Privacy

The short version

Your sermons are private to your account. We do not sell data, do not run advertising, do not embed third-party trackers, and do not use anything you write to train a model.

What is stored

Your account. Your email address, the display name you chose, and your password — stored only as a scrypt hash, which means we cannot read it and cannot tell you what it is.

Your sermons. Everything you write: the manuscript, references, slides, margin and sticky notes, series, dates, and every version the product has saved for you.

Files you add. Voice notes and slide images, held in private storage that is not reachable from the public internet. Every request for one is checked against your session first.

Sessions. A record of the devices signed in to your account, so you can be signed in tomorrow and so a session can be ended.

An audit log. A line for significant actions — an account created, a password changed, a sermon published, imported or deleted. It records that a thing happened, not what the sermon said.

Cookies

Two, and neither of them watches you. sd_session keeps you signed in; it is HttpOnly, Secure and SameSite=Lax. sd_theme remembers whether you asked for light or dark.

There are no analytics cookies, no advertising cookies and no third-party tags on any page of this product — which is why you have not been asked to dismiss a cookie banner.

Who else is involved

Cloudflare hosts the product and holds the database and the file storage. Everything you write is stored on their network on our behalf.

Cloudflare Turnstile checks that a sign-up or sign-in is a person rather than a bot. It sees the request, not your sermons.

Cloudflare Workers AI transcribes a voice note when you ask it to. The audio goes to it and the text comes back.

Crossway’s ESV API receives the passage reference you look up — for example Isaiah 6:1–7 — and returns the text. It is sent a reference and nothing else: not your sermon, not your name, not your account.

Slides.Click receives slide changes only if you have deliberately connected a presentation system, and only while you are preaching. Disconnect it and it receives nothing.

Administrator access

A platform administrator can, in the course of supporting the product, open sermon content. This is worth stating plainly rather than burying: it is possible, and it is not routine.

Every such access writes a line to the audit log recording who did it and which sermon it was. The log exists so that the access is never silent.

What it is never used for

Not sold. Not shared with advertisers, data brokers or anyone else for their purposes. Not used to train any AI model. Not read for product research. Not published anywhere, under any circumstances, without you choosing to publish it.

Publishing, and what private means

Publishing a sermon for preaching creates a private URL with an unguessable address, and opening it still requires your session. Two independent locks, on purpose. It is not listed, not indexed, and not reachable by anyone who is not signed in as you.

Every page holding your work is served with headers telling search engines not to index it, in addition to the tag on the page itself.

Keeping and deleting

Deleting a sermon deletes its content, its versions and the audio and images attached to it, from the database and from file storage.

To have your entire account removed, write to us and we will do it. Self-serve account deletion is not built yet; when it is, this page will say so.

Audit log lines outlive the thing they describe, because a record of a deletion that gets deleted is not a record.

Where it lives

On Cloudflare’s network, which is distributed across many countries. Your sermons may be stored and served from a location near you rather than a single place.

Children

Sermons.Dev is a tool for people doing the work of preaching. It is not intended for children and we do not knowingly hold data about them.

Changes and questions

If what we do with your data changes, the date at the top changes and the product will tell you before it takes effect.

Any question about your own data — what is held, or getting it removed — write to us through the address on your account. A person reads it.