Ochlos ("we," "us," "our") is an Arizona nonprofit corporation operating the community at ochlos.org. This policy explains what we collect, why, and what you can do about it.

What we collect

• Account info. When you register, we store your handle, hashed password (we never see your plaintext password), and — if you provide one — your email address.
• Content you share. Messages, prayer requests, verse-wall reflections, posts, comments, and any images you upload. Prayer-wall submissions can be anonymous if you choose.
• Light technical data. IP address, browser type, and timestamps — used for abuse prevention and operations. We do not use third-party advertising trackers.
• Prayer requests and safety. With each prayer request, and with messages or prayers whose wording suggests someone may be at risk of harming themselves, we keep the IP address and device/browser information our hosting provider reports, plus which help resources (such as 988) you tap afterward. This is kept for 90 days and then erased — including for anonymous requests. Anonymous means your name isn’t shown to others; it doesn’t switch off these safety records.
• Anonymous usage counts. To understand how Ochlos is used, the site counts visits anonymously, on our own servers: pages viewed, time actively spent, buttons and links tapped, how a visit arrived (for example from a search or social media), and approximate location (country and state or province), looked up from your IP address on our own server — the address itself is not kept. A random number stored on your device lets us count returning visitors without knowing who you are. We never record what you type. Detailed counts are kept for 90 days, then only daily totals remain. No third parties and no advertising. Browsers that send Do Not Track or Global Privacy Control are not counted.
• Cookies. A session cookie keeps you signed in. We do not set advertising cookies.

How we use it

• To run the service: authenticate you, deliver messages, store prayer requests, render your profile.
• To keep the community safe: rate limiting, moderation, abuse investigation.
• To help someone who may be in danger. If what you write suggests you may be at risk of harming yourself, we show you crisis resources right away, privately alert our care team, and record which resources you tap. If we believe someone’s life may be at risk, we may share what we have — including the text, time, IP address and device information — with emergency services or law enforcement so they can help.
• To email you about your account: password resets, prayer-wall "manage your prayer" links, and (with consent) room broadcast notifications.

We do not sell your data. We do not share it with advertisers.

Who can see what

• Public: the prayer wall, verse wall, directory, social feed posts marked Public, and your profile page (if registered).
• Friends only: social posts you choose to scope to friends.
• Anonymous prayer requests: only your reflection text is shown; your handle is hidden.
• Hosts & admins: can see all posts/messages they moderate, plus audit logs of moderation actions.
• Safety records: only our senior administrators can see the IP address and device information described above, and only for posts flagged because someone may be at risk.

Service providers we use

• Cloudflare — site hosting, DNS, DDoS protection.
• Fly.io — chat backend compute and storage.
• Cloudflare R2 — encrypted image storage (avatars, cover photos, post images).
• Resend — transactional email (password reset, verification, prayer-wall manage links).
• Stripe — donation processing (when you donate). Stripe handles payment data directly; we never see card numbers.

Your choices

• Edit or delete your profile, posts, prayer requests, and comments from your account.
• Submit prayer requests anonymously.
• Email hello@ochlos.org to request export or deletion of your data.
• Block users to hide their content from your view.

The Ochlos mobile app

The Ochlos app for iOS and Android shows the same community as ochlos.org. It works by loading our web experience, and it may download updated web content (HTML, CSS, and JavaScript) from our own servers so the app stays current between store releases. We do not fetch or run executable code from third parties, and the app contains no third-party advertising or analytics SDKs.

• Sign-in. Your sign-in is stored securely on your device (iOS Keychain / Android encrypted storage) so you stay signed in between launches.
• Notifications. If you choose to turn on push notifications, we store a device notification token for the sole purpose of delivering the notifications you opt into. You can turn notifications off at any time in your device settings.
• Device & technical data. The same light technical data described above (for operations and abuse prevention). We do not collect advertising identifiers.

Children

Ochlos is not directed to children under 13. If you believe a child has registered, please contact us and we will remove the account.

Changes to this policy

We will update the "Last updated" date when we change this policy. Material changes will be announced on the site.

Contact

Questions? Email hello@ochlos.org.

---

We may refine the wording of this policy over time; we will update the "Last updated" date above and announce any material changes on the site.