ShepherdForge
Draft — owner/legal review required. This text describes current ShepherdForge application behavior. It is not a finalized legal agreement and must not be treated as public-facing terms until registration is separately authorized.
This Privacy Policy describes how the ShepherdForge application (app.shepherdforge.com) handles information for self-service beta accounts. It is limited to practices implemented in the current software. It does not describe ministry websites that merely use ShepherdForge to publish studies.
When you register we collect:
After verification we store workspace files you create or generate, including Bible study drafts and published markdown, workspace settings, optional hosted pages, logs used to operate the workspace, and search indexes used for study retrieval. Successful logins may be counted for operator beta tracking (username, workspace, timestamp, and a login count). Hashed identifiers of IP addresses may be stored briefly to enforce registration rate limits. Verification tokens are stored only as hashes, not in raw form.
If you use AI-assisted features, the text you submit for those features is sent to a third-party AI provider (currently OpenAI) to produce a response. If you use public study chat on a published workspace, questions and study context may be processed to generate answers.
We use session cookies required to keep you signed in (HttpOnly, SameSite=Lax; Secure on the production HTTPS host) and CSRF tokens to protect forms. This signup flow does not implement advertising cookies or a marketing email list.
The software does not include a feature to sell or rent personal information. We do not use signup data to send marketing campaigns in this version.
The production application runs on the operator’s hosting provider with a persistent disk for workspace files. Email verification, when configured, is sent through the transactional provider named in the application environment. AI features, when used, call OpenAI. Those processors receive only what the corresponding feature sends.
Content you publish (studies, hosted pages) can be read by anyone with the public URL. Unpublished drafts stay in your workspace files. Platform operators with Super Admin credentials can manage workspaces, including suspension. They do not log in as your workspace admin through this signup flow.
Account and workspace data remain on the managed disk while the workspace exists. Archive and suspend block login and keep files. This version does not offer self-service account deletion. The operator may later delete a workspace as an operational task; that is not an automated user-facing right in the current code. Email verification pending records expire and are replaced or removed as verification proceeds.
Beta accounts may expire when an expiry window is configured. Expired and suspended accounts cannot log in, and existing sessions for those workspace admins are ended on later requests.
Passwords are hashed. Verification tokens are random, single-use, expiring, and stored as HMAC hashes. Signup, resend, and verification attempts are rate-limited. Browser forms use CSRF protection. Session cookies use HttpOnly and SameSite=Lax (Secure on production HTTPS). These measures reduce risk; they are not a claim of perfect security.
The service is intended for adults creating study content. It is not directed at children under 13, and the software does not implement a parental-consent flow.
Public visitors to a ministry workspace may see a different Privacy Policy at that site’s /privacy path. That page is workspace content. This document applies to ShepherdForge account holders on app.shepherdforge.com.
The version identifier on this page is recorded when you accept it at signup. Material changes will receive a new version identifier.
Contact the ShepherdForge operator through the channels published on shepherdforge.com. Transactional mail is sent from noreply@shepherdforge.com and is not a monitored inbox.