Article 14
Security and privacy basics
How sign-in works, who can see what, how visitor data is handled, and what you are responsible for.
Short version: no passwords to leak, nothing a visitor writes is ever public, and you control how long we keep it.
Sign-in without passwords
You sign in with a one-time link sent to your email. It works once and expires in 15 minutes. If a link arrives that you did not request, ignore it. Protect your email account with a strong password and two-step verification, because your email is the key to everything.
Who can see what
- You (the owner) see everything: content, inbox, billing, team, domain.
- Editors you invite see content and the inbox, not billing.
- People on your notification list get each form submission by email.
- Emberline staff can open a read-only view of your account, including your inbox, when you ask us for help or when it is needed to keep the service running. We log every such view.
- Visitors see only the published site. Never the inbox, never drafts.
Visitor data
Forms collect what the visitor types, plus the time and an IP address for spam protection. Submissions are emailed to the addresses you set and stored in your inbox. They are never published. Prayer requests are deleted after 90 days by default; you can shorten or extend that in Settings. You can delete any submission at any time.
Treat prayer requests as confidential. Do not forward them outside your care team, and never post one publicly without asking the person.
Children
Do not collect information about children through your forms. For photos of minors, get a parent's permission before publishing, and take a photo down the same day if a parent asks.
HTTPS and hosting
Every site is served over HTTPS. Content is versioned, so any change can be undone. Hosting is on a global network with protection against common attacks.
What we keep and share
When an account ends, your site and data are kept for 30 days, archived for 30 more, and then permanently deleted on day 60 (or after 7 days if you ask for immediate deletion in Settings). We keep only billing records, the reserved name of your site's address, the list of guests who asked not to be emailed, and audit logs with email addresses replaced by a one-way hash. Backups age out within 30 days.
We do not sell data. We use a short list of providers to run the service (payments, email, hosting and content storage). The categories and retention periods are in the privacy policy.
Your site's own privacy page
Every template includes a privacy page written for your visitors. Read it once and make sure it matches what you do.
Reporting a problem
If you think your account was accessed by someone else, or you spot a security issue, email hello@emberline.studio with "Security" in the subject. We treat these first.