Last updated: 3 October 2026
Philly Christian Students (“PCS”, “we”) is a registered student organization at the University of Pennsylvania and Temple University. This policy covers the Philly Christian Students iPhone app.
We are a student club, not a company. We do not sell data, we do not advertise, and we do not use any analytics or tracking service. If you sign up, we do keep a note of which of our notifications you open — see below.
What the app collects, and only when you give it
If you sign up
The sign-up form asks for your name, your gender, and whether you are a college student (graduate students included). Gender is optional.
If you are a college student, it then asks for your school, year, email address, phone number and which activities interest you.
If you are not, it skips school, year and interests, and asks instead which Bible studies you’d like notifications from (UPenn, Temple, both, or neither) and whether you’d like notifications about the Intercollegiate Community Dinner, then your email address and phone number.
The phone number is optional either way, and you can skip it and still sign up.
You can also skip signing up entirely. Choosing “Just looking” gives you the whole app: meeting times, events, the reading tracker, everything. Nothing is collected. You can sign up later from the About tab.
Your sign-up is encrypted on your phone before it is sent. It is stored in Apple’s iCloud in a form that Apple cannot read, and that nobody without the club’s private key can read. That key is held only by the club’s staff, on their own phones.
If you RSVP to an event
Your name and email, your phone number if you give one (it is optional), and any note you add (a dietary requirement, for example). Encrypted the same way.
If you answer the availability survey
Before each semester, during the summer and winter breaks, the club may ask students who have signed up when they are free for a one-hour weekly Bible study. The answers decide one study time for the whole semester. The survey appears only when the club switches it on, answering is optional, and people who signed up from the community are not asked.
If you answer, the app sends:
- the times you marked on each day, and whether each one is a time you’re free every week or one you could make work if needed;
- your note, if you write one;
- your email address, so the club can match your answer to your sign-up. The website accepts an answer only from an address already in the club’s records;
- a random code the app made on your phone. Your sign-up carried the same code to the club, so the website accepts an answer only from the phone you signed up on. It keeps only a scrambled form of the code.
Unlike your sign-up, your answer goes straight to the club’s website over an encrypted connection, not through iCloud, so staff can see it straight away. On the website your times are stored as they are, and your note is stored encrypted. Your answer is also kept on your phone, so you can look at it and change it until the survey closes.
Staff see your answer in the staff-only area of the website, on your contact record and in a chart of everyone’s answers for your campus. Each time someone answers, staff phones get a notification with that person’s first name, the initial of their last name and the days they said they’re free. It passes through Cloudflare and Google like every other notification.
To stop misuse, the website counts how many answers come from one internet address. It keeps that count, in a scrambled form, for ten minutes.
If you allow notifications
Your device is registered with Firebase Cloud Messaging, a Google service, so we can send reminders about meetings and events.
Google receives a device token — an anonymous identifier for your phone — and the topics you subscribe to: all, your campus (or the Bible study you chose, if you signed up from the community), and the activities you said interested you. If you’re a student who has signed up, there is also a topic for your campus’s availability survey, so you hear when it opens. Registering your phone does not give Google your name, email, phone number, or anything else about you. Staff alerts about survey answers are different: they carry a first name and last initial, as described above.
Once you sign up, your phone also listens on a channel of its own, named with a scrambled form of the code your phone made. Staff can send a notice to chosen groups — for example, the students of one school, or people who are not students and asked to hear about the Temple Bible study — and the club’s website works out from its records who that is, then sends one copy to each of their channels. Google sees only those anonymous channel names, never your school or anything else about you. In the app’s list, such a notice carries short scrambled codes for the people it went to, so only their phones show it.
You can turn notifications off at any time in iOS Settings.
What the app tells us about our notifications, once you’ve signed up
- Which ones you open. When you open one of our notifications — by tapping it, or from the list in the app — the app tells the club’s website, with your phone’s code. Staff see, for each person, which notifications were sent to them and which they opened.
- Your phone’s notification address. The app gives the website the address Google uses to reach your phone (Firebase’s registration token). The website keeps it encrypted. Once a week it sends that address a silent message — nothing appears on your phone — to learn whether the app is still installed. If it isn’t, your record moves to staff’s list of people who deleted the app.
Nothing else about how you use the app is reported.
If you use the reading tracker or prayer book
This never leaves your device except to your own private iCloud. The club cannot see it. There is no setting that would let us. It syncs between your own devices through your personal Apple account and is invisible to us and to Apple.
The prayer book can be locked with a passcode you set, stored in your device’s Keychain.
What the club’s staff keep
Staff keep a contact record for people who have signed up or come to a meeting: the details above, notes about conversations, whether you have attended, your availability survey answers, and prayer requests you have shared. The record also shows whether, and when, you signed up through the app, the year you gave then and your year now (moved up each August), which notifications were sent to you and which you opened, and whether the app is still on your phone. After you graduate — from June 1 after senior year — you are moved to an archived list and no longer picked for notifications sent to chosen people. Staff can also stop sending you those notifications altogether.
These records are kept on staff members’ own phones, optionally in a staff member’s private iCloud as a backup, and in a staff-only area of the club’s website that only signed-in staff can open. On the website, your email address, phone number and the notes about you are stored encrypted. When staff share records with each other through the app, the whole thing is encrypted first with the club’s key.
Prayer requests you have shared are treated as more sensitive than the rest: the app does not send them to the website, and does not share them automatically, even between staff.
Who else is involved
| Service | What it receives | Why |
|---|---|---|
| Apple iCloud | Encrypted sign-ups and RSVPs it cannot read; club announcements | Storing and syncing |
| Google (Firebase Cloud Messaging) | An anonymous device token, your topic subscriptions and your phone’s own anonymous channel; the text of staff alerts about survey answers; a weekly silent message to your phone | Delivering notifications, and checking the app is still installed |
| Cloudflare | The notification text and which audience it is for, including the anonymous channels of the people a notice is for; once a week, your phone’s notification address, on its way to Google for the silent check | Passing notifications and the weekly check to Google |
| DreamHost (the club website’s host) | The staff-only records described above, with email, phone and notes encrypted; availability survey answers, with your note encrypted; a scrambled form of your phone’s code; your phone’s notification address, encrypted; which notifications you were sent and opened | Keeping the club’s records |
Cloudflare stores no information about any person — not your notification address, not your name, nothing. For one day it keeps a record of which messages were sent, and to which anonymous channels, so a retry reaches only the phones that missed it and nobody is notified twice.
We use no analytics service of any kind. The app includes Firebase Cloud Messaging only; it does not include Google Analytics. Apart from which of our notifications you open, described above, the app reports nothing about how you use it.
Sharing
We do not sell, rent, or trade your information. We do not share it with anyone outside the club’s staff, except the services above that are needed to run the app.
We would disclose information if required by law.
How long we keep it
Contact records are kept while you are involved with the club and for a period afterwards, so we can stay in touch. You can delete yours at any time — see below.
Your encrypted sign-up and RSVPs stay in iCloud, readable only with the club’s key, until you delete them.
Your availability survey answers are kept with your contact record, one for each semester you answered, until you delete your sign-up.
Your choices
- Use the app without signing up. Choose “Just looking”.
- Skip the survey. It is optional. Closing its card on the Home tab hides it there.
- Delete your sign-up in the app. On the About tab, tap Delete my sign-up (or Delete my RSVP details if you only sent an RSVP). It is removed from your phone straight away, along with your RSVPs and your survey answers, and a request goes to the club. What your phone can prove it sent us — your sign-up, your RSVPs, your survey answers, which notifications you opened and your phone’s notification address — is then erased from the club’s records automatically, on staff phones and on the club’s website, the next time staff open their part of the app, usually within a few days; nothing else is needed from you for those. If the club also holds a record of you that did not come from this phone — one a staff member wrote after meeting you, or one that came from an older sign-up sheet — a member of staff first checks by hand that it is really yours, so that one person’s request can never erase somebody else’s record. Until then, that record shows that you signed up in the app and then deleted your sign-up, with the date. That check can take a little longer than a few days; email us if you would rather not wait. If you came to a club meeting, the club keeps a record that one person was there, with nothing that says who. You can sign up again any time.
- Or ask us to delete it. Email us and we will.
- Turn off notifications. iOS Settings → PhillyCS → Notifications.
- Ask what we hold about you. Email us and we will tell you.
- Delete the app. Your reading tracker and prayer book leave this phone with it. They were only ever on your own devices and in your own iCloud; the club never had them.
Children
The app is for university students, and for adults who are not students and join the club’s Bible studies. It is not directed at children under 13, and we do not knowingly collect information from them.
Changes
If this policy changes, the date at the top changes with it. Significant changes will be announced in the app.
Contact
phillychristianstudents@gmail.com
Philly Christian Students
Philadelphia, Pennsylvania