Privacy Policy

Effective date: August 1, 2026
Entity: Rockstarr LLC, doing business as Wheat and Goats ("Wheat and Goats", "WAG", "we", "us", "our")
Contact for privacy questions: the data controls on the settings page; our privacy email address will be published here the moment its mailbox is live
Service: the Wheat and Goats website and web app (the "Service")

1. What this policy covers, in one paragraph

Wheat and Goats helps you find a local Christian church that matches your religious beliefs. You answer a doctrine quiz (agree or disagree on a series of belief statements), and we rank nearby churches by how closely their doctrine matches your answers. Your quiz answers describe your religious beliefs. Under the GDPR, the UK GDPR, and general privacy law, information about your religious beliefs is a special category of personal data that gets heightened protection. We only collect and use those answers with your explicit consent, and this policy explains exactly what we do with them and how you can get them deleted.

2. The data we collect

2.1 Your doctrine quiz answers (sensitive, special-category data)

When you take the quiz, you tell us whether you agree or disagree with belief statements. Those answers reveal your religious or philosophical beliefs. This is the most sensitive data we handle. We treat it as special-category personal data under Article 9 of the GDPR and Article 9 of the UK GDPR, and we handle it only on the basis of your explicit consent (see Section 4). We collect:

• Your agree / disagree / (and if offered) neutral or "not sure" response to each belief statement.
• Any weighting or "how much this matters to me" input you provide.
• Derived data computed from the above, such as your belief profile and your ranked list of matched churches.

2.2 Location data

To rank nearby churches, we need to know roughly where you are or where you want to search. If you grant browser location permission, we use your approximate coordinates for that search. If you type in a city, ZIP or postal code, or address, we use that instead. We use location to compute distances and to order results. See Section 6 on retention for how long we keep it.

2.3 Account data (only if you create an account)

You can use core features without an account (see Section 3 on anonymous use). If you choose to create an account, we collect:

• Email address.
• How you sign in. WheatAndGoats is passwordless: you use a one-time email sign-in link, or a connected Google, Apple, or Microsoft account. We never set or store a password.
• Optionally, a display name.
• Your saved belief profile and saved or favorited churches, linked to the account.

2.4 Church-representative data (for people who claim a church listing)

If you are a pastor, staff member, or authorized representative claiming or verifying a church profile, we collect your name, your role or title at the church, a contact email and/or phone number, information you submit to prove you are authorized to manage the listing, and the edits, corrections, and content you submit about the church. See the Terms of Service for the rules that apply to claimed listings.

2.5 Technical and usage data

Like most websites, we automatically receive: IP address, browser type, device type, operating system, and language; pages viewed, searches run, and actions taken in the Service; and cookie and similar-technology identifiers (see Section 9). We keep required (strictly necessary) technical logs to run and secure the Service. We use no third-party analytics and set no non-essential cookies. We do count a small number of anonymous, aggregate product events (for example, that a church's profile was viewed); these events accept no account identifier by design and cannot be tied to you.

2.6 Data about churches (not personal data about you)

The Service publishes information about real, named churches: name, address, phone, email, website, denominational or traditional affiliation, and our computed belief-match percentages. Some of this comes from public directories and from OpenStreetMap. OpenStreetMap-derived location data is used under the Open Database License and is attributed as "(c) OpenStreetMap contributors" (see our attribution page). This church data is generally organizational information, not your personal data, but where a church's listed contact is an individual person, that individual has rights too (see Section 11).

3. Anonymous users vs. account users

You do not need an account to take the quiz or see matches.

• Anonymous / no-account use. By default your quiz answers and search stay in your browser's local storage on your device. They are not tied to a durable identity and are not stored on our servers. When you clear your browser storage, that data is gone. You can also erase it from the settings page at any time.
• Account use. If you create an account and choose to save your belief profile, we store your answers on our servers, linked to your account, so you can return to them, refine them, and re-run matches. You can view, correct, export, or delete them at any time (Section 8).

We make the choice clear in the interface and never silently upgrade an anonymous session into a stored account profile without your action.

4. Why we use your data, and our lawful basis

We rely on the following lawful bases (GDPR / UK GDPR terminology; equivalent concepts apply under US state laws such as those of California, Colorado, Connecticut, Virginia, and others):

• Doctrine quiz answers (religious beliefs): to compute your belief profile and rank matching churches. Basis: explicit consent (Art. 9(2)(a)), given at the consent gate before the quiz. You can withdraw it at any time.
• Location: to find and order nearby churches. Basis: consent (browser location) and/or performance of the service you requested.
• Account data: to create and secure your account and save your profile. Basis: performance of a contract (our Terms) and our legitimate interest in account security.
• Church-representative data: to verify claims and let you manage a listing. Basis: performance of a contract and legitimate interest in listing integrity.
• Technical / security logs: to run, secure, and debug the Service. Basis: legitimate interest and legal obligation.
• Analytics / non-essential cookies: consent only. None are used today.

Withdrawing consent. Because we run the quiz on explicit consent, you can withdraw that consent at any time. Withdrawing consent does not affect processing we already did lawfully before you withdrew, but going forward we will stop using your belief answers and, on request, delete them (Section 8).

5. How your data is shared (we do not sell it)

We do not sell your personal data, and we do not sell or share your religious belief answers with anyone for their own marketing. We share data only in these limited ways:

• Service providers (processors) who host, secure, email, or operate the Service on our behalf, under contracts that require them to protect the data and use it only for us. Today these are cloud infrastructure and database hosting, and transactional email delivery (the one-time sign-in links).
• Aggregated or de-identified statistics that cannot reasonably identify you. We do not publish belief data tied to an identifiable person.
• Churches. We do not hand a church your identity or your personal belief answers. If you contact a church through the Service or ask us to share your details, that is your choice and we will tell you before doing so. No "connect me to this church" feature exists today. A church that has claimed its listing can see aggregate statistics about that listing: how often its profile was viewed, and counts of how many seekers' answers agreed or disagreed with particular doctrines. These counts carry no identity, and numbers below a floor of five people are suppressed entirely, so no individual can be picked out of them.
• Legal and safety. If required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfer. If the Service is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction; we will require the successor to honor this policy or notify you of material changes.

Regarding US state privacy laws: we do not "sell" personal information or use it for "targeted advertising" or "cross-context behavioral advertising" as those terms are defined.

5.1 Share links you create

Where sharing features are available in the Service, you can choose to create a share link (for example, a result card, a compare-with-a-friend invitation, or an "I found my church" card). Sharing is always your explicit choice: nothing is shared until you review what the card will show and press the share button. Here is exactly what a share link does:

• What a link exposes: only the snapshot you approved when you created it, such as your closest tradition and match percentage, and, only if you switched them on, your first name, a small set of top church matches, or topic-level summaries. Topic-level summaries are averages across a topic, never individual answers.
• Raw answers are never published. The sharing system has no field for your individual quiz answers, so a share card cannot carry them.
• Anyone with the link can view it. Share pages are public to link-holders, need no sign-in, and social platforms will show a preview image of the card when the link is posted. Treat posting a link as publishing the card. A church card in particular announces a real-world association between you and a named congregation.
• Shares are revocable. You can turn a share off from the device where you created it. A revoked link stops working and shows nothing. Revoking cannot take back copies or screenshots other people already made while the link was live.
• Retention: a share exists until you revoke it. Revoking deletes it.

6. How long we keep data (retention)

• Anonymous quiz answers: kept in your browser's local storage only, under your control, as described in Section 3.
• Account belief profiles: kept while your account is active, and hard-deleted immediately when you delete the answers or the account (Section 8).
• Account records: kept while your account is active; deleted or de-identified within 30 days after account closure, except where we must keep limited records for legal, tax, or security reasons.
• Church-representative and claim records: kept while the claim is active and for up to 12 months afterward for audit and dispute resolution.
• Technical / security logs: kept for up to 90 days for security and debugging.

If legal review adjusts any of these windows, this section will be updated first.

7. How we protect data

We use reasonable technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit, access controls, hashed credentials, and limiting who can access belief data. Our servers never write your quiz answers to application logs. No system is perfectly secure, but we treat belief answers as our most sensitive category and design access controls accordingly.

8. Your rights, including the right to delete your data

Depending on where you live, you have some or all of these rights. We honor the following for all users regardless of location, as a baseline:

• Access: get a copy of the personal data we hold about you, including your belief answers.
• Correction: fix inaccurate data, including editing or re-answering your quiz.
• Erasure / "delete my data": ask us to delete your belief answers, your saved profile, and/or your entire account. When you use the delete controls, your answers, profile, and consent records are hard-deleted from our active database immediately, in a single operation, and leave backups on the normal backup rotation cycle. Before the delete runs, your answers are folded into anonymous per-statement counts (for example, "N people agreed with this statement") that contain no identifier, location, or timestamp and cannot be traced back to you.
• Portability: receive your data in a portable, machine-readable format where applicable.
• Withdraw consent: withdraw your consent to belief-data processing at any time (Section 4).
• Object / restrict: object to or restrict certain processing.
• Opt out of any "sale", "sharing", or targeted advertising as defined by applicable US state law (currently not applicable, see Section 5).
• Non-discrimination: we will not deny you the core Service for exercising these rights.

How to exercise them. Use the data controls on the settings page: download a copy of everything stored in your browser, delete it, and withdraw belief-data consent, all in one place. Anonymous use stores answers on your device only, so those controls erase them completely. Account users get one-click "delete my answers" and "delete my account" controls as the accounts feature ships. You will also be able to reach us by email; the address will be published here the moment its mailbox is live. We may need to verify your identity before acting on access or deletion requests, to protect you. We aim to respond within 30 days. If we cannot act, we will explain why. You may have the right to complain to a data protection authority (in the UK, the ICO; in the EEA, your local authority; in the US, your state Attorney General where applicable).

9. Cookies and analytics

We use strictly necessary browser storage to run the Service (for example, to keep your quiz progress and remember your consent choices). These do not require consent. We use no third-party analytics and no non-essential cookies at all. The only usage counting we do is the anonymous, aggregate product events described in Section 2.5, which set no cookies and carry no identifier. If we ever adopt analytics that touch personal data, they will load only after you opt in through a consent banner, and this policy will be updated first.

10. Children

The Service is intended for adults choosing a church, and is not directed to children. Because belief answers are sensitive, we set a minimum age of 13 to use the quiz, confirmed at the gate before the quiz. We do not knowingly collect belief data from anyone under that age. If you believe a child provided data, use the deletion controls on the settings page or contact us through the route in Section 14 and we will delete it.

11. Churches and individuals listed on the Service

We publish factual contact information about churches, plus algorithmic belief-match estimates. If you are associated with a listed church and want to correct, claim, or dispute your listing, see the Terms of Service takedown and claim process. Where a church's listed contact is a named individual and that person wants their personal contact detail removed, we will handle that request under Section 8.

12. International transfers

We process data in the United States. If we transfer personal data across borders, we use appropriate safeguards where required (for example, Standard Contractual Clauses for EEA/UK data).

13. Changes to this policy

We may update this policy. If we make material changes, especially to how we handle belief data, we will notify you and, where required, ask for fresh consent. The "Effective date" shows the latest version.

14. Contact

Questions or requests: use the data controls on the settings page. Our privacy email address will be published here the moment its mailbox is live. We do not publish a postal address on this site. Rockstarr LLC is an Arizona limited liability company; parties needing to effect formal legal service can locate the entity through the Arizona Corporation Commission's public records.