This Privacy Policy explains what information SermonWave ("SermonWave", "we", "us") collects when you use the SermonWave website, dashboard, listener pages, our capture devices and the church directory (together, the "Service"), and how we use, share and protect it. It covers church account users, listeners, churches listed in our directory, and visitors to sermonwave.com. Our Terms of Service govern use of the Service.
1. Who we are
SermonWave provides live transcription and translation for churches. We are based in the United States and we run the Service on our own servers. We are a small team; we do not have a data protection officer, and we do not hold SOC 2, ISO 27001 or any similar certification. We say so plainly so you can judge the Service on what it actually is.
You can reach us any time at team@sermonwave.com or (918) 283-0005, or through our contact page.
2. Information we collect
Church accounts
- Account information: your name, email address, password (stored only as a secure hash), role, and the users you invite.
- Church profile: church name, address, city, time zone, website, logo, service times, social links, speaker names and photos, and other details you enter or ask us to fill in automatically.
- Billing information: your plan, add-ons, subscription status and invoices. Stripe collects and stores your payment card details; we do not receive or store full card numbers. If we ship you hardware we also collect a shipping name, address and phone number.
- Customer content: sermon and service audio captured by your web device, your SermonWave hardware device or the OBS plugin, and the recordings, transcripts, translations, synthesized translated audio, summaries, quotes, outlines and images created from it.
- Voice samples: if you use the voice add-on, short samples of a speaker's voice taken from sermon audio, used to generate translated audio that resembles that speaker.
- Device information: device identifiers and keys, status, audio levels, software version, network information and diagnostic logs, used to keep devices running and to support you.
- Usage information: sign-in times, pages and features used in the dashboard, and IP address and browser information for security and troubleshooting.
Listeners
- No account needed. You can listen, read and search without an account and without giving us a name or email.
- Listener identifier and preferences: a random identifier and your preferences (language, theme, audio on/off, listening history, playlists) are kept in your browser's storage on your device so the page remembers you. Section 11 lists them.
- Listening sessions: which church, event and language you listened to, when, and your device type (mobile, tablet or desktop). We store a one-way hash of your IP address rather than the address itself. We also send your IP address to a geolocation service to estimate your approximate city and region, which appear in aggregated listener statistics and maps for churches.
- Location for "near me": if you use the church finder's "use my location" button, your browser asks your permission to share your location. It is used only to find nearby churches and we do not keep it.
- What you choose to send: if you submit a prayer request, a contact request or a search, we collect what you enter and share it with the church you sent it to.
Listener accounts (optional and free)
If you choose to make a free listener account, we store:
- Your email address, and whether you confirmed it.
- Your password, stored only as a secure one-way hash. We cannot see your password.
- Your choices: site language and Bible version.
- Your playlists: their names, the sermons in them and their order. For a playlist that adds new sermons by itself, we also keep the search or filter it follows and which sermons are still marked "New".
- Your favourite churches, and when you added each one.
- Which in-site notices you have read.
- Signed-in browsers: for each phone or computer you sign in on, the time, its IP address and its browser type, so you stay signed in and so we can spot misuse.
- Sign-in attempts: for sign-ins, sign-ups and password-reset requests, the IP address, the time, whether it worked, and a scrambled (hashed) form of the email typed. We use this only to stop password guessing and spam.
- Your age confirmation: the date you ticked "I am 16 or older and agree to the Terms and Privacy Policy", and which version you agreed to.
Your Bible notes and highlights are not stored in your account. They stay in your browser on your device.
We use this only to run your account: to sign you in, keep your playlists and favourites on every device, and show you new sermons. Churches do not see your account. They cannot see your email, your playlists, or that you added them as a favourite.
In-site notices
If you add a church as a favourite, a bell at the top of our site shows you new public sermons from that church: ones that reach SermonWave after you added it, from the last 60 days. We work this out when you open the site. Notices appear only on our website. We do not send them by email, text message or push notification. We remember which ones you marked as read.
The only emails we send listeners
We send a listener account exactly two kinds of email:
- One email to confirm your address, when you sign up. Its link works for 7 days. Your account works even if you never click it.
- A password-reset link, only when you ask for one. It works for one hour.
That is all. SermonWave is 100% free for listeners. We never sell your data, and we never market to you: no newsletters, no offers, no marketing emails, and we do not give or rent your email to anyone, including churches.
Website visitors and the directory
- Information you submit through our contact, signup, subscribe, claim or removal-request forms.
- Analytics about how the site is used (pages visited, referring site, approximate location, device and browser), collected with Google Analytics. Section 9 says exactly what Google receives.
- Signals collected by Google reCAPTCHA on our church sign-up and contact forms, to protect them from spam and abuse.
- Information about churches in our directory, including churches that have not signed up. Section 8 explains this in full.
3. How we use information
- to provide the Service: live captions, translation and translated audio, archives, summaries, search, podcast feeds, and church and sermon pages;
- to create and manage accounts, run free trials, process payments and ship devices;
- to send service emails, such as your welcome email, trial reminders, receipts and important notices;
- to run listener accounts: sign you in, keep your playlists and favourite churches, show in-site notices, and send the two emails described in section 2;
- to give churches aggregated listener statistics;
- for organisations that have switched it on, to train SermonWave's own generic voices from sermon audio (section 5);
- to run and improve the church directory, and to handle claims and removal requests;
- to monitor, secure, debug and improve the Service;
- to respond to your questions and support requests; and
- to comply with law and enforce our Terms of Service.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use customer content for advertising.
4. Legal bases
If the UK or EU GDPR applies to you, we rely on these legal bases:
- Contract: to provide the Service to a church that has signed up, and to bill for it; and to run a listener account you create.
- Legitimate interests: to keep the Service secure and working (including the sign-in attempt records in section 2), to produce aggregated statistics, to understand how our website is used with Google Analytics, and to publish the church directory from public information. Where we rely on legitimate interests we have weighed them against your rights, and you can object (see section 13).
- Consent: for optional things you turn on, such as marketing emails to church accounts, browser location, and voice training for organisations that switch it on (section 5). You can withdraw consent at any time. We do not currently ask for consent before Google Analytics runs; section 11 explains.
- Legal obligation: to keep billing and tax records and to respond to lawful requests.
For sermon audio and anything made from it, the church is normally the controller and we act as its processor. See section 17. Voice training (section 5) is different: when an organisation switches it on, we also use its sermon audio for our own purpose of building SermonWave voices.
5. How AI processing works
Speech recognition, machine translation, text-to-speech and sermon summaries run on AI servers that SermonWave owns and operates in the United States. Sermon audio, transcripts and translations are not sent to third-party AI providers for processing. Audio travels from your device to our servers over encrypted connections.
Processing audio means: we convert speech to text, translate that text into the languages your church has chosen, and generate spoken audio of the translation. If you use the voice add-on, we also generate audio designed to resemble the speaker's own voice. Each of these steps creates a new copy of the content, which is stored with your account.
One exception: if you use the optional church profile auto-fill in the dashboard, we send your church name, location and the text of your church's public website to a third-party AI provider (Anthropic) to draft your profile. No sermon content is sent. You can skip auto-fill and enter your profile by hand.
AI training: only for generic SermonWave voices. We do not use your audio, transcripts, translations or other content to train or tune AI models, with one exception. For organisations that have agreed to it, in writing or by turning on Help build SermonWave voices in the dashboard, we may use their sermon audio and transcripts to train SermonWave's own generic voices. Each voice is blended from many speakers and checked so it does not sound like any one person. We never clone or imitate anyone's voice this way, and we never sell or share the audio or give it to others to train their models. Training runs on our own servers.
- We use only short clips of the main speaker, with their transcript. We leave out music, prayers, other voices in the room, and recovery or support-group meetings, as far as we can.
- In the training data, speakers are labelled with random codes, never names. The link from a code back to a church is kept separately, with restricted access.
- A church admin can turn this off at any time in the dashboard, or by emailing team@sermonwave.com. From then on that church's audio is not used in any future training. A voice already built cannot "unlearn" it, but it will not be used in any new voice.
- If you are a speaker and do not want your sermons used, ask your church, or email us, and we will leave your sermons out of future training.
AI output can be wrong. Transcripts and translations may contain errors, including in names, scripture references and theological terms. Do not rely on them where accuracy is critical.
6. Recording in your sanctuary
SermonWave captures audio from the room. That audio can include the preacher, worship leaders, people reading or praying aloud, and congregants near a microphone. What people say out loud in a service can be personal and sometimes sensitive.
The church decides what to record and is responsible for telling people about it. If you run a church account, you are responsible for giving whatever notice and obtaining whatever consent the law where you are requires — for example a sign at the door, a line in the bulletin, a verbal announcement, or a consent form for speakers whose voice you clone. Recording laws vary by state and country, and some places require everyone's consent. We cannot give you legal advice about your jurisdiction.
If you are a congregant or a speaker and you want a recording of yourself removed, ask your church first, because the church controls its own content. You may also contact us at team@sermonwave.com and we will pass the request on and help where we can.
7. Public pages
Churches choose whether each sermon is public, unlisted or private. Public sermons, including transcripts, translations, summaries and audio, appear on church and sermon pages, may be listed in sitemaps, and may be indexed by search engines and AI assistants. Unlisted sermons can be viewed by anyone with the link. Private sermons are visible only to the church's dashboard users.
If your church turns on a SermonWave podcast feed, the public sermons you include in it are published as an RSS feed that anyone can subscribe to, together with their audio and transcripts. Translated episodes carry a spoken and written notice that the voice is AI-generated.
Once a page has been public, search engines and other third parties may keep copies after a sermon is made private or deleted. We cannot control how long those copies remain.
8. The church directory
We publish a free directory of churches at sermonwave.com/churches. A church can appear in it without having signed up, so this section explains exactly what we do and how to get out. It applies as the directory is rolled out; if your church is not listed, nothing in this section applies to you.
Why a church appears
We build listings from public information: open datasets (including Overture Maps, OpenStreetMap and the IRS Exempt Organizations file, which contains a church's legal name, EIN and mailing address), the church's own public website, and the church's own public podcast feed. Every listing says it was compiled from public sources and that the church is not affiliated with SermonWave unless it is marked Claimed. We publish the directory on the basis of our legitimate interest in providing a useful, free, accurate index of churches, and we give every church an easy way to object.
What we collect — and what we deliberately do not
- We collect organisational facts: church name, address, phone, website, service times, denomination, social and sermon links, and a logo.
- We deliberately do not collect personal staff emails or phone numbers, staff or member lists, member names, or photos of people. Our crawler skips prayer-request and children's-ministry pages. It identifies itself honestly, obeys
robots.txt, pauses between requests and revisits at most twice a year. - Preachers' names. Where a sermon is published by the church with the preacher's name on it, we show that name on the sermon page as the church published it, so the credit is accurate. If you are a preacher and you do not want your name shown, tell us and we will remove it.
Sermons in the directory
To show what the product does, we may take a church's newest sermons from its own public podcast feed or website, transcribe them, and publish the transcript with full credit to the church. For these listings we do not translate the sermon, generate synthetic speech or clone anyone's voice. We never download anything from YouTube. Every directory sermon page credits the church by name and links to the original ("Sermon by [church]. Original: [link]"). Credit always goes to the church, never to SermonWave.
Claiming a listing
Any church can take over its own listing free at /churches/claim/{church}/. We verify that you represent the church — usually with a code emailed to an address at the church's own domain — and then the listing becomes your account, with a 14-day free trial. Claiming is free and does not require payment.
Removal and corrections
Every listing and directory sermon page has a Request removal link, at /churches/remove/{church}/. You can ask us to remove the listing and all sermons, remove the sermons only, or correct the information. A person reviews every request, usually within 7 days. You can also email team@sermonwave.com.
When we remove a listing we unpublish the profile and every sermon we made from it, delete the stored audio and transcripts, and add the church to a suppression list so a later crawl does not add it back. We keep a minimal record of the request itself so the removal stays permanent.
Who we exclude
The directory lists Christian congregations only. We do not list Latter-day Saints, Seventh-day Adventist, Jehovah's Witness, Unitarian or Unitarian Universalist, or Episcopal Church (TEC) congregations. These are scope decisions about which churches the Service is built for, not judgements about any faith. Listings never editorialise, and denominations are described neutrally.
9. Sharing and service providers
We share information only as described here. We do not sell it.
- With the church: listener statistics, and anything a listener chooses to send to a church.
- Service providers that process data for us:
- Stripe — payments, subscriptions and card data. SermonWave currently bills through the Stripe account of Serve.Love, the platform SermonWave is built alongside, so your card statement or receipt may show "Serve.Love", "SermonWave", or both, depending on how our payment processor labels the charge at the time.
- Google, for three things:
- Google Analytics (website statistics). It runs on most of our public pages, but not on live listening pages, recovery-meeting pages or the church dashboard. It starts when the page loads: we do not show a cookie banner and we have not turned on Google's consent mode. Google receives the address of the page, the page you came from, your device, browser, screen and language, your approximate location, and a random visitor ID stored in its
_gacookies. On sermon, church and directory pages we also send events such as "sermon played" (with the sermon title), "FAQ opened" (with the question) and "directions" or "call" clicks. Google receives your IP address because your browser connects to it; Google says Google Analytics 4 uses it to estimate your location and does not log or store it. We do not send Google your name, your email or your account. Google's own policy applies: policies.google.com/privacy. You can block it with the Google Analytics opt-out add-on or a content blocker. - Google Fonts (web fonts). Most of our pages, including the dashboard and live listening pages, load fonts from Google's servers. Your browser then sends Google your IP address, your browser details and the fact that the request came from sermonwave.com. Google explains how it handles these requests in its Google Fonts privacy FAQ. Recovery-meeting pages do not use Google Fonts.
- Google reCAPTCHA (spam protection), only on our church sign-up and contact forms. It sends Google information about your device and how you use the page, and Google may set its own cookies. Its use is subject to Google's Privacy Policy and Terms. The listener sign-up does not use reCAPTCHA.
- Google Analytics (website statistics). It runs on most of our public pages, but not on live listening pages, recovery-meeting pages or the church dashboard. It starts when the page loads: we do not show a cookie banner and we have not turned on Google's consent mode. Google receives the address of the page, the page you came from, your device, browser, screen and language, your approximate location, and a random visitor ID stored in its
- Anthropic — church profile auto-fill only, as described in section 5.
- ip-api.com — approximate city and region from a listener's IP address.
- Email delivery — we send email from our own mail server at sermonwave.com, with SMTP.com as a fallback relay if our own server cannot deliver a message.
- Shipping carriers — delivery of hardware.
We host the Service, store its files and run its AI on our own servers in the United States. Our map tiles are self-hosted, so loading a map does not tell any third-party map provider where you are. We do not use SermonWave to send you SMS or automated voice calls.
- If a church publishes to other platforms: when a church chooses to publish its sermons to a podcast app or another platform, the content it publishes goes to that platform and is then governed by that platform's own terms and privacy policy. If a church admin connects YouTube in the dashboard, our servers use that connection to upload the sermons the church chooses to publish, and to create, check and end the church's live broadcasts when the church streams with our OBS plugin, as described in section 10. The video of a live broadcast itself goes from your church's own computer to YouTube; it does not pass through our servers.
- Legal reasons: when required by law or legal process, or to protect the rights, safety and property of our users, the public or SermonWave.
- Business transfers: as part of a merger, acquisition or sale of assets, under this policy's protections.
- With your consent or at your direction.
10. YouTube
Connecting YouTube is optional. A church admin can connect the church's YouTube channel in the dashboard under Settings. Once it is connected, the church can publish chosen sermons to that channel, and, if the church streams with our OBS plugin, SermonWave can run the church's live broadcasts. Here is what that involves.
- What we access. When you connect, Google asks you to allow SermonWave to see, edit and delete your YouTube videos and captions. That is the single permission YouTube offers for running live broadcasts, and it is the only one we request. We use it only to: create and run a live broadcast and live stream for each language your church streams with our OBS plugin, and end them when the service ends; upload the sermons your church chooses to publish; set the title, description, language, privacy and captions of the videos we created for you; and read your channel's name, ID and picture so the dashboard can show which channel is connected. A new upload is private unless you choose otherwise.
- About the delete permission. The permission Google asks for also allows deleting videos, because YouTube does not offer a narrower one that can create live broadcasts. SermonWave never deletes a video. Our software contains no instruction to delete anything on your channel, and we test for that on every change so it stays true. If a live broadcast we created never actually went live, we end it rather than remove it; it stays on your channel for you to delete if you want to.
- What we upload. For each sermon you publish, we make a video from the sermon's audio and its cover image on our own servers and send it to your channel. We do not upload anything you have not asked us to publish.
- Live broadcasts. For each translated language your church streams, our server creates a broadcast on your channel with the title and privacy setting you chose, gives your streaming computer the stream address and stream key for that broadcast, checks whether it is live, and ends it after the service. The video and the captions go from your church's own computer straight to YouTube. We keep the broadcast and stream IDs and their status; we do not store stream keys.
- What we do not do. We do not delete or change videos we did not create for you, and we do not read your playlists, comments, subscribers or analytics. We do not download anything from YouTube.
- What we store. Your channel's name, ID and picture link, the permission you allowed, a record of each sermon you published (title, description, privacy setting, video ID and status), a record of each live broadcast we created for you (its IDs, title, privacy, status and times), and the access and refresh tokens Google gives us. The tokens are encrypted on our servers, with a key that is kept separate from our database, and are used only for the purposes listed above. We also check at least once a day that your connection is still allowed. If you remove SermonWave's access in your Google account, we delete the stored tokens as soon as we notice (within a day) and the rest of your YouTube information within 30 days.
- Disconnecting. You can disconnect at any time in the dashboard under Settings. We then ask Google to revoke our access and delete the stored tokens. You can also remove SermonWave's access from your Google account at myaccount.google.com/permissions. Videos already on YouTube stay on your channel until you remove them there.
- YouTube's and Google's terms. By connecting YouTube you also agree to the YouTube Terms of Service, and Google handles your information under the Google Privacy Policy.
SermonWave's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
11. Cookies and storage on your device
We use a few cookies, and we keep some settings in your browser's storage on your device. None of them is used for advertising.
Cookies
| Name | Set by | What it is for | How long |
|---|---|---|---|
sw_listener | SermonWave | Keeps you signed in to your listener account. It holds a random token, not your email or password. | 180 days from your last visit; removed when you sign out or delete your account |
uv_session | SermonWave | Keeps church staff signed in to the dashboard. | Until you close the browser |
client_site_register | SermonWave | Remembers a church staff sign-in on the dashboard. | 1 year |
sw_dash_lang | SermonWave | The language of the dashboard sign-in page. | 1 year |
sw_claim_csrf | SermonWave | A security check on the "claim your church" form. | Until you close the browser |
_ga, _ga_7KJVH1YZ9T | Google Analytics | A random ID so Google Analytics can count visits and returning visitors (see section 9). | Up to 2 years |
| Google's reCAPTCHA cookies | Spam protection on the church sign-up and contact forms only. | Set by Google |
The SermonWave cookies are needed for sign-in and security, so they cannot be switched off while you use those features. You can block or delete any cookie in your browser settings; you will then be signed out, and blocking reCAPTCHA can stop the church sign-up and contact forms from working.
Storage on your device
Our public pages keep these in your browser's local storage (or session storage). They stay on your device. We only see something from this list if a page sends it to us, as described here.
| What | Names | Why |
|---|---|---|
| Playlists made without an account | sw_playlists_v1, sw_playlist | Your playlists on this device. When you sign in or sign up, they move into your account once and are removed from the device. |
| Click-to-play switch and player choices | sw_click_to_play, sw_listen_autoplay_next, sw_skip_intro_*, sw_listen_seek_tip, listener_video_size | Whether clicking transcript text plays from that point, whether the next sermon plays by itself, and similar player settings. |
| Listener identifier | uv_user_token | A random ID our live and sermon pages send with listening sessions, so churches get accurate, anonymous listener counts. |
| Listening preferences | listener_theme, listener_language, listener_lang_*, listener_audio_enabled, listener_history, listener_favorites, listener_home_church | Theme, language, audio on or off, recently played sermons and churches you marked on the live pages. |
| Bible reading | sw_bible_notes, sw_bible_translation, sw_bible_tr_lang, sw_bible_compare, sw_bible_strongs, sw_bible_il, sw_bible_panel, sw_bible_sheet_h, sw_bible_scholar, sw_bible_trivia | Your Bible notes and highlights, your Bible version and reading settings, and trivia scores. |
| Account helpers | sw_account_hint, sw_account_applied, sw_account_lang_done | Whether this browser was signed in (so the page shows the right button straight away; it holds no email or token) and which saved settings were already applied. |
| Campaign tags | utm_source, utm_medium, utm_campaign, utm_term, utm_content (session storage) | If you arrived from a link with these tags, we keep them until you close the tab and add them to links within our site, so Google Analytics can tell which link brought you. |
To remove all of this, clear this site's data in your browser settings. Deleting your account does not clear your device, because we cannot reach it.
Global Privacy Control: we do not sell or share personal information for advertising, so there is nothing for a Global Privacy Control signal to turn off. Our pages do not read the signal today, and Google Analytics still runs when it is on.
12. Retention and deletion
We would rather tell you how this really works than quote a tidy number we do not enforce.
- Customer content is kept while your account is active, or until you delete it. There is no automatic expiry by default: if you do nothing, your recordings, transcripts and translations stay available to you.
- Optional automatic deletion. We can set a retention window on your account — for example, delete recordings older than 90 days — and a scheduled job then deactivates and deletes those files. Ask us if you want one; it is off unless you request it.
- Deleting a sermon removes it from your dashboard and your public pages. The underlying audio files are then purged from our storage by a scheduled cleanup job, which runs hourly and removes files that nothing active refers to and that are at least 7 days old.
- Closing an account: contact us and we will delete your customer content. We will export it for you first if you ask. We may keep a copy in backups for a limited period before it is overwritten.
- Listener accounts are kept until you delete them. We do not delete inactive accounts automatically. Records of signed-in browsers and sign-in attempts are kept with the account; we have not set a fixed time limit for them yet.
- Deleting your listener account: sign in and use Delete my account on your account page. It happens at once. We remove your email and personal data: your email is replaced with a random placeholder that cannot be turned back into your email, your password is removed, your playlists, favourite churches, read notices and age confirmation are switched off and cleared, every browser is signed out, the IP addresses and browser details of your sign-ins are removed, and the scrambled email is removed from our sign-in attempt records. Our database does not erase rows; it overwrites them so they no longer identify you. What remains is an empty account number with the dates it was made and closed, and anonymous usage counts (for example, how many accounts were made). You can sign up again later with the same email; it will be a new, empty account. Backups may hold a copy for a limited period before it is overwritten. You can also ask us to delete your account by email (section 13).
- Listener session records are kept to produce statistics for churches, and are deleted or aggregated when no longer needed for that purpose.
- Directory listings that are removed are suppressed permanently, as described in section 8.
- Billing records are kept as long as tax and accounting law requires.
13. Your rights and how to use them
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict processing, and to withdraw consent.
How to make a request: email team@sermonwave.com or use our contact page, and tell us what you want. Church account owners should write from the email address on the account. We may need to verify your identity before we act, and we will not charge you for a routine request. We aim to respond within 30 days, and within 45 days where U.S. state law sets that period.
- Church users: you can view and change your account and profile in the dashboard, change a sermon's visibility, and delete sermons yourself.
- Listeners: delete your account yourself with Delete my account on your account page (section 12), or email us and we will do it. To get a copy of what your account holds, email us. Clear this site's data in your browser to remove what is stored on your device. To have something you sent a church deleted, contact that church, or contact us and we will help.
- Churches in the directory: use the Request removal link on your listing, as described in section 8.
- Marketing email: use the unsubscribe link in the email. We will still send essential service emails such as billing notices.
If the UK or EU GDPR applies to you, you may also complain to your data protection authority. If you are in the UK that is the Information Commissioner's Office. We would appreciate the chance to put things right first.
14. U.S. state privacy rights
If you live in California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect, to access or delete it, to correct it, to obtain a portable copy, and not to be discriminated against for exercising those rights.
- We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act as amended by the CPRA. We therefore have no "do not sell or share my personal information" process to offer — there is nothing to opt out of. If that ever changes we will add one and say so here.
- Sensitive personal information. Sermon audio can reveal religious beliefs, and a listener's choice of language can suggest their background. We use this information only to provide the Service — to transcribe, translate and publish what a church asks us to, and to show that church its own statistics. We do not use or disclose it to infer characteristics about you, and we do not use it for advertising. We do not knowingly collect government identifiers, precise geolocation (beyond the city-level estimate described in section 2), health, biometric or financial account information.
- Authorised agents may make a request on your behalf with proof that you authorised them.
- Appeals. If we refuse your request and your state gives you a right of appeal, reply to our decision and a person will review it.
Categories of personal information we collect, the purposes, and who we disclose to are described in sections 2, 3 and 9. We disclose personal information to service providers for business purposes only.
15. Security
Here is what we actually do: connections to our website, dashboard and devices use TLS; passwords are stored only as hashes; device and API credentials are hashed or kept in the operating system's keychain on the device; access to production systems is restricted to the people who need it; our AI servers are on a private network and are not exposed to the internet; and listener IP addresses are hashed rather than stored.
What we do not claim: we have no SOC 2 or ISO 27001 certification, no third-party penetration-test report we can share, and no cyber-insurance policy we are promising you. No system is completely secure. If a breach affects your personal information we will notify you and any regulator as the law requires.
16. Children
Church accounts are for adults (18+). Listener accounts are for people 16 or older; sign-up asks you to confirm this. Anyone can use listener pages without an account, and without an account they do not ask for a name or contact details. If we learn that a listener account belongs to someone under 16, we will delete it. We do not knowingly collect personal information from children under 13, or under the age set by local law. Churches should not submit children's personal information through the Service, and our directory crawler deliberately skips children's-ministry pages. If you believe a child has given us personal information, contact us and we will delete it.
Children may be audible in a recording of a service. That is the church's decision and the church's responsibility, as described in section 6.
17. Where data is processed
SermonWave is based in the United States, and we process and store data on our own servers in the United States. If you use the Service from outside the United States — including from the UK or the EU — your information will be transferred to and processed in the United States, which may not provide the same level of protection as your home country.
Where the UK or EU GDPR applies to a transfer, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism, together with the protections in this policy. Ask us if you need a copy of the relevant terms.
18. Churches and listeners
Each church decides what to record, what to publish, and what to collect from its congregation. For that content the church is the controller (or "business") and SermonWave processes it on the church's instructions to provide the Service. Churches are responsible for notices and consents in their own buildings, as described in section 6.
Listeners with questions about how a particular church uses their information should contact that church. We will help put you in touch.
19. Changes to this policy
We may update this policy. We will post the new version on this page and change the "Last updated" date. If a change is material we will also notify church account owners by email or in the dashboard before it takes effect. Because we promise listeners only two kinds of email, we tell listener account holders about changes on our website (for example on the account page), not by email.
This version replaces the policy dated 26 September 2026. It was rewritten to describe the church directory, the OBS plugin, podcast feeds, voice cloning and our real retention practices. On 14 October 2026 we added section 10 about connecting YouTube and publishing sermons to it, and later the same day we expanded it: SermonWave now also runs a church's YouTube live broadcasts from its own servers, which needs a broader YouTube permission, so section 10 describes that permission, what we do with it, and that we never delete a video.
On 25 October 2026 we added free listener accounts: section 2 now lists what an account stores, the in-site notices and the only two emails we send listeners; section 11 lists every cookie and what we keep on your device; section 9 says exactly what Google Analytics, Google Fonts and reCAPTCHA receive; section 12 explains how deleting a listener account works; and section 16 sets the minimum age for listener accounts at 16. The same day we changed section 5 (and sections 3 and 4 to match): organisations that agree can let us use their sermon audio to train generic SermonWave voices, never to clone or imitate anyone.
20. Contact us
Privacy questions and requests (including access, a copy of your data, correction or deletion). Write "Privacy request" in the subject and, for a listener account, send it from the account's email address:
team@sermonwave.com
(918) 283-0005
sermonwave.com/contact
SermonWave
500 S. Lynn Riggs, PMB 299
Claremore, OK 74017