Privacy Policy
KingsRoute maps every Loveworld (Christ Embassy) branch and routes members to the nearest one. A church map is also, unavoidably, a map of where people gather — and for Cell fellowships, of private homes. This policy explains exactly what we collect, why, who it reaches, and the control you keep.
The controller of your personal data is Loveworld Incorporated (Christ Embassy), Loveworld Conference Centre, Kudirat Abiola Way, Oregun, Ikeja, Lagos, Nigeria. Data protection contact: [email protected] — please mark rights requests "Data protection" in the subject line.
1. Religious affiliation is special category data
Using a church-finding platform can reveal your religious beliefs. Under Article 9 UK/EU GDPR that is a special category of personal data, and it deserves a higher bar than ordinary information.
We rely on your explicit consent (Article 9(2)(a)) to hold data that reveals religious affiliation — your account, your home church, your favorites and your carpool activity.
That consent is captured as a clear affirmative act when you create an account, and the moment is recorded against your record.
You may withdraw consent at any time by deleting your account. Withdrawal does not affect processing carried out before it.
2. What we collect
2.1 If you never create an account
You can use the map, search and directions without an account. In that state we do not build a profile of you. Our servers process your request and a short-lived technical log (see §6), and your device asks Mapbox for map tiles and routes.
2.2 If you create an account
Data | Why we hold it | Lawful basis |
|---|---|---|
Email address | Sign-in, verification, security notices | Contract · Explicit consent (Art. 9) |
Name | Display in the app and to carpool counterparties | Contract |
Phone number (optional) | Carpool coordination where you choose to share it | Consent |
Profile photo (optional) | Recognition in carpool and profile screens | Consent |
Password | Authentication — stored only as a hash, never in readable form | Contract |
KingsChat identifier (if you use KingsChat sign-in) | Linking your KingsChat identity to your account | Contract |
Home church & favorites | Personalizing the app | Explicit consent (Art. 9) |
Last known location | Sorting branches by real distance and delivering opt-in alerts | Consent |
Carpool routes and requests | Coordinating shared travel to a service | Contract · Explicit consent (Art. 9) |
Push notification token | Delivering notifications you have enabled | Consent |
Policy acceptance timestamp | Evidencing consent, as GDPR requires | Legal obligation |
2.3 Branch listings
Listings hold a name, tier, service schedule, contact details, photographs and coordinates. Where a branch is claimed, we associate it with the administrator's account.
3. Location data
3.1 Your location
Foreground. Used to sort branches by real distance and to follow a route while you navigate.
Background. Read only while an active route is running, or for features you switch on yourself — geofenced event alerts and home-church alerts. Both are off unless you enable them, and you can revoke the permission at any time in your device settings.
Not required. Search by name or city works with no location access at all.
We do not sell location data, use it for advertising, or share it with data brokers. Ever.
3.2 Branch locations, and why some are deliberately imprecise
Cell fellowships meet in members' homes. Publishing an exact house address to the open internet would be indefensible, so:
Fuzzing. Every unauthenticated request receives coordinates offset to roughly a one-kilometer radius — enough to know a fellowship is in the neighborhood, not enough to stand at a family's front door.
Encryption at rest. Exact coordinates and addresses are encrypted and decrypted only for authenticated members entitled to see them.
Attempting to defeat fuzzing is a breach of the Terms of Service.
4. How we secure your data
In transit. TLS 1.3 for every connection between your device and our servers.
At rest. Solid encryption for exact coordinates and addresses; strong hashing for passwords; refresh tokens stored only as hashes.
Sessions. Access tokens are short-lived (15 minutes); refresh tokens are longer-lived and stored on our side only as a strong hash. On the web they are held in HttpOnly cookies the browser will not expose to scripts; on mobile they are written to the device's secure keystore, falling back to the platform's standard app storage on devices where the keystore is unavailable.
One-time codes. Verification codes and restoration tokens are generated with a cryptographically secure random source and expire quickly — codes within minutes, restoration links after 30 days and a single use.
Access control. Role-based authorization on every protected endpoint; administrative endpoints require a second credential beyond a valid session.
Abuse resistance. Rate limiting across the API — 100 requests per minute in general, tightened to 15 per minute on geospatial queries so the map cannot be harvested.
Biometrics. If you enable fingerprint or face unlock, that check happens entirely on your device. We never receive your biometric data.
No system is perfectly secure. If a breach ever affects your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware, and tell you directly where the risk to you is high.
5. Who we share data with
We do not sell personal data. We do not serve advertising. We share only with the processors below, each under a written data processing agreement, and only with what they need.
Processor | Purpose | What it receives |
|---|---|---|
Mapbox | Map tiles, routing, geocoding | Coordinates needed to draw the map and compute a route, plus technical request data. Sent directly from your device. |
Cloudflare R2 | Storage of branch and profile images | Uploaded images. Access is via short-lived signed URLs. |
Resend | Transactional email — verification, password reset, policy notices | Email address and message content. |
Expo Push Notification Service | Delivering push notifications | Device push token and notification content. |
KingsChat (only if you use it to sign in) | Federated sign-in | The profile fields you approve at sign-in. |
Contabo | Hosting the application and database | Data processed on our behalf as infrastructure. |
We also share where the law requires — a valid legal request, or to protect the rights and safety of members and congregations.
5.1 Carpool
When you accept a carpool arrangement, limited contact details are shared between driver and rider so the pickup can happen. Only what is needed is shared, and only with the counterparty.
6. International transfers
Loveworld Nation spans continents, and some processors operate outside your country. Where personal data leaves the UK or EEA we rely on an adequacy decision, or on Standard Contractual Clauses with supplementary measures where required. You may request details of the safeguards used.
7. How long we keep data
Data | Retention |
|---|---|
Account and profile | Until you delete it, then a 30-day restoration window, then permanent erasure |
Verification and reset codes | Minutes — deleted on use or expiry |
Restoration tokens | 30 days, single use |
Carpool routes and requests | Retained for the journey and a short period after, for safety and dispute handling |
Notifications | Until you delete them, or the account is erased |
Technical logs | A short rolling window for security and debugging |
Administrative audit records | Kept indefinitely. When a member of our staff performs a privileged action — approving a branch claim, changing an account’s role, removing a listing — we record the action, the staff member who performed it, and the device and IP address it came from. These records concern our staff rather than ordinary members, and we keep them for as long as the platform operates so that any past action remains accountable and any security incident remains investigable. |
Branch listings | For as long as the branch is listed — these describe a congregation, not an individual |
8. Your rights
Wherever you live, you can exercise the following. Several are self-service in the app; the rest reach us at [email protected]. We respond within one month, free of charge.
Access — request a copy of your data. Self-service export is built into the app.
Rectification — correct anything inaccurate, from your profile screen or by writing to us.
Erasure — delete your account in the app. You get a 30-day window to change your mind; after that it is permanent and cannot be recovered.
Restriction and objection — including objecting to processing based on legitimate interests.
Portability — receive your data in a structured, machine-readable format.
Withdraw consent — at any time, without affecting processing already carried out.
Complain — to your local supervisory authority. In the UK that is the Information Commissioner's Office; in Nigeria, the Nigeria Data Protection Commission.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
9. Regional rights
United Kingdom & EEA. The rights above are your UK/EU GDPR rights in full.
Nigeria (NDPR / NDPA). Equivalent rights apply, and we operate as a data controller under the Nigeria Data Protection Act.
California (CCPA/CPRA). You have rights to know, delete, correct and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not process sensitive personal information for inferring characteristics.
Other jurisdictions. Where local law grants stronger rights — including South Africa, Kenya, Ghana, Canada, Brazil, India and Australia — those rights apply.
10. Children
KingsRoute is not directed at children below the age of digital consent in their country (16 in the UK/EEA unless lowered locally, 13 elsewhere). We do not knowingly collect their data. If you believe a child has created an account, write to [email protected] and we will remove it.
11. Cookies and local storage
The public website sets no advertising or analytics cookies. Full detail, including the single preference we store on your device, is in the Cookie Policy.
12. Changes to this policy
Every published version carries a version number and publication date, shown at the top of this page. For material changes we notify registered members in advance by email or in the app.
Continued use of the Service after the effective date means you accept the updated policy. Where a change requires your consent — including anything affecting religious-affiliation data under Article 9 — we will ask you for it explicitly rather than infer it from your continued use.
13. Contact
Data protection enquiries and general support both reach us at [email protected]. Please put "Data protection" in the subject line so a rights request is routed and clocked correctly.
Loveworld Incorporated (Christ Embassy), Loveworld Conference Centre, Kudirat Abiola Way, Oregun, Ikeja, Lagos, Nigeria.