preventing fraud, or enforcing agreements.

We are implementing and improving automated deletion workflows. Until a deletion workflow has fully completed, account deletion requests may require support-assisted processing. To request deletion, email support@myshepherdapp.church. Deletion from active systems may take a reasonable period, and residual copies may remain in protected backups until overwritten according to our backup schedule.

10. Security and Breach Notice

We use reasonable administrative, technical, and organizational measures designed to protect personal information. These measures include HTTPS for data in transit, HSTS, JWT-based authentication, Helmet content-security protections, access controls, provider-managed encryption at rest, and a policy of not storing plaintext credentials.

No online service can promise absolute security. You are responsible for protecting access to your email account and login links. If we confirm a breach affecting your personal information, we will provide notice without undue delay and, where feasible, within 72 hours of confirmation, subject to applicable law and law-enforcement needs.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, our practices, or applicable requirements. For material changes, we will provide notice by email and an in-app notice at least 14 days before the new version takes effect. The revised policy will include a new effective date.

12. Contact Us

For questions, requests, or concerns about this Privacy Policy, contact us at:

Bar Above LLC

523 California Ave

Oakdale, CA 95361-3005

support@myshepherdapp.church