Privacy Policy — INVEST Marriage

In short

The app holds personal things: how you communicate, notes to your spouse, conversations with the Coach. We treat all of it as sensitive.
Your spouse sees only what the app says is shared. Coach conversations are private to you.
We do not sell your information, show ads, or track you across other apps and websites.
A small number of service providers run the app for us; each is named below.
You can delete your Coach conversations, or your whole account, in Settings at any time.
The app is for adults, 18 and older.

Who we are

INVEST Marriage is made by Wildfire Leadership, LLC ("we", "us"), the company of Bill and Stephanie Lammers, authors of the INVEST Marriage curriculum. We are the data controller for the information described here. Questions or requests: info@wildfireleadership.com.

This policy covers the INVEST Marriage app for iPhone and Android and this website, invest.wildfireleadership.com.

What we collect, and why

Account details. Your first name, your email address, whether you are the husband or the wife, and the season of marriage you chose. We use these to sign you in (by a code sent to your email, or on an iPhone through Sign in with Apple) and to address you and your spouse by name in the app. If you sign in with Apple, Apple gives us your name the first time only and an email address, which may be a private relay address that forwards to you.

What you write in the app. Your Snapshot answers and results (how you communicate and how you are most loved), your daily notes to your spouse, what you enter in the couple tools (Grace Place, the Mission Portrait, Proper Portions, the DREAM Map, date-night questions, the weekly reflection), and your conversations with the INVEST Coach. We store these so the app can show them back to you and to your spouse where the app says they are shared, and so the Coach can answer from your own Snapshot.

Your church or group code, if you redeemed one. It tells us which group gave you access so the app can open the right features. We do not share your answers, notes or conversations with your church or group.

Purchases. Whether you hold an active subscription or a gifted membership, and the dates it started and renews. Apple or Google handles the payment; we never see your card number.

Notifications. If you allow notifications, a device token so we can deliver them, and the reminder time you chose. A notification never shows the words of a note; it says that one is waiting. So that a note can appear on your home-screen widget the moment it arrives: on an iPhone, its words travel inside the notification encrypted to your phone, and only your phone can read them; on Android, the notification carries no words and only wakes the app, which then fetches the note over an encrypted connection.

Voice notes, if you record one: a short recording, up to 30 seconds, that you choose to send to your spouse. It is stored privately, only the two of you can play it, and we never transcribe or analyze it. The app uses the microphone only while you are recording.

Photos you add to a note, if you add one: the picture you take or choose, resized on your phone and stripped of its location and camera details before it is sent. It is stored privately, only the two of you can see it, and a small copy is kept on your spouse's phone so it can show on their home-screen widget.

The monthly notes email, if you turn it on. The address it goes to (the one you sign in with, or another you confirm with a code sent to it) and when each one was sent. The email holds the notes you and your spouse left each other that month, so it carries their words to that address.

How the app is used. Which screens you open and which features you use, tied to your account and to your couple, with your role, your plan, your church or class code if you entered one, the phone's model and the app's version, so we can see what helps couples and what does not. We do not look up where you are. It never includes the words of a note, an answer or a Coach conversation, or your name or email. If the app crashes, a crash report with technical details about the device, the app version and the app's state at that moment is sent so we can fix it.

When someone talks about ending their life. If you tell the Coach you are thinking about ending your life, it points you to the 988 Suicide & Crisis Lifeline. When it does, we keep a record that it happened, never a copy of the conversation.

Images you choose. If you add a picture to a Mission Portrait, the image you chose or searched for. Apart from a photo you choose to add to a note, we do not otherwise access your photos, your contacts or your location.

On this website. The online workbook keeps your answers in your own browser's storage. They leave your device only if you ask for them by email ("Or email it to yourself" on Your workbook): then they pass through our server and Resend to the address you typed. We keep no copy; Resend keeps a delivery record for a short time. The INVEST Marriage Snapshot on this website works the same way: your answers stay in your browser, unless you save them for the app (below), and a link you send your spouse carries your result in its own address, which never reaches our server. If you take the Snapshot inside an AI assistant that has it connected (such as ChatGPT or Claude), the assistant sends your answers to our server to work out your result, and we keep no copy; what you tell the assistant itself is covered by its own privacy terms. Apart from that, this site sends us only the sign-up form, described below, and, if you press it, the "Turn it off" button from the monthly notes email. Our hosting provider keeps standard server logs (the address a request came from, the page requested, the time) for security and reliability.

Counting visits. On the website's public pages we use Vercel Web Analytics to count visits, so we can see how people find INVEST Marriage, including from AI assistants such as ChatGPT. It uses no cookies. It records the page you opened (without anything after it in the address, except a campaign tag such as utm_source), the site you came from, your country, and your type of device, operating system and browser, and it tells visits apart without following you from one day to the next. It does not run at all on pages whose address carries something private: the Snapshot itself, gift and pairing links, the notes and email-settings links, and your workbook.

Who can see it

Your spouse. The app is built for two. When you pair with your spouse, they can see what the app says is shared: your daily note to them, your Snapshot result once you have both taken it, and what the two of you write together in a couple tool. Your Snapshot answers themselves, and anything the app marks private to you, stay yours. If you add the home-screen widget, your spouse's note is shown on your home screen, where anyone who can see your phone can see it. If you send a note as a text, you choose where it goes.

Your Coach conversations are private to you. Your spouse cannot read them. We do not read them either, except to respond to a support request you make, to investigate abuse of the service, or where the law requires it.

We do not sell or rent your information to anyone, we do not show advertising, and we do not track you across other companies' apps or websites. We do not "share" personal information for cross-context behavioral advertising as California law defines it.

When we must. We may disclose information if the law requires it, to protect someone's safety, or to enforce our terms. If Wildfire Leadership is ever sold or merged, your information would go with the service under this same policy, and we would tell you.

Who processes it for us

We use a small number of service providers to run the app. Each one processes only what its job needs, under its own terms and safeguards, and none of them may use your information for their own purposes.

Supabase hosts our database, file storage and sign-in (United States).
Anthropic writes the INVEST Coach's replies. Your messages to the Coach, and the context the Coach needs to answer (your Snapshot results, your spouse's where they are shared with you, the parts of the curriculum that apply, and, when the Coach looks them up, your earlier Coach conversations, your Grace Place conversations and what you have noticed about your spouse in the app), are sent to Anthropic's Claude API to write each reply, under Anthropic's commercial terms, which do not allow it to train its models on them.
Google writes the Coach's reply, through its Gemini API, when Anthropic's service is unavailable, and for anyone who has so far agreed only to the Coach's earlier wording, which named Google alone. The same model reads a Mission Portrait you bring in from a photo or PDF, so its words land in the right places. The app asks for your permission in plain words before any of this happens, and you can withdraw it any time in Settings, which stops the sharing.
Apple handles Sign in with Apple and every purchase made on an iPhone.
Google handles every purchase made through Google Play, and delivers notifications to Android phones (Firebase Cloud Messaging).
RevenueCat keeps track of subscriptions using your account's identifier and the store's purchase receipt.
Expo delivers push notifications and app updates.
Resend sends your sign-in code by email and, if you turn it on, your monthly notes email. On this website, it emails you your workbook if you ask, and the code for a Snapshot you save for the app, and for sign-ups it sends the welcome note and keeps our mailing list.
PostHog keeps the usage information described above (United States), for us and no one else, and never for ads.
Sentry receives crash reports.
Unsplash receives your search words when you look for a picture for a Mission Portrait, and serves the picture you choose.
Vercel hosts this website and counts visits to its public pages (Web Analytics, described above).

Where it is kept, and how it is protected

Your information is stored in the United States. Everything travels encrypted between your phone and our servers, and is encrypted at rest. Each person's rows in our database are readable only by that person and, where the app says shared, their spouse; that rule is enforced in the database itself, not only in the app. On your phone, your sign-in is kept encrypted with a key in the device's secure key store (the iPhone's Keychain, or Android's Keystore). No system is perfectly secure, and we will tell you if a breach affects you.

How long we keep it

We keep your information while your account exists, so the app can show you your history. Coach conversations stay until you delete them. When you delete your account, your information is removed from our live systems right away and from backups on their rolling schedule, within 30 days. Usage information is tied to your account, never to your name, and is kept for up to a year. Crash reports are not tied to your account.

Your choices and rights

See and correct. Your name, role and season are in Settings. Everything you wrote is in the app where you wrote it. Email us if you want a copy of your information in a portable form.

Delete. Delete your Coach conversations, or your whole account, in Settings. Deleting your account removes your account, your answers, your notes (voice notes and photos included) and your conversations. Entries the two of you made together in a couple tool stay with your spouse, and their own notes and answers remain theirs. You can also email us and we will delete it for you; here is how.

Notifications. Turn them off in the app's Settings or in your phone's settings at any time.

Usage information. Turn off "Share usage data" in Settings, and the app stops sending it.

The monthly notes email. Turn it off in Settings, or with one tap from any of the emails.

Unpair. You can end the pairing with your spouse in Settings. What was shared up to then stays with each of you.

California residents have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information. To exercise a right, email us; we will verify the request through the email address on your account and answer within 45 days. You may authorize someone to make a request for you.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performing our contract with you (running the app you signed up for), your consent (notifications, and the faith-based and relationship content you choose to enter, which may reveal your religious beliefs), and our legitimate interests in keeping the service secure and improving it. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent, and you may complain to your local supervisory authority. Your information is transferred to and stored in the United States; we rely on our providers' standard contractual clauses for those transfers.

If you sign up on this website

When you leave your name on this website (on the home page, or on the page a QR code opens), we receive your first name, your email address, where you said you are (dating, engaged, married, or leading couples), whether you want to hear about retreats, the language of the page, and which page you used. Signing up does not create an account.

We use it for one thing: so Bill and Stephanie, and the small team helping them, can write to you about INVEST Marriage, the study and retreats. It goes to their inboxes at Wildfire Leadership. Resend, the service that sends our email, sends you one welcome note when you sign up and keeps what you gave us on our mailing list. We do not sell it or share it with anyone else.

We keep it until you ask us to remove it. Reply to any email from us, or write to info@wildfireleadership.com, and we will delete what you gave us.

If you save your Snapshot for the app

When you save the Snapshot you took on this website (“Keep it in the app”), we receive your email address, the first name you gave the Snapshot, your thirty answers, and whether you came from INVEST Engaged. They are kept with the app’s data so the INVEST Marriage app can bring them back for you: to the account with that email address once the address is confirmed, or to whoever enters the code we email you. We send you that one email. If you tick the box for occasional notes, your address and first name also go on our mailing list, as with the sign-up form above.

When the app takes your Snapshot, we delete your answers and your name from this record and replace your email address with a one-way hash; your answers then live in your app account, under the rest of this policy. What is left (the dates, whether you came from INVEST Engaged, whether the app found it by your email or by the code, and which app account took it) is kept for up to 180 days so we can count how many saved Snapshots reached the app. A save the app never takes is deleted after 90 days. To stop the form being misused we count saves per email address and per internet (IP) address for the day, as one-way hashes, deleted within two days. Write to info@wildfireleadership.com and we will delete a saved Snapshot sooner.

If you claim a partner gift

When you claim a gift from one of our partners on this website (for example a first year of INVEST Marriage from Vow + Vine), we receive your first name, your email address, your spouse’s email address if you give it, whether you are engaged or married, and whether you or your spouse serve in the military.

We use it to attach the membership to your INVEST Marriage account, and your spouse’s, when you sign in to the app with those addresses, and to send you one email with your gift link. It is kept with the app’s data. We tell the partner how many couples claimed, not who. We do not add you to a mailing list, sell it, or share it with anyone else.

To stop the form being misused, we also count, for the day, how many claims come from each email address and each internet (IP) address. Those counts keep only a one-way hash of the address, never the address itself, and are deleted within two days.

Write to info@wildfireleadership.com and we will erase your claim: your name, your email address and your spouse’s are removed, and your gift link stops working. A membership the gift has already given you lasts until it ends, unless you ask us to end it too. We keep only that a claim was made, with nothing that identifies you, so we can count claims for the partner. Deleting your app account does not remove the claim; write to us for that. If we end a gift because it was claimed in someone else’s name, we keep that claim, marked as ended, so it cannot be claimed again.

Children

INVEST Marriage is for adults. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18. If you believe a minor has an account, email us and we will delete it.

Changes to this policy

If we change this policy in a way that matters, the app will tell you before the change takes effect, and this page will show the new date. Continuing to use the app after that means you accept the change.

Contact

Wildfire Leadership, LLC · info@wildfireleadership.com