Who we are
Sown publishes sermon notes, transcripts and grounded answers for churches. It is operated by Jackson Porter, a sole proprietorship based in Ontario, Canada (“Sown”, “we”). This policy explains what personal information Sown collects, why, who receives it, where it is stored and how long it is kept. It covers this website, the church sites Sown hosts, and the dashboard church staff use.
Our privacy officer, Jackson Porter, is responsible for how Sown handles personal information and answers every privacy question and request: privacy@joinsown.com, or by mail to Jackson Porter, 2880 King St., Jordan Station, ON L0R 1S0, Canada.
The short version
- Church sites have no member accounts, no ads and no advertising trackers.
- Questions asked on church sites aren’t stored by Sown. They go to our AI providers only to produce the answer, and the conversation stays in the visitor’s browser tab.
- On this website, we collect only what you give us in the demo request form.
- Payments are handled by Stripe. Sown never sees or stores full card numbers.
- Our database is in Canada. Some of our providers process information in the United States.
- We don’t sell personal information, or share it for advertising.
This website
Demo requests
When you request a demo, we collect your name, email address, church name, and — if you choose to give them — your role, your church’s size and your message, along with whether you’d like occasional updates. We use this to reply to you and, only if you asked for them, to send updates. You can unsubscribe from updates at any time.
Preventing abuse
We don’t store your IP address. To stop repeated automated submissions, we store a one-way hash of it, combined with a secret value, which can’t practically be turned back into the address.
Analytics and cookies
We count visits with Vercel Web Analytics, which doesn’t use cookies and doesn’t identify individual visitors. This website doesn’t set cookies.
Church sites
Each church’s site is offered by the church, and Sown runs it for the church. Every church site has its own Privacy & AI notice, at /privacy on that site, which explains the following to the people who use it.
- Members and visitors don’t sign in, and church sites don’t show ads, set cookies or use advertising trackers.
- When someone asks Selah (the AI assistant on a church’s site, under whatever name the church gives it) a question, or searches, what they type is sent to Anthropic, together with the last few messages of that conversation and the sermon passages found for it, to write the answer, and to OpenAI, to search the sermons by meaning. Under their terms for business customers, they don’t use it to train their models, and may keep it for a limited time to watch for abuse. Sown doesn’t store the text of questions or answers, and doesn’t write it to its logs.
- The conversation itself is kept only in the visitor’s browser tab, so it survives moving around the site. It reaches Sown only as part of the next question. Starting a new conversation, or closing the tab, clears it.
- Church sites count page visits for the church’s team as daily totals per page, sermon, series and Bible chapter, without cookies and without keeping anything that identifies a visitor. Visitors whose browser sends Global Privacy Control or Do Not Track aren’t counted.
- We keep counts — such as how many questions a site received in a day, which sermons answers drew on, and how often each suggested question is chosen — to run the service, show the church how its site is used, and prevent abuse. To limit abuse we also keep, for a few minutes, a one-way hash of the visitor’s IP address with a count of recent requests.
- If a church offers the weekly sermon email and someone signs up, we keep their email address, when and to what they agreed, and a hash of the IP address they signed up from, as proof of consent under Canada’s anti-spam law. They confirm through a link we email them before anything else is sent, and every email has a one-click unsubscribe link. The church’s staff see how many people subscribe, not who.
- Sermon videos play from YouTube in its privacy-enhanced mode, and only when the visitor opens a sermon’s video. Once a video plays, YouTube’s own privacy policy applies.
- A church can put parts of its site, such as the assistant, on its own website. These parts work exactly as they do on the church’s Sown site and collect nothing more.
Sermon content comes from the church’s public YouTube videos and their captions. Please don’t put personal details, about yourself or anyone else, in questions to Selah.
The dashboard
Church staff sign in with their email address and a one-time code. We keep their email address, the churches they belong to and their role, and a record of changes they make — such as who published a sermon, and when. The dashboard uses a cookie to keep staff signed in; it is needed for the dashboard to work and isn’t used for anything else.
When an owner or admin proves their church’s YouTube channel by signing in with Google, Google shows them what Sown asks for: read-only access to their YouTube account. Sown uses it once, to read which channel the account owns, then revokes it. We keep only the channel, when it was proved, and who proved it. Sown’s use of information from Google’s APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can also remove Sown’s access from your Google account’s security settings.
Subscriptions and payments
When a church starts a free trial or subscribes, we collect the name and email address of the person signing up, the church’s name and YouTube channel, and the plan and billing period they choose. We use this to set up the church’s site and account, and to bill for it.
Payments are handled by Stripe, our payment processor. Stripe collects the payment details and billing address directly, and Sown never sees or stores full card numbers. From Stripe we keep the church’s plan, the state of its subscription and the references that link the church to its Stripe customer and subscription. Stripe sends receipts and keeps invoices on our behalf, and also uses payment information to prevent fraud, as its own privacy policy describes.
Why we use personal information
We use personal information only for the purposes described above: to provide Sown to churches and the people who use their sites, to bill for it, to answer people who contact us, to keep Sown secure and prevent abuse, and to meet our legal obligations. We collect only what those purposes need. We rely on consent — given when you send the form, sign up for the email, or subscribe — and you can withdraw it at any time, which may mean we can no longer provide the part of Sown that needs it.
Service providers
We share personal information only with these providers, only so they can run their part of Sown for us. Each is bound by contract to protect it and use it only to provide its service to us.
- Vercel (United States): hosting for this website and church sites, and visit counts for this website.
- Supabase (database in Canada): database, file storage, staff sign-in and sign-in emails.
- Anthropic (United States): writing sermon notes, summaries and Selah’s answers.
- OpenAI (United States): indexing sermon text and questions so relevant passages can be found.
- Stripe (United States): payments, subscriptions, receipts and invoices.
- Resend (United States): delivering the weekly sermon email and its confirmation emails.
- Google (YouTube): public information about sermon videos and their captions, and proving a church’s channel.
- Supadata: fetching the public captions of sermon videos. It receives only the video’s address, never personal information.
We may also disclose personal information if the law requires it, such as under a court order, or to a business that takes over Sown, which would have to keep this policy’s promises.
Where information is stored
Sown’s database and files are stored in Canada (Supabase’s Montreal region). Our hosting, AI, email and payment providers process information in the United States, and may use other countries too. While it is there, it is protected by our contracts with them, but it is subject to the laws of those countries and may be accessed by their courts and authorities.
How we protect it
Information is encrypted in transit and at rest. Each church’s data is kept apart by the database’s access rules, staff sign in with one-time codes, only the people who run Sown can reach production systems, and backups are encrypted. If a breach creates a real risk of significant harm, we’ll tell the people affected and the Privacy Commissioner, as the law requires.
How long we keep information
- Demo requests: two years after our last contact with you, then deleted.
- Sign-up details: an unfinished sign-up is deleted after 30 days; a finished one keeps the signer’s name and email only until they have joined the church’s dashboard.
- Weekly-email subscribers: an unconfirmed address is deleted after seven days, and an address is deleted 30 days after it unsubscribes.
- Hashed IP addresses for limiting abuse: a few minutes to a day.
- Daily visit totals on church sites: about two years.
- Staff accounts and the record of their changes: while the person belongs to a church on Sown. We delete an account on request, or with the church’s data.
- A church’s sermons, notes, transcripts, settings and usage counts: until 30 days after its subscription ends, then deleted (see the terms). Deleted data stays in our encrypted backups until they are replaced, at most 12 months.
- Billing records, such as invoices and payments: six years after the end of the tax year they relate to, as Canadian tax law requires.
Your choices and rights
You can ask to see the personal information we hold about you, to correct it, or to delete it, and you can withdraw consent to updates or the weekly email at any time. Write to privacy@joinsown.com. We’ll answer within 30 days, free of charge, and may first need to confirm it’s you. If the information was collected for a church, such as an email subscription, we’ll act on it and tell the church where needed.
If you aren’t satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d’accès à l’information.
Children
Sown isn’t directed at children. Church sites have no accounts, Sown doesn’t store questions, and church sites are designed not to collect personal information from anyone, including children.
Changes to this policy
When this policy changes, we’ll post the new version here and update the date at the top. If a change affects how we use information we already hold, we’ll tell church owners by email first, and ask for consent again where the law requires it.