Privacy Policy

In short

We collect what we need to let you in, to answer you, to bill a membership, and to keep the site safe: chiefly your name and email address, what you send us, and technical information about your visit. We do not sell personal information and do not share it for cross-context behavioural advertising. We run no advertising and allow no advertising network to profile you here. We use Google Analytics and PostHog to understand how the site is used; for visitors in the UK, the EEA, and Switzerland they store nothing on your device, and for everyone they switch off when your browser sends a Do Not Track or Global Privacy Control signal. Our hosting provider also counts page views and load times without cookies. The record this site publishes concerns institutions and public offices, not the private lives of individuals; if you are named in it, section 11 explains what it holds and how to correct it or object.

1. Who we are and what this covers

Ocean Edgewater, LLC, a California limited liability company (“we,” “us”), operates Catholic Intelligence and decides how and why the personal information described here is processed. For the purposes of the UK and EU General Data Protection Regulation and the Swiss Federal Act on Data Protection we are the controller, and for the purposes of U.S. state privacy laws we are the business or controller.

This policy applies to catholicintelligence.com, its read API and MCP endpoint, the emails we send, and any correspondence with us (together, the “Service”). It does not apply to the websites of the parishes, dioceses, and institutions the record links to, each of which has its own practices. Section 11 explains how this policy applies to the people named in the record.

Write to [email protected] about anything in this policy. Our postal address is available on request.

2. Information we collect

Information you give us.

1. Joining and signing in. Your email address and, where you give them, your name, your office or role, your diocese or parish, and a line about what brings you here. If you sign in with Google, Google tells us your email address and the basic profile details you allow it to share. We record when you sign in and how many times you have.
2. Membership. Your email address, the plan you choose, and the status of your subscription. Card details are entered on pages hosted by Stripe, Inc. and never reach our servers.
3. Enquiries. What you write to us through a form or by email, with your name, email address, organization, and the page you wrote from.
4. Contributions. Corrections to the record, Mass schedules you paste or link, confirmations that a schedule is right or wrong, news tips, photographs, comments, and votes, together with the account or device identifier they were submitted under.
5. Searches. The words you search for, the filters you choose, and, when you ask for results near you, your location as described in section 7.

Information collected automatically. When you visit, our hosting provider receives your IP address, browser and device type, the page requested, and the time. In our own records we keep a keyed one-way hash of your IP address rather than the address itself, together with your browser’s user-agent string, the network your connection comes from, and the country your connection reports, which we use to prevent abuse and to count genuine readers apart from automated traffic. Our analytics providers collect the information described in section 6.

Information from others. Google, if you choose to sign in with it; Stripe, which confirms payments and subscription changes; and Cloudflare, which reports the approximate location of your connection. For the record described in section 11, information published about the Church’s institutions and offices, including what those institutions publish about themselves, and corrections sent to us by readers and institutions.

We do not ask for, and ask that you do not send us, information about your health, finances, or government identifiers, or the religious beliefs of anyone else. Because this is a Catholic publication, the fact that you use it may suggest something about your faith. We do not record, infer, or disclose any belief from it.

3. How we use it

1. To provide the Service: to review requests to join, sign you in, keep you signed in, answer your searches, and give members the record their membership covers.
2. To bill and administer memberships and orders, and to keep the accounting records the law requires.
3. To answer you, and to send the messages the Service depends on, such as sign-in links, confirmations, receipts, and notices about your access. We do not send marketing email.
4. To check and publish contributions to the record, with the source you name.
5. To compile and publish the record of the Church’s institutions and public offices described in section 11.
6. To understand, in aggregate, which pages and searches are used and where they fail, so that we can improve them.
7. To keep the Service secure, to detect and prevent abuse, scraping, and fraud, and to enforce our Terms of Use.
8. To comply with law and to establish, exercise, or defend legal claims.

Some features use machine-learning models run by our hosting provider, Cloudflare, for example to read a Mass schedule you paste or to match a member’s question to the record. We do not use your personal information to train any model. Cloudflare Turnstile checks form requests for automated abuse using browser and connection signals. Automated checks screen traffic for abuse and may slow or block a connection; if you believe you have been blocked in error, write to us and a person will review it. We make no decision about you by automated means that has legal or similarly significant effects.

4. Legal bases and your right to object (UK, EEA, Switzerland)

Where the UK or EU GDPR or the Swiss Federal Act on Data Protection applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have weighed them against your interests, rights, and freedoms, and you may ask us how. Where we rely on consent, withdrawing it does not affect processing that took place before. Giving us your email address is necessary to join or sign in; everything else is optional.

5. Who receives it

Service providers. These providers process personal information to provide their services to us:

Services your browser contacts directly. Maps and some page components are loaded from third parties, which receive your IP address and browser information as part of the request: map imagery and tiles from Esri, the U.S. Geological Survey, EOX, OpenFreeMap, and OpenStreetMap; mapping code from the unpkg content network; and, on some pages, fonts from Google Fonts. Each handles that request under its own privacy policy.

Other disclosures. We disclose personal information when compelled by valid legal process; to establish, exercise, or defend legal claims; to protect the rights, property, or safety of any person; with your direction or consent; and to a successor in a merger, acquisition, or sale of assets, which will be bound to handle it in a manner consistent with this policy.

No sale, no sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding twelve months. We have no actual knowledge of selling or sharing the personal information of anyone under sixteen.

6. Cookies, analytics, and your signals

We use the following cookies. None is used for advertising.

We also keep a few settings in your browser’s local storage, such as your chosen theme, map settings, drafts of a correction or comment you have not yet sent, the items you choose to follow, and the topics you read most on the news page. These stay on your device, are not sent to us, and are removed when you clear this site’s data in your browser.

Analytics. Google Analytics and PostHog record the pages you view, the links and controls you use (for example, the news topics, places, and sources you choose), whether a sign-in or request to join succeeds, your browser and device, the referring page, and your approximate location derived from your IP address. Each browser is given a random identifier, so that a visit can be followed from page to page and from one visit to the next; for visitors in the UK, the EEA, and Switzerland, it lasts only for the page being read, as described below. We do not link this activity to your name, email address, or account. Cloudflare Web Analytics counts page views, referring pages, and load times, and stores nothing on your device. We configure Google Analytics with Google signals and ad personalization disabled, and we do not use session recording. On the Find Mass pages, address and coordinate details are removed from the page address before anything is sent.

UK, EEA, and Switzerland. If your connection is in the United Kingdom, the European Economic Area, or Switzerland, or in a place our hosting provider cannot identify, we do not load Google Analytics, and PostHog keeps its visit identifier in page memory only, so nothing is stored on your device and no analytics identifier outlasts the page you are reading.

Google’s use of this data is described at How Google uses information from sites that use its services, and you may install Google’s opt-out browser add-on.

Do Not Track and Global Privacy Control. When your browser sends either signal, our pages do not load Google Analytics or PostHog. Because we neither sell nor share personal information, no further opt-out is needed. You can also block or delete cookies in your browser settings; if you block the strictly necessary cookies, you will not be able to sign in.

7. Location

Approximate. Cloudflare reports the approximate location of your connection, usually to the city, so that the map can open on your region and a diocese can be suggested. We use it to answer that request and do not store it. We do record the country your connection reports.

Precise, only if you ask. We use your device’s precise location only with your consent, which you give by granting your browser’s permission and asking for results near you. On the map, your position stays in your browser. When you ask the Mass finder for churches near you, your browser sends coordinates rounded to about 100 metres, and we keep them in our search log, without your name or email address, to improve results. If you type an address or place instead, we keep that text in the same way. You can withdraw location permission in your browser at any time.

8. What you choose to make public

The display name you choose appears beside your comments. Corrections, schedules, and photographs you contribute may be published as part of the record once we have checked them, credited to their source but not to your email address. Photographs carry information embedded in the file, including where and when they were taken and on which camera. We remove it before a photograph is stored, keeping only how the picture should be turned. If you are under eighteen, you may ask us to remove anything you have posted.

9. How long we keep it

We keep personal information only as long as the purpose for which it was collected requires, and then delete it or keep it only in a form that no longer identifies you:

1. Account and membership information: while your access continues, and afterwards for as long as needed to show when access was granted and ended and to handle any question about it. The hashed IP address and browser details recorded with a sign-in, a request to join, or an enquiry are removed after one hundred and eighty (180) days.
2. Payment, invoice, and tax records: for as long as tax and accounting law requires, generally seven years.
3. Enquiries and correspondence: for as long as needed to respond and follow up, and to keep a record of what was agreed.
4. Security and abuse records: one hundred and eighty (180) days, except the record of a connection that has abused the Service, which we keep while it is needed to keep that abuse out.
5. Sign-in and joining limits: ninety (90) days.
6. Search logs: for as long as they are useful to improve search. The hashed IP address is removed from each entry after one hundred and eighty (180) days.
7. Contributions to the record: with the record, because a correction is only as good as the source it names.
8. Information about those who hold office: while it forms part of the record of the office, including its history, or until it is corrected or removed under section 11.
9. Comments and votes: until you or we remove them.
10. Analytics: according to the retention settings of Google Analytics and PostHog.

Where we keep information in a form that no longer identifies you, we keep and use it only in that form and do not attempt to identify anyone from it. Closing your access from your account page ends your access but does not erase your information. To have it erased, write to us under section 12.

10. Security

We use administrative, technical, and organizational measures appropriate to the information we hold: traffic is encrypted in transit; sign-in cookies are marked secure and are not readable by page scripts; access to systems holding personal information is limited to those who need it, and administrative actions are logged; IP addresses are replaced with a keyed one-way hash before they are written to our own records; and embedded metadata is removed from uploaded photographs. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

11. The record, and those who hold office

The record this site publishes concerns institutions and public offices: dioceses, parishes, cathedrals, schools, religious institutes, the times at which they offer the sacraments, and those who hold office in them. It is compiled from information published about those institutions and offices, including what the institutions publish about themselves, and from corrections sent to us by readers and institutions. Because this information does not come from the people it concerns, we give this notice to them here.

What it holds about people. For those who hold or have held an office, the record may include their name, office and title, the see, parish, or institute they serve, the dates of their appointments, their religious institute, their dates and places of birth and death, and the official contact details their institution publishes. Pages about individual people, and any published contact address that belongs to a named person, are shown only to signed-in readers. We publish nothing about the private life of any cleric, religious, or lay employee.

Why, and on what basis. To keep an accurate public record of the Church’s institutions and offices, on the legal bases set out in section 4. It is kept as long as section 9 describes.

Your choices. If you hold or have held an office named in the record, you have the rights in section 12 in respect of the information about you, including the right to object, and you may ask us to correct or remove a personal detail. A correction from an institution about itself outranks every other source we have. Where a name is removed, the office is left standing and blank rather than filled with a guess.

12. Your rights and how to use them

Wherever you live, you may ask us to tell you what personal information we hold about you and give you a copy, to correct it, or to delete it. Write to [email protected] and say what you are asking for. Sections 13 and 14 set out the further rights that the law of your place of residence gives you.

Verification. To protect you, we confirm a request by asking you to reply from the email address we hold, and may ask for a little more where the request concerns sensitive information. We use what you give us for verification only for that purpose.

Authorized agents. Someone may act for you with your signed permission; we may ask you to confirm your identity and the permission directly with us.

Timing and cost. We respond within the period the applicable law sets: forty-five (45) days under U.S. state laws and one (1) month under the UK and EU GDPR, extendable where those laws allow, in which case we will tell you why. We do not charge for a request unless it is manifestly unfounded or excessive.

Limits. We may keep information where the law requires or permits it, for example for tax records, to complete a transaction, to secure the Service, or to establish or defend a legal claim. If we cannot fully meet a request, we will explain why.

No discrimination. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised any of these rights.

13. California and other U.S. states

This section supplements the rest of this policy for residents of California and of the other U.S. states with comprehensive consumer privacy laws. It serves as our notice at collection.

Your rights. Subject to the applicable law, you have the right to know what personal information we collect, use, and disclose, and to receive it in a portable form; to correct it; to delete it; to opt out of its sale, sharing for cross-context behavioural advertising, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects, none of which we do; and to limit the use of sensitive personal information, which we already confine to the purposes the law permits. Section 5 names each third party to which we disclose personal information.

Categories collected in the preceding twelve months.

The purposes for which we collect and use each category, and how long we keep it, are set out in sections 3 and 9. We process precise geolocation only with your consent (section 7). We use sensitive personal information only to provide the Service you request and for the other purposes permitted by California Code of Regulations, title 11, section 7027(m), and not to infer characteristics about you.

Appeals. If we decline a request, you may appeal by replying to our decision with the word “Appeal.” We will answer within the period your state’s law sets, and if you remain dissatisfied you may contact your state attorney general.

14. UK, EEA, and Switzerland

Your rights. You have the rights of access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent at any time. You may lodge a complaint with the supervisory authority where you live or work, or where you believe an infringement occurred: in the United Kingdom, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner; and in the EEA, the data protection authority of your country. We would be grateful for the chance to put things right first.

International transfers. We are established in the United States. When you use the Service from elsewhere, you provide personal information directly to us in the United States, where data protection law differs from the law where you live. Our service providers process it in the United States and in other countries where they operate. Where the law requires a safeguard for a transfer, we use one it recognizes, such as the EU-U.S. Data Privacy Framework with its UK Extension and the Swiss-U.S. Data Privacy Framework, or the European Commission’s Standard Contractual Clauses with the UK Addendum. You may ask us for a copy of the relevant safeguards.

15. Children

The Service is not directed to children under thirteen (13), and we do not knowingly collect their personal information. If you believe a child has given us personal information, write to us and we will delete it.

16. Changes and contact

Changes. We may update this policy, and the date at the top of this page shows when it last changed. Where a change is material, we will say so at the top of this page for at least thirty (30) days and tell account holders by email before it takes effect.

Contact. Ocean Edgewater, LLC, operating Catholic Intelligence: [email protected]. If you need this policy in another format, for example because of a disability, write to us and we will provide it.