Privacy Policy

• Every plan has an account (your email and name). On the free Steward plan, your financial records and receipts still never leave your device; we do not have them.
• On Steward+, we store your records solely to provide the service to you. We do not sell your information, share it with advertisers, or mine it.
• If your subscription lapses, we do not delete your records. You can still open and export everything you saved.
• If you opt in, we send occasional emails about the housing allowance and related services for pastors: never spam, and you can unsubscribe anytime.
• Payments are handled by Stripe; we never see your card number.

MHA Tracker is operated by Ministerial Housing Allowance Tracker LLC, a Hawaii limited liability company doing business as MHA Tracker ("we," "us"). This policy describes what information we collect through the MHA Tracker application and website, how we use it, and the choices you have. The Service is operated from the United States and your information is stored in the United States. Contact: support@mhatracker.com.

Steward requires an account, so we collect your email address, password (stored as a cryptographic hash; we cannot read it), and your name, and the church or ministry name you provide. Your financial records themselves (expenses, designations, estimates, monthly costs, and receipt files) are stored in your browser's storage (localStorage and IndexedDB) on your device only and are never transmitted to our servers. That also means we cannot back them up or recover them: if you clear your browser data or lose the device, they are gone.

The optional answers on your profile (whether you own, rent, or live in a parsonage; your ministry role; who is keeping the records; and the minister's name if that is not you) are stored with your account on every plan, because they describe you rather than your finances. Every one of them can be left blank.

• Account information: email address, password (stored as a cryptographic hash; we cannot read it), and the name and church or ministry name you provide.
• Your records: the expenses, allowance designations, estimates, monthly costs, and receipt images/PDFs you save. Receipts can show details such as your address or partial account numbers; you are welcome to redact anything you do not want stored before uploading. Receipt files are stored in a private bucket, are not publicly accessible, and are only served to your signed-in session through short-lived signed links. Database access is protected by row-level security, so your records are only ever returned to your own authenticated account. One narrow exception: authorized support staff can view your records and receipts through an internal, access-logged support tool, and only to operate the service and help with your support requests, never for advertising or any other purpose. You can see every time that has happened, or that it never has, at Profile → Support access.
• AI receipt scanning: when you choose to scan a receipt, that image or PDF is sent to Anthropic, our AI provider, which reads it and returns the date, amount, and payee for you to review. Scanning only happens when you start it. Under Anthropic's commercial terms, the documents you send are not used to train their models; Anthropic may retain a scanned document for up to 30 days for safety and security purposes under those terms, then deletes it. We keep a count of how many scans each account has used so we can apply monthly limits.
• Rent estimates: when you choose to look up your address, that address (and the optional bedroom, bathroom, and square footage details you enter) is sent to RentCast, a rental data provider, which returns an estimated market rent. Lookups only happen when you start one. We deliberately do not record which account looked up which address: our cache of estimates is stored by address alone, with no link to any user. We keep only a count of how many lookups each account has used so we can apply monthly limits.
• Address suggestions: as you type your address into the rent estimate lookup, the text you have typed so far is sent to Mapbox, a mapping provider, which suggests matching addresses so you can pick yours instead of spelling it out. Because the request comes from your own device, Mapbox also sees your network address and uses its rough location to list nearby streets first. We do not record what you typed or which suggestion you picked; only the address you then choose to look up is handled as described above.
• Exchange rates: if you record an expense you paid in another currency, we ask Frankfurter, a free public exchange rate service carrying European Central Bank reference rates, what that day's rate was, so the rate is filled in for you. The request is made by our server rather than your device, and all it contains is the currency code and the date. Nothing about you, your account, or the expense is sent, and the answer is the same for everyone who asks about that currency on that day.
• Billing: handled by Stripe, Inc. We receive and store your subscription status and Stripe identifiers, never your card number. Stripe's handling of your payment details is governed by Stripe's own privacy policy.
• Technical logs: our hosting providers keep standard server logs (IP address, request time, user agent) for security and reliability, for up to 30 days.

From the Profile page you can send us a review of the app or an idea for something it should do. We store what you write alongside your account so we can follow up with you about it.

Ideas are for us and are never published. A review is different. If you tick the box giving permission, and only then, we may publish your review on our website along with the name, role, and location you choose to give us. Publishing is a public disclosure, so it is entirely your decision: the box is never ticked for you, and we cannot tick it on your behalf. We publish only reviews that real users actually wrote. We never write one ourselves or put words in anyone's mouth. If a reviewer received anything of value from us, we say so next to the review.

You can change your mind at any time. Email support@mhatracker.com and we will take your review down. A review you gave us permission to publish can remain on the website after you delete your account, so if you would like it removed, tell us and we will remove it.

To provide, secure, and improve the service: authenticating you, storing and syncing your records (Steward+), processing your subscription, responding to support requests, and sending essential service emails (confirmation, password reset, billing, renewal reminders, and important service notices).

We also send occasional emails about the housing allowance and related services we offer to pastors and churches, but only if you chose to receive them when you created your account or later in your profile. We will not sell your information or spam your inbox, every such email includes an unsubscribe link, and unsubscribing never affects your account or essential service emails.

We do not sell your personal information and we do not use your financial records for advertising or share them with data brokers, ever.

We use a small set of processors to run the service:

• Supabase: database, authentication, and file storage
• Vercel: application hosting
• Stripe: payment processing
• Anthropic: AI receipt scanning, and only for documents you choose to scan (Steward+)
• RentCast: rent estimates, and only for addresses you choose to look up (Steward+)
• Mapbox: address suggestions while you type in the rent estimate lookup (Steward+)
• Resend: delivery of the emails we send you
• Backblaze: a nightly backup copy of receipt files, so a technical failure cannot take your records with it
• Amazon Web Services: holds records from our original iPhone app while we finish moving longtime users over (see section 8)

Each receives only what it needs to perform its function and is bound by its own security and privacy obligations. We do not share your information with anyone else except as required by law (for example, a valid legal request) or to protect the rights, safety, or security of users or the service. If the business is sold, merged, or reorganized, your information may be transferred to the successor, who will be bound by this policy, and we will tell you before that happens.

We use only functional cookies: authentication session cookies, and a single preference cookie that remembers which plan your device is on. No advertising or cross-site tracking cookies. We do not track you across other websites, so Do Not Track and Global Privacy Control browser signals make no difference to how we operate.

• Steward+ data is retained while your account exists so your multi-year records stay intact; that is the product's purpose.
• If your subscription lapses, we do not delete your records. If a renewal payment fails, you keep full access for 60 days while the payment is retried, so an expired card or a renewal notice lost in a spam folder does not cost you your records. After that, and after a subscription you cancel reaches the end of the period you paid for, your account becomes read-only: you can still open, read, and export everything you saved, you just cannot add, edit, or delete records until you restart Steward+. Your records stay for as long as your account exists, with one exception: if an account has not been signed into for three years, we may delete it after emailing you at least 60 days in advance with a chance to export.
• You can delete your account yourself at any time, without asking us: go to Profile → Delete account. This permanently removes your expenses, designations, estimates, monthly costs, and receipt files, and cancels any active subscription. Deletion is immediate and cannot be undone, so export your records first (Reports → CSV, PDF, or receipts ZIP). If you would rather we do it for you, email support@mhatracker.com and we will action it within 30 days.
• A few things intentionally outlive your account: messages you sent us through the contact form, which we keep as business correspondence, including the name and email address you wrote from, with the link to your account removed; payment records held by Stripe, which we and Stripe are required to keep for tax and accounting purposes; an internal record that a support action took place, so our access log stays complete and honest; any review you gave us permission to publish, which we will remove on request; and, if you chose to tell us why you left, that answer, which is stored with nothing that identifies you. Residual copies of database records sit in our provider's encrypted daily backups, which are kept for seven days and then roll off. Receipt files are copied once a day into a separate encrypted backup we keep so your records survive a disaster on our side. When you delete a receipt or your account, the file leaves that backup on its next daily run, and any older backup copies roll off within 30 days.
• If you used our original iPhone app, the records you created there still live in that older system (hosted on Amazon Web Services) until we retire it, and deleting your account here does not reach them. Email support@mhatracker.com if you would like those older records removed sooner, and we will do it by hand.

Data is encrypted in transit (HTTPS) and at rest by our providers. Access to your records is enforced at the database layer with row-level security; receipt files live in a private bucket scoped to your account. No system is perfectly secure, and you play a role too: use a strong, unique password and keep the devices you use to sign in secure.

If we learn of a security incident affecting your personal information, we will notify you by email to the address on your account as required by applicable law, and we will tell you plainly what happened, what information was involved, and what we are doing about it.

The service is for adults: the Terms require you to be 18 to create an account. The service is not directed to children under 13, and we do not knowingly collect information from children.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. The app provides these directly: your records are viewable in the app, exportable at any time from the Reports tab (CSV, PDF, or a ZIP of every receipt), correctable by editing them, and deletable via Profile → Delete account. For anything else, email support@mhatracker.com and we will respond within 30 days. We do not discriminate against anyone for exercising these rights.

If we make material changes to this policy, we will notify you in the app or by email before they take effect. The "last updated" date above always reflects the current version, and we keep a dated copy of every version so you can ask us for the wording that applied at any time.