Privacy Policy

TGAW is built for the global watch — from the EU to California to Brazil and beyond. This policy explains what we collect, why we collect it, and the rights you have in your region. We keep it plain, and the same protections travel with you.

Manage non-essential cookies anytime: Avatar → Cookie Preferences, or below.

What we collect

Account details you give us, content you create (posts, bookings, messages), and technical signals (IP country, device, consent). No sensitive categories unless you share them.

Why & legal basis

To run the community you joined (contract), keep it safe (legitimate interest), and only set analytics/marketing when you consent (Art. 6 GDPR).

Your controls

View, correct, delete, or export your data. In the US: Do Not Sell/Share + GPC. Everywhere: withdraw consent in one tap.

1. Who we are

The Global Altar Watch (“TGAW”, “we”, “us”) operates the community platform for devotion, prayer, Bible reading, and fellowship at tgaw.app. We are the controller for personal data processed on the site.

Contact: info@tgaw.app
DPO / privacy contact: same address — subject “Privacy Request”.
EU representative (where applicable) and US contact details are provided on request.

2. Personal data we collect

Category	Examples	Purpose	Legal basis	Retention
Account & Profile	Name, email, password hash, avatar, role, timezone, country, age range	Create & secure your account; personalize bookings	Contract · Legitimate interest	While account active + 30 days after deletion request
Content & Activity	Posts, comments, likes, bookings, messages, group membership, presence heartbeat	Deliver community, slots, chat and feed	Contract · Legitimate interest	Until you delete or account closure
Technical & Cookies	IP country, device, tgaw_consent, session_token, analytics events (if consented)	Geo-adaptive consent, security, aggregated metrics	Consent · Legitimate interest	tgaw_consent 12 months; session 30 days; analytics 14 months
Communications	Email/push preferences, notification logs, support messages	Send devotion reminders & updates per your preferences	Consent · Contract	Until unsubscribe or account deletion

We do not intentionally collect data from children under 13, and do not process special categories (health, political, religious beliefs) except where you voluntarily share a testimony or prayer request — processed only for the feature you used.

3. Purposes & legal bases (GDPR Art. 6)

Contract

To deliver what you signed up for.

Creating your account, saving bookings, delivering messages, posts, and presence — without this, the watch cannot function.

Legitimate interest

Security, safety, and basic analytics.

Fraud prevention, rate limiting, crash logs, and strictly necessary cookies. We balance this against your rights and keep it minimal.

Consent

You opt in, we activate.

Non-essential cookies, email/push notifications, and any analytics/marketing. Withdraw in Avatar → Cookie Preferences or see the Cookie Policy.

Legal obligation

When the law requires it.

Responding to lawful requests, tax record-keeping, or enforcing our Terms. We only share what is required.

4. Cookies, Consent Mode & signals

We use a geo-adaptive banner: EU/EEA, UK, Brazil, Canada, Japan, Korea, South Africa and similar regions see strict opt-in (non-essential cookies off until you consent); US states see opt-out with Do Not Sell or Share; elsewhere we show notice-only. See the full Cookie Policy for the cookie table and durations.

Consent Mode v2: ad_storage, analytics_storage, ad_user_data stay denied until you allow Analytics/Marketing.
Global Privacy Control: browsers sending Sec-GPC: 1 automatically get Marketing = denied on first visit (CCPA/CPRA, CPA, CTDPA).
Your choice is stored in tgaw_consent (12 months, v1) and honors expiry/version bumps.

5. Sharing & processors

We only share with trusted processors who make TGAW work:

Hosting & database — Vercel / MongoDB Atlas (infrastructure, strictly necessary).
Auth & email — Better Auth, SMTP provider (to verify email, reset passwords).
Media & storage — Cloudinary (if you upload images/tracts).
Analytics (only if consented) — Google Analytics 4 via Consent Mode; never loaded before consent in strict regions.

We do not sell your personal information. US “sharing” for cross-context ads only occurs if you allow Marketing — turn it off to opt out.

6. Retention

Account & content: while your account is active; deleted quickly after you delete your account or content (residual backups expire within 30–60 days).
Logs & heartbeat presence: short-lived (minutes to days); presence rows auto-expire via TTL.
Cookie consent: 12 months or until a version bump.
Where the law requires longer (e.g., tax, abuse logs), we keep the minimum required and no more.

7. International transfers

Our infrastructure may process data in the US and EU. For transfers from the EEA/UK/Switzerland we rely on adequacy decisions where available, otherwise Standard Contractual Clauses (SCCs) and supplementary measures. Brazil (LGPD), South Africa (POPIA), and others are handled on the same basis.

8. Security

We protect data with hashed passwords, scoped sessions, RBAC (member → superadmin), TLS, and least-privilege access. No system is 100% secure — use a strong, unique password and enable 2FA in Settings when available.

9. Your rights

Your region shapes your rights — we honor the strongest among them. To exercise any right, email info@tgaw.app or use in-app Settings where available.

Right	EU/EEA/UK	US (CA/CO/CT…)	How to act
Access / Know	Art. 15	CCPA §1798.100	Request a copy of your personal information
Rectification / Correction	Art. 16	CPA / CPRA	Fix inaccurate profile or content
Deletion / Erasure	Art. 17	CCPA §1798.105	Delete account & associated content
Restriction / Limit	Art. 18	CPRA Sensitive PI limit	Limit processing to storage only
Portability	Art. 20	CCPA / CPA	Export your data in JSON/CSV
Object / Opt-out	Art. 21	Do Not Sell/Share + GPC	Avatar → Cookie Preferences → Marketing off
Withdraw consent	Art. 7(3)	Universal opt-out	Change cookie toggles anytime

Deletion

Delete your account in Settings. We will remove posts, bookings, and profile promptly; backups age out within 60 days. We keep only what the law requires.

Do Not Sell / GPC

US residents: Avatar → Cookie Preferences → Marketing off, or turn on GPC in your browser. No discrimination for exercising rights.

10. Changes & contact

We will update this policy when our practices or applicable laws change. Material changes bump tgaw_consent version and re-show the banner; the “Updated” badge at the top will change.

Questions or requests? info@tgaw.app · See also Cookie Policy and Terms & Conditions.

Supervisory authority (EEA/UK) and state AG (US) contact details available on request. We respond to verifiable requests within 30 days (EU) / 45 days (US), with a single 45-day extension where allowed.

info@tgaw.app

GDPR · CCPA/CPRA · LGPD · POPIA · APPI · PIPA compliant · Consent Mode v2 & GPC supported · This is not legal advice.