Privacy Policy

What we keep, what we do with it, and how to delete it.

Steeple is a product of Heard Studio LLC, Brunswick, Georgia ("we", "us"). This policy covers the website at sundaydone.church, the Steeple app at app.sundaydone.church, and Sunday, Done, our done-for-you service. It sits alongside our Terms of Service. Questions or requests: hello@sundaydone.church.

The short version

  • Your church owns its video. We use it to make your Sunday set and for nothing else.
  • In the app, nothing posts to a connected account until a person at your church approves that item. On Sunday, Done, your order sets what we publish for you.
  • We don't sell your information, show you ads, or use your recordings to train AI models.
  • You can disconnect any account or delete everything at any time. See the data deletion page.

The website form

When you send a Sunday or request early access we keep what you type (church, city, your name, role, email, the link and your notes), the plan you asked about and the time you sent it. We use it to run your Sunday and send the review page, and to tell you when your spot opens. We do not add you to any marketing list. Form details are deleted 12 months after you send them, or sooner if you ask. To keep the form from being flooded we also keep a scrambled, one-way code made from your IP address and the name of your browser; both are erased after 30 days.

Your Steeple account

We keep the name and email of each person on your church's account, their role, your church's name and settings (brand colors, caption style, thumbnail template, service times), the clip choices you make, so Steeple can learn your church's preferences, and a record of what each person approved and when. We use it to sign you in, run your Sundays and send you notices about them. Sign-in uses a one-time email link or Google sign-in; with Google sign-in we receive your name, email address and profile picture and nothing else from your Google account.

Your service recordings and what we make from them

We store the recordings you upload or link from your own storage (for example Google Drive, Dropbox, Vimeo or your streaming provider), transcribe them, and make the sermon video, chapters, captions, clips, thumbnails and suggested titles and descriptions. Source recordings are deleted 14 days after we receive them and outputs 90 days after they are made, so the review page keeps working without holding your video forever. Clips frame the speaker; clips that may show congregation faces or children are flagged for you, and on Sunday, Done we take down a posted clip on request; in the app, you can delete it on the platform.

Connected YouTube accounts

Steeple uses YouTube API Services. When you connect a YouTube channel you sign in with Google and choose to grant Steeple access. We ask Google for two permissions: one to upload videos, and a broader one Google describes as managing your YouTube account. We use the broader one only to add captions and to change the schedule, title, description, thumbnail or visibility of videos Steeple uploaded for you. We never use it to read, change or delete your other videos, comments, subscribers or analytics. What we access, store and use:

  • Access tokens that let Steeple act for you, stored encrypted, used only to carry out an action you approved.
  • Your channel's ID, name and picture, so you can see which channel is connected.
  • The videos Steeple posted for you: their IDs, links, upload status and settings, so the review page can show what went out.

We do not share YouTube data with anyone except the service providers listed below that run Steeple for us. YouTube data we store is refreshed or deleted at least every 30 days. When you disconnect a channel in Steeple, we revoke Steeple's access with Google immediately and delete the YouTube data we stored within 7 days. If you remove Steeple from your Google Account instead, we delete it within 7 days of learning of it, and never later than 30 days. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of your data is governed by the Google Privacy Policy.

You can revoke Steeple's access at any time from your account settings in Steeple (Disconnect), or from your Google Account's security settings at myaccount.google.com/permissions.

Steeple's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connected Facebook Pages and Instagram accounts

When you connect through Facebook, you choose which Page and Instagram professional account Steeple may use. We receive the list of Pages you manage and, for the ones you choose, the Page's name and ID, the linked Instagram account's name and ID, and access tokens, stored encrypted. We use them only to publish the posts, Reels and captions you approved. We use the Page read permission only to confirm that our own posts published and to get their links. We do not read your messages, followers or insights. You can disconnect in Steeple, or remove Steeple in Facebook under Settings & privacy → Settings → Business integrations. Data from Meta is deleted within 7 days of disconnecting, or when you follow the steps on the data deletion page.

Connected TikTok accounts

When you connect TikTok, we receive your account's display name, avatar and an account ID, the posting options TikTok allows for your account, and access tokens, stored encrypted. We use them only to post the videos you approved, with the caption, privacy setting and interaction settings you chose on the review page. You can disconnect in Steeple, or in TikTok under Settings and privacy → Security → Manage app permissions. TikTok data is deleted within 7 days of disconnecting.

Who handles it for us

We use a small number of service providers, each under contract and each seeing only what it needs for its job:

  • Cloudflare: hosts the site and app, and stores your account, recordings and outputs.
  • Modal: renders clips and videos on cloud computers.
  • Groq (and OpenAI as a backup): turns speech into text.
  • Anthropic: the AI model that drafts the clip plan, titles and descriptions and checks captions.
  • A posting partner, named here before any church connects through it: carries approved posts to YouTube, Facebook, Instagram or TikTok while our own platform approvals are pending. When you connect an account through it, you grant access to that partner's app, and its terms and privacy policy also apply. It holds the access tokens for those accounts.
  • Stripe: takes payments. We never see or store your full card number.
  • Resend: delivers our email. Our own inbox is on Google Workspace.
  • Our own computers in Brunswick, Georgia, where Heard Studio staff edit Sunday, Done sets.

We share information otherwise only if the law requires it, or with a buyer of Steeple who agrees to keep this policy.

Cookies and tracking

The website sets no cookies of its own and runs no ads or third-party trackers. It remembers your light or dark choice in your browser's storage and loads fonts from Google Fonts, which sees your IP address. The app uses a sign-in cookie to keep you signed in. Cloudflare, which protects both, may set a security cookie to block bots. If we add analytics, we will update this policy first.

Keeping it safe

Everything travels over HTTPS. Access tokens are encrypted at rest, and only the parts of Steeple that post for you can use them. If we ever learn of a breach that affects your information, we will tell you promptly.

Children

Steeple accounts are for adults acting for a church. We do not knowingly collect information from children under 13. Children may appear in a service recording your church sends; those clips are flagged for you and are never posted without your approval.

Your choices

You can see, correct, download or delete your information at any time. Most of it is in your account settings; for anything else, write to hello@sundaydone.church and we will answer within 7 days. Deleting your account removes every connected-account token immediately and the data we received from YouTube, Facebook, Instagram and TikTok within 7 days. Your recordings, outputs and settings are removed from our live systems within 7 days and from backups within 30 days. After an account closes we keep, for two years, a record of what was approved, by whom and when (not the video), to resolve disputes. We delete everything else.

Changes

If we change this policy in a way that matters, we will post it here with a new date and email account owners before it takes effect.

Updated October 3, 2026.