Privacy Policy

1. Introduction

MKDSCPLS ("we," "our," or "us") operates the website mkdscpls.com (including go.mkdscpls.com) and provides a Christian discipleship platform with related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Services.

By creating an account or using our Services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our Services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Password (stored as a cryptographic hash -- we never store your actual password)

2.2 Profile Information

You may optionally provide:

• Profile photo (uploaded and stored on our CDN)
• Phone number (for contact preferences you control)
• Organization or church affiliation

2.3 Platform Activity Data

As you use our Services, we collect data related to your participation:

• Course progress, workbook answers, and assessment responses
• Reading plan progress and completion status
• HEAR journal entries and personal reflections
• Group memberships and participation
• Badges and achievements earned
• Feedback submissions and support tickets
• A few key moments in how you use MKDSCPLS and GO, such as opening your DNA Story, reading it to the end, or starting a suggested next step. We keep these in our own database, use them only to see what helps people grow and what we should improve, and never send them to Google or any other analytics company. Church leaders do not see them.

2.4 Sensitive Personal Information

2.5 Payment Information

When you subscribe or make a payment, your payment card details are collected and processed directly by Stripe. We do not receive, store, or have access to your full credit card number. We receive only transaction confirmations, subscription status, and limited billing details (such as the last four digits of your card) from Stripe.

2.6 Information Collected Automatically

When you use our Services, we may automatically collect:

• Log Data: IP address, browser type, pages visited, timestamps
• Device Information: Device type and operating system
• Usage Data: Features used, courses accessed, login frequency
• UTM Parameters: If you arrive at our site via a marketing link, we may store campaign tracking parameters (such as utm_source, utm_medium, and utm_campaign) in your user preferences to understand how you found us

2.7 Information from Third Parties

• Stripe: Transaction confirmations and subscription status
• Organization Administrators: Your church or organization may provide your information when inviting you to groups or courses

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Operate Services: Deliver courses, manage groups, track progress, process subscriptions and payments, and coordinate mission trips
• Communicate With You: Send reading plan reminders, course notifications, subscription confirmations, and important service announcements via email
• Improve Our Services: Analyze usage patterns, diagnose technical issues, and develop new features
• Ensure Security: Protect against fraud, unauthorized access, and abuse; monitor for errors and service disruptions
• Support Leaders and Administrators: Enable group leaders and organization administrators to view participant progress and provide guidance within their assigned scope
• Process Payments: Handle subscription billing, donations, and mission trip payments through Stripe
• Understand Marketing Effectiveness: Use UTM tracking data to understand which channels bring users to our platform
• AI Features: When you use a feature such as your DNA Story, some of your answers are sent to an AI service to produce the result. Section 4.5 explains exactly what is sent and when

4. Third-Party Services

We rely on a limited number of third-party service providers to operate our platform. These providers only receive the minimum information necessary to perform their functions:

4.1 Stripe (Payment Processing)

We use Stripe to process subscriptions and payments. When you make a payment, your card information is sent directly to Stripe and is subject to Stripe's Privacy Policy. We do not store your full payment card details on our servers.

4.2 DigitalOcean (Hosting and File Storage)

Our application servers and database are hosted on DigitalOcean infrastructure in the United States. User-uploaded files (such as profile photos and content library resources) are stored on DigitalOcean Spaces, a cloud object storage service with CDN delivery.

4.3 Resend (Transactional Email)

We use Resend to send transactional emails including account notifications, reading plan reminders, subscription confirmations, and leader-to-member messages. Resend processes your email address and message content on our behalf.

4.4 Sentry (Error Monitoring)

We use Sentry for application error tracking and performance monitoring. Sentry may receive technical data such as error messages, stack traces, browser information, and IP addresses to help us diagnose and fix issues. Sentry does not receive your personal profile content or journal entries.

4.5 AI Services (Anthropic and Google)

Some features use AI from Anthropic (Claude) and Google (Gemini). Here is exactly what we send, when, and why. Nothing is sent until someone uses the feature, and these features are only for adults (18 and older).

What goes to Anthropic (Claude)

• Your DNA Story. When you create or rework it, we send your Biblical Identity and Spiritual Gifts results (your type, how strongly you lean each way, and your gift scores) and the answer you chose for each assessment question. If you tell us something missed, we send what you wrote too, with names replaced by labels. We never send your name or email.
• Team DNA summaries. When a church leader asks for a team summary, we send each person's type and top gifts, labelled "Person A", "Person B" and so on. People who have turned off DNA sharing are left out.
• Your testimony. When you ask us to combine your story into one testimony, we send the words you wrote for it.
• Your trip summary (GO). Only you can create one, from your own post-trip debrief answers. We send those answers and the trip's destination.
• Scripture research. When you tap Research, we send the verses you selected.
• Finding a course. When you type a question to find a course, we send your question.
• New church sign-ups. When a church registers with an email that does not match its website, we send the person's name, the church's name and its public website text, to check they are listed there.
• Custom reading plans. When a church asks us to write a plan, we send its sermon calendar and the notes it gave us.

What goes to Google (Gemini)

Reading plan drafts, for a second review, and short descriptions we write to make images. Neither contains any member's information. We do not use Gemini for any feature a member uses.

Names are replaced first. Before we send anything you wrote, your name and the names of people in your church are replaced with labels like "Person A", and emails, phone numbers and links are removed. We put the names back only after the answer returns to us. We may not recognize every name, such as a first name on its own or someone outside your church, so please leave other people's names out.

Used only for your result. What we send is used only to produce that result. We never use it to build a profile of you or for advertising.

Whether they keep it or learn from it. Under their paid business terms, neither Anthropic nor Google uses what we send to train their AI. Each keeps it for a limited time only to prevent misuse.

What we never send to any AI service: your email, phone number or address, date of birth, passport or travel documents, health or dietary information, emergency contacts, payment or donation records, HEAR journal entries, leaders' private notes about you, messages, and children's ministry records.

See How Our Content Is Made for how AI-assisted courses, reading plans and articles are reviewed before publishing.

4.6 No Data Sales

4.7 Website Analytics

We use these tools to understand how our websites are used and to keep them fast. None of them is used for advertising, and we do not sell or share this information.

• Inside MKDSCPLS and GO (www.mkdscpls.com and go.mkdscpls.com): no third-party analytics at all. What you read, your assessment answers, your DNA Story, your prayer requests and your trip details are never sent to an analytics company. We keep our own records of your activity to run the service, as described in section 2.3.
• Cloudflare Web Analytics (all our sites): measures visits and page speed without cookies or fingerprinting.
• Google Analytics (startdiscipling.com and missiontripplanning.com only, and only if you allow it): counts visits and pages viewed, how visitors arrived, and general device and location (city level). It sets first-party cookies to recognize a returning browser. We do not send it your name, email address, account or anything you type into a search box.
• Microsoft Clarity (startdiscipling.com and missiontripplanning.com only, and only if you allow it): records clicks, scrolling and mouse movement so we can see where a page is confusing. We configure it to hide all text on the page, so what you type or read is not captured. It sets cookies to recognize a returning browser.

Your choice: on our public websites, Google Analytics and Microsoft Clarity load only after you choose "Allow analytics". You can change your choice at any time on the Your Privacy Choices page (startdiscipling.com/privacy-choices or missiontripplanning.com/privacy-choices). If your browser sends a Global Privacy Control signal, we treat it as a choice not to allow analytics and neither tool loads.

This data is processed by Google, Cloudflare and Microsoft under their privacy policies.

5. Information Sharing and Disclosure

Beyond the third-party services described above, we may share your information in these circumstances:

5.1 Within the Platform

• Group Leaders: Can view participant progress, course responses, and contact information (if you have enabled sharing) for their assigned groups
• Organization Administrators: Have access to member data within their organization
• Trip Leaders: Can access participant information necessary for mission trip coordination
• Fellow Participants: Limited profile information (name, profile photo) may be visible to others in your groups. You can control phone and email sharing through your contact preferences
• Your mission trip team: Teammates see your phone number only if you choose to share it; your trip leaders always can, and leaders' numbers are shown to their team. Teammates see only their own flights, seats and pickup addresses, not yours. Files you upload are visible only to you until you share them with your trip leaders or the whole team; a file that meets a trip requirement is always shared with your leaders

5.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers

If MKDSCPLS is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. Cookies and Tracking Technologies

We use a minimal set of cookies to operate our Services:

• Session Cookie (JWT): A JSON Web Token stored as a cookie to maintain your authenticated login session. This is essential for the platform to function and cannot be disabled while using the Services.
• Session Storage: We use browser session storage to temporarily hold UTM campaign parameters during your visit so that marketing attribution is preserved when you register.
• Browser storage: We also keep a few settings in your browser, such as notices you've dismissed and, if you take an assessment before signing in, a short reference to it so we can offer to save it to your account. This contains no personal information and you can clear it in your browser at any time.
• Trips saved for offline use (GO): When you open GO, a read-only copy of each mission trip you are on that starts within 45 days, or is under way, is saved in your phone's or computer's browser so you can see it with no signal. It holds the trip itinerary and lodging, your own flights and rides, team meetings, prayer requests, your teammates' names, and your trip leaders' names and phone numbers. It never holds passport details, dates of birth, medical information, emergency contacts or payment details. Signing out of GO deletes it from that device, and the next time you open GO a week or more after the trip ends, it is removed. Anyone who can unlock your device can see it, so keep your device locked.

Besides the cookies above, our websites use the analytics cookies described in section 4.7 (Google Analytics, and Microsoft Clarity on our public websites). We do not use advertising cookies, advertising pixels or social media tracking widgets, and we do not take part in cross-site behavioral advertising. You can block or clear these cookies in your browser without affecting your ability to use the platform, apart from staying signed in.

You can clear cookies through your browser settings at any time, though doing so will log you out of your account.

7. Data Security

We take the security of your information seriously and implement the following measures:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS enforced via HSTS)
• Password Security: Passwords are hashed using industry-standard cryptographic algorithms and are never stored in plain text
• Content Security Policy: We deploy CSP headers to protect against cross-site scripting and injection attacks
• Input Sanitization: User-submitted content is sanitized to prevent malicious code injection
• Access Controls: Role-based access ensures users only see information they are authorized to view
• Security Headers: We employ security headers including X-Content-Type-Options, Referrer-Policy, and Permissions-Policy
• Subresource Integrity: Third-party scripts loaded from CDNs are verified using SRI hashes

8. Data Retention

We retain your information for as long as necessary to provide our Services and fulfill the purposes described in this policy:

• Account Data: Retained while your account is active. After a deletion request, we will remove your data within 30 days, except where retention is required by law.
• Course Progress and Journal Entries: Retained for the duration of your account
• Subscription and Payment Records: Retained for 7 years for financial and tax compliance
• Mission Trip Records: Retained for 7 years for legal and financial compliance
• Error Logs (Sentry): Automatically expire per Sentry's retention policies (typically 90 days)
• Uploaded Files: Profile photos and content are deleted when you delete your account or remove the file, though CDN-cached copies may persist briefly

9. Your Rights and Choices

You have the following rights regarding your personal information:

9.1 Access and Portability

You can access most of your personal information through your account dashboard, including your profile, course progress, journal entries, and assessment results. You may request a complete copy of all data we hold about you by contacting us.

9.2 Correction

You can update your profile information, contact preferences, and notification settings at any time through your account. For other corrections, contact us.

9.3 Deletion

You may request deletion of your account and personal data by contacting us. Please note:

• Some data may be retained for legal, financial, or legitimate business purposes (such as payment records)
• Anonymized or aggregated data that cannot be linked back to you may be retained
• Content you shared within groups may persist in other participants' records

9.4 Communication Preferences

You can manage your email notification preferences (such as reading plan reminders) in your account settings. You can also control whether your phone number and email are visible to group members through your contact preferences.

9.5 Additional Rights for California Residents (CCPA)

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to non-discrimination for exercising your privacy rights
• We do not sell personal information, so the right to opt out of sale does not apply

9.6 Additional Rights for EEA/UK Residents (GDPR)

• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

10. Children's Privacy (COPPA Compliance)

MKDSCPLS is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, you may not create an account or use our Services.

For users between the ages of 13 and 17:

• We recommend parental or guardian awareness and consent before using our Services
• For mission trip participation, we require parental or guardian consent and a guardian account
• AI features (see section 4.5) are not available to anyone under 18
• Guardians can access, review, and request deletion of their minor's information

If you believe we have inadvertently collected information from a child under 13, please contact us immediately at [email protected] and we will promptly delete the information.

11. International Data Transfers

Our servers and third-party service providers are located in the United States. If you access our Services from outside the United States, your information will be transferred to and processed in the United States. By using our Services, you consent to this transfer. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

• Update the "Effective Date" at the top of this page
• Post the revised policy on our website
• For material changes, send an email notification to registered users

Your continued use of the Services after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

13. Contact Us