Privacy policy
Last updated 4 October 2026
Introit is a service that hosts websites for Lutheran parishes. It is run by Hallowed Gains LLC (“we”, “us”). This policy says what information Introit handles, why, who else sees it, and how long it is kept. If anything here is unclear, write to contact@hallowedgains.com.
Who this covers
Three kinds of people use Introit, and we handle different information for each:
- Visitors to introit.church or to a parish’s website.
- Parish staff who sign in to a parish’s console to edit its website.
- Anyone who writes to us.
A parish decides what to publish on its own website: its times of service, the names of its clergy and staff, its photographs. The parish is responsible for that content, and we host it on the parish’s behalf.
Visitors
Introit’s pages have no advertising, no analytics, no tracking scripts, and no scripts of any kind. We do not build profiles of visitors or follow them from site to site.
- One cookie, only if you ask for it. If you choose the light or dark version of a parish’s website, a small cookie remembers that choice. Nothing else is stored in your browser.
- Request logs. Like every website, ours receive your IP address, the page you asked for, and what browser you are using. We keep these records for seven days to find faults and stop abuse, then they are deleted.
- Our host. Introit runs on Cloudflare, which processes every request to deliver it and to protect the sites from attack. Cloudflare’s handling of that information is described in its privacy policy.
Parish staff
To let the right people edit a parish’s website, we keep:
- Your email address, and your name if you give it. These identify you and are how we reach you about your account.
- A password, if you set one, stored only in a scrambled form (a one-way hash). We never see or store the password itself.
- If you sign in with Google, the email address, name, and account identifier Google shares with us when you choose to sign in. We ask Google for nothing more: not your mail, your files, or your contacts.
- Which parishes you may edit, in what role, and who added you. A parish’s administrators can add your address, and when they do we email you to say so.
- A sign-in cookie that keeps you signed in, which ends when you sign out or after thirty days without use, and a second cookie on a parish’s own address while you use its console, which ends when you close your browser or sign out.
- Counts of sign-in attempts, by address and by network address, to stop anybody guessing passwords. They are stored in scrambled form (a one-way hash), not as the addresses themselves, and deleted within a day.
- A record of changes: which address changed what part of the website, and when, and when each person last signed in. The parish’s administrators can see this record. It keeps the most recent few hundred changes.
- What you upload: photographs, service folders, and a logo, stored with the parish’s website. If the parish connects a calendar it keeps elsewhere, we read that calendar once a day to show its entries on the website.
Introit’s use and transfer of information received from Google will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use that information only to sign you in.
Anyone who writes to us
If you email us, we keep your message and address to answer you and to keep a record of what was agreed. We do not add you to a mailing list.
What we use it for
- To run the service: host the websites, sign people in, and keep the sites working and safe.
- To send the emails an account needs: confirming your address, resetting a password, an invitation to a parish (with a link that works once, within a week), and notices about the service or your parish’s subscription.
- To answer you when you write to us.
We do not sell personal information, share it for advertising, or send marketing email.
Who else sees it
Only the companies that help us run Introit, and only for that purpose:
- Cloudflare, which hosts the service, stores its data, and sends its email.
- Google, if you choose to sign in with a Google account.
- Stripe, once Introit begins taking payment, which will handle card and bank details. We will never see or store a full card number.
We will also disclose information when the law requires it, and will tell the people concerned unless we are forbidden to.
How long it is kept
- Request logs: seven days.
- An account: for as long as it exists. Ask us and we will delete it.
- A parish’s website and uploads: for as long as the parish uses Introit, and for twelve months after it stops, so that it can come back or take a copy. After that it is deleted.
Your choices
You may ask us for a copy of the information we hold about you, to correct it, or to delete it, by writing to contact@hallowedgains.com. A parish may take a copy of its whole website at any time. If you are in a place whose law gives you further rights over your information, we will honour them.
Children
Introit’s accounts are for adults acting for a parish. We do not knowingly collect information from children under 13. A parish that publishes photographs or names of children on its website is responsible for having the permission of their parents.
Security
Every page is served over an encrypted connection. Passwords are stored only as hashes, sign-in links expire after an hour and work once, and each parish’s data is kept apart from every other’s. When you choose a password, we check it against Have I Been Pwned’s list of passwords leaked from other websites; only the first five characters of a scrambled form of it are sent, never the password itself. No system is perfectly secure; if we learn of a breach that affects you, we will tell you promptly.
Changes
If this policy changes, the new version will appear here with a new date. If a change affects how we use information we already hold, we will tell the parishes using Introit before it takes effect.