No nonsense.
Your data is yours.

Your ministry records are yours. WitnessWork is designed to keep them on your device and, if you sync your devices, end-to-end encrypted on our server (Cloud Sync) or in your own iCloud or Google Drive storage. We do not sell your data or show ads. Some features use an anonymous account on our server that has no name, email, or phone number. We collect usage statistics and diagnostics as explained below.

• AI Notes Import: available on iOS and, as it rolls out, on Android from Google Play. When you use it, your notes are sent through our service and OpenRouter to zero-data-retention AI providers. The import is normally deleted from our servers within about one hour; limited identifiers, content hashes, and usage totals tied to your anonymous account may remain to prevent abuse and manage usage. Our server also sends PostHog import statistics, such as note length, outcome, and record counts, under a one-way hash of your account, never your notes or names.
• Address search: the address you search for is sent through our service to HERE to return suggestions and coordinates.
• Help Center search: when you search the Help Center while online, in the app or on this website, the text you type, your language, and your device type (iOS or Android) are sent to our search service on Cloudflare, which uses Cloudflare Workers AI to find matching answers. Searches are not linked to your account, and we don't keep a log of what you searched. Offline, the app searches the Help Center on your device.
• Android maps: Google Maps processes map requests and interaction data, device and SDK information, IP addresses, a Maps-specific identifier, and crash diagnostics to provide maps and improve Google services. If you allow location access and use location tracking, the map centers on your location. You can deny or revoke location permission in Android settings.
• Supporter status: RevenueCat and your platform's store (Google Play on Android, Apple on iOS) process purchase history to verify access and provide purchase analytics. The app uses a pseudonymous identifier with RevenueCat to check access. Your anonymous account is linked with that RevenueCat customer so our server can tell whether the account is a Supporter, and RevenueCat notifies our server when that changes. Our server receives the purchase status, product, and expiry date, never your payment details.
• Usage statistics: the app sends PostHog screen and feature activity, app version, and device information under a random identifier stored on your device. It is not your account or the identifier used to check supporter access, and it is replaced when you turn usage statistics off. Events may include purchase-status flags and the selected Publisher role; that role can indicate religious affiliation. Usage events do not include your name, contact records, notes, addresses, or typed text. PostHog can derive an approximate, country-level location from your connection.
• Crash reports, feature availability, and surveys: crash reports with technical details of the failure go to PostHog so bugs can be fixed. The app also asks PostHog which features are enabled for your install, using its analytics identifier, so new features can be released gradually. If you answer an optional in-app survey, the answers you choose to submit are sent to PostHog as well. These are not affected by the usage-statistics switch.
• Reliability and security: Our hosting provider, Cloudflare, processes IP addresses and operational logs to run and protect the service.

• Anonymous account: Buddies, Cloud Sync, backups, moving to a new phone, and Scribe AI Notes Import use an account on our server. It is a random account id and a public key; the secret account key stays on your devices (and in iCloud Keychain or Android Block Store). It has no name, email, or phone number. We use it to run those features, count Scribe AI usage, and suspend accounts that abuse Buddies. The server also knows which Buddies inbox belongs to your account, but not who your buddies are.
• Device verification and sign-in: when the app signs in to your account, Apple App Attest (iOS) or Google Play Integrity (Android) confirms that it is the genuine WitnessWork app on a genuine device. Apple or Google receives that check from your device. On iOS, our server keeps the app’s verification key for your installation to check later requests. For each signed-in device, our server stores its platform, a device name encrypted on your devices that we cannot read, and when it signed in and expires; not your IP address or a device identifier. Sign-ins last at most 90 days and are deleted a week after they end.
• Account activity: so you can spot a sign-in you didn’t make, our server keeps a security history you can see in Settings → Account: sign-ins, sign-outs, devices signed out, your account sent to a new phone, backups downloaded or deleted, suspension and reinstatement, and your Buddies inbox linked or deleted. Each entry has its time, platform, and encrypted device name; never your IP address, location, content, or anything about your buddies. Entries are deleted after 400 days.
• Cloud Sync: each device that syncs through Cloud Sync, the default way to sync your devices, encrypts a copy of its data on the device, end to end, with a key only your devices have, before uploading it. Our server stores only data it cannot read, with each copy’s size, upload time, and the sign-in that uploaded it, and tells your other devices when something changed so they can fetch it. A device deletes its copy when it stops using Cloud Sync. Our server also deletes a copy 30 days after its last upload once that device is signed out, and any copy 400 days after its last upload. Without your devices or your recovery key, no one can read it, including us. Each device syncs one way at a time; you can switch to iCloud or Google Drive sync, which WitnessWork doesn’t encrypt end to end, or turn sync off.
• Backups and moving to a new phone: if you turn on backup, your data is end-to-end encrypted on your device before it is uploaded, so our server stores only data it cannot read, with its size and upload time. A backup is deleted 400 days after its last upload, or right away when you delete it. When you set up another device, our server relays the encrypted exchange between your phones and keeps it no longer than 10 minutes. Without your phones or your recovery key, no one can read the backup, including us.

• End-to-end encrypted: Buddies shares your planned service days, invitations to Plans and Follow-ups, replies, and badges with up to five buddies. Everything you share, including your name, is encrypted on your device with keys only you and your buddies have. Our server relays it and cannot read names, Plans, notes, or photos. A shared Follow-up carries only its date and time, the contact’s first name, an address, and the topic; in data protection mode, only the date and time.
• What our server stores: your inbox and a record for each buddy (random ids and public keys), the encrypted events and Buddy Cards your buddies send you, an encrypted list of your buddies so your other devices can restore them, and invitations until they expire (at most 7 days). Events are deleted 30 days after they are sent. An inbox that isn’t used for 180 days is wiped; only a one-way hash of its key is kept, so no one else can take over its address.
• Photos: when photo sharing is available, photos in a shared Plan’s note and your full-size Profile photo are encrypted on your device and stored in Cloudflare R2. Our server sees only the encrypted file, its size, and when it is uploaded and read. Each photo is deleted when it expires, at most 90 days after it was uploaded, or sooner when you remove it or stop sharing.
• Notifications: each device gives our server a push token so it can send alerts through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). The alert text our server stores and sends is generic, like “A buddy has a new badge”; your device adds the buddy’s name from the encrypted event the alert carries. Apple and Google receive the token, that generic text, and encrypted data.
• Your account and abuse reports: your Buddies inbox is linked to your anonymous account. When someone reports abuse, the report names an inbox, and we use the link to find the account behind it and may suspend that account, which stops its Buddies until it is reinstated. A suspended account can still remove buddies and delete its Buddies data.
• Removing and deleting: removing a buddy deletes that pairing’s cards and events from both inboxes. Delete My Buddies Data wipes your inbox, including its buddies, events, devices, and photos, and deletes your Buddies key, keeping only the one-way hash above. Both work even while Buddies is turned off.

Turn usage statistics off at any time in Settings → Preferences → Privacy; the switch stops usage events on that device. It is in version 1.44.0 and later on iOS and Android (Android 1.43.0 has no switch). You can delete records in the app and remove WitnessWork data from iCloud through Apple’s settings. In Settings → Sync you can turn Cloud Sync off, which deletes that device’s copy from our server. In Settings → Account you can sign other devices out and delete your backups. In Buddies you can remove a buddy or delete all your Buddies data. To ask about data or request deletion of server-side records tied to your account or app identifier, email support@leviwilkerson.com.