Privacy

Last updated 22 August 2026

Stewrd is church management software operated by Loxicom. This explains what we hold, why, and who it goes to. It is written to be read rather than to be survived.

Who is responsible for what

Your church controls its own records. The directory, giving history, attendance and notes belong to the church that entered them. Loxicom stores and processes that data on their instructions — we do not decide what a church collects or who at that church may see it.

We control your account. Your name, email, password and the churches you belong to are held by us so you can sign in.

If you want a church's records about you changed or deleted, ask that church. If you want your Stewrd account closed, email us.

What we hold

• Your account — name, email, phone if you give one, and a hashed password. If you sign in with Apple or Google we store the identifier they give us, not your password.
• Your profile — the details you keep about yourself, which you can edit at any time, and which are shared with churches you actively belong to.
• Church records about you — your membership status, household, groups, attendance, and giving. These are the church's, and are visible only to people at that church whose role includes them. Giving amounts are behind a separate permission that most staff roles do not have, and every read of a contribution record is logged.
• Children's check-in — a child's name, who is authorised to collect them, and a record of each check-in and collection, including any refused collection. Kept because it is a safeguarding record.
• Technical — sign-in times, IP address and device information, kept to secure accounts and diagnose faults.

Who we send it to

• Stripe processes payments. Card details go directly to Stripe and never reach our servers. A church's donations are charged on that church's own Stripe account.
• Apple and Google deliver push notifications to your device, and verify your identity if you sign in with them.
• An AI service reads bank statements and counting sheets, and only if the church has switched that on. It is off by default and there are two separate switches, because a bank statement and a sheet listing who gave what are different kinds of confidential. What is sent is the document itself; the results are checked by arithmetic and confirmed by a person before anything is recorded.
• Planning Center, if your church chooses to connect it, to send giving records across for their statements.

We do not sell personal information, and we do not use it to target advertising.

Church staff and support

Loxicom staff do not have standing access to a church's data. Support access is granted by the church, for a stated length of time, is read-only, and expires on its own. Every page viewed under such a grant is written to that church's own audit log, where they can read it.

Keeping it

A church keeps its records for as long as it needs them, including after you leave — giving statements and safeguarding records have to survive a person leaving a congregation. Leaving a church stops that church receiving further updates to your profile. Closing your Stewrd account removes your login; it does not erase a church's record of gifts you made, which they are required to keep.

Your choices

• Edit your own details at any time, in the app.
• Turn off push notifications, by category, in the app.
• Leave a church, which stops your profile updates reaching them.
• Ask a church for a copy of what they hold about you, or ask them to correct it.
• Email support@loxi.dev about your account itself.

Children

Stewrd is not directed at children. Records about a child are entered by their church and their parent or guardian, and a child does not hold their own Stewrd account.

Changes

If this changes in a way that matters, we will say so in the app rather than quietly changing the date at the top.

This is a plain-English description of how the software actually behaves. It has not been reviewed by a lawyer, and it is not a substitute for advice about your own obligations.