Privacy

A membership directory is a list of real people, their phone numbers, their addresses and their children’s names. It is one of the more sensitive things a church keeps. This page says plainly what happens to it.

Whose data it is

The directory belongs to the church, not to us. Cotek App FZ-LLC operates Fold and processes what a church puts into it on that church’s instructions. Each church decides who is in its directory, what appears against them, and who may read it.

What is held

• Names, including preferred and maiden names, and the surname the directory is filed by.
• Contact details a member or an administrator has entered: phone, WhatsApp, email, address.
• Birthdays, and a year of birth where one has been given.
• Photographs, in colour and in a black-and-white copy made for printing.
• Family links — spouse, parent, child, sibling, guardian — and household membership.
• Church record: membership status, the date someone joined, baptism, previous church, any office they hold.
• Where a membership has ended: the date, the reason the church recorded, and any note kept with it.
• Notes an administrator has written, marked private and never shown to members or printed.
• Where a church chooses to hold them, copies of identity papers — a passport, a residence permit, a safeguarding check — together with their reference number and expiry date.
• Sign-in details for people with accounts, and a log of changes made to the directory.

Who can see it

Two settings decide, and the stricter one always wins. A church sets how open its directory is — whether addresses appear, whether birthdays do, whether children are listed. Each member sets how visible they are. A member can always be more private than their church, and never less.

Fields a reader is not entitled to are removed on the server before the page is built. They are not hidden with styling and they are not present in the page source.

Administrators, pastors and elders see the full record, including private notes. That is the point of the roles: a church cannot pastor people it cannot contact.

Taking the directory out

An administrator — and only an administrator — can export the whole directory as a spreadsheet. It is the complete record: every phone number, address and private note, unaffected by what individual members have chosen to share, because it goes to the person already answerable for the account. No other role can do it, not even one that can print the book. Every export is written to the audit log with a name, a count and a time against it, so a church can always answer “when did our directory last leave the building”.

What your church recommends

A church may add links to other services — a counselling service, a signup, a companion app. These are chosen by your church, not by us, and they appear under your church’s name. Following one takes you to a separate service with its own terms and its own privacy; we are told nothing about it, and nobody in your directory can see that you went.

Households that share an email address

Plenty of families use one address between them, and children have none at all. Where a church allows it, an adult may keep the details of the people in their household who have no sign-in of their own — a spouse, their children. They can change for those people exactly what they can change for themselves: contact details, a photograph, and what the directory shows.

The moment somebody has an account of their own, their entry is theirs alone. Nobody else in the household can change it, and nobody with their own sign-in is ever quietly editable by a relative. A church can turn the whole arrangement off in its settings.

Identity papers

A church may hold scans of documents it is required to keep. These are treated differently from everything else in the directory, and deliberately so:

• Only an administrator, or an elder or pastor the church has named one at a time, can reach them. No role carries this on its own, and a directory editor never has it.
• They never appear in the directory, in the printed book, in an export, or on the member’s own page.
• The file is never linked to directly. It is streamed through an authenticated route, so the storage address exists only on the server and cannot be forwarded, bookmarked or left in a browser history.
• Every single opening is written to the audit log, with a name and a time against it.
• Deleting one removes the file from storage as well as the record of it.

A church should hold these only where it has a reason to and has told the person concerned. Fold makes it possible and accountable; whether it is lawful and necessary is the church’s decision.

Where it goes

• Email. Invitations and announcements are sent through Resend on the church’s behalf, from the church’s own name.
• Files. Photographs, logos, attachments and printed editions are stored on Vercel Blob.
• The database. Everything else is in a Postgres database operated by Neon.
• Hosting. The application runs on Vercel.

Nothing is sold. Nothing is used to train anything. No advertising or analytics network is given access to a church’s directory.

The printed directory

When a church prints its directory, the resulting PDF contains whatever that church has chosen to include, and it leaves our control the moment it is downloaded. Churches should treat a printed directory the way they have always treated one: distributed to members, not published.

When a membership ends

A church releases a member — a transfer, a resignation the members have accepted, a removal, a death. Only an administrator can record it, and nobody can record it against themselves: resigning is something a person asks their church for, not something they do to a database.

• The record is kept, with the reason and the date the church agreed it, among the past members. It appears in no directory, no list, and no printed book.
• Unless the church chooses otherwise, a short message is sent saying the membership has ended. Nothing is sent where somebody has died.
• Their sign-in no longer opens that church’s directory. The account itself is untouched, so another church can invite the same address and the invitation attaches to the account they already have.

Membership is held in one place at a time. Fold will not record somebody as a member of a second church while a first still has them on its roll — it says which church, so the two can speak.

How long it is kept

For as long as the church keeps it. Archiving a person keeps their record and takes them out of the directory and the book; deleting removes it outright, along with the family links that ran through it. Both are the church’s decision, not ours.

Asking for your own record

Ask your church first: an administrator can show you your profile, correct it, or remove it. If your church cannot help, write to us at support@cotek.live and we will act on the church’s instructions or, where the law requires it, directly.

Security

• Passwords are stored as bcrypt hashes at twelve rounds and never in the clear. A sign-in attempt for an address with no account costs the same time as one with, so the difference cannot be measured.
• Invitation and password-reset links are thirty-two bytes from a cryptographic random source, and are stored only as their SHA-256 hash — so reading the database yields no usable link.
• Each church’s data is separated from every other church’s at the level of every query. An administrator of one church cannot read, change or delete anything belonging to another, by any route.
• What a reader is not entitled to is removed on the server before the page is built. It is not hidden with styling, and it is not present in the page source.
• Pages are sent with a same-origin referrer policy, so an address that carries a token — an invitation, a reset — never leaks to another site. The pages may not be framed by another site, which closes the trick of laying an invisible page over a real one to harvest a click.
• Signing in, registering, accepting an invitation and asking for a password reset are rate-limited, so guessing is slow and expensive rather than free.
• Nothing behind a sign-in is written to the browser’s offline cache — a directory page left in the cache of a shared phone would be a leak rather than a feature.
• Exporting the directory, and every opening of an identity document, is written to the audit log.

No system is perfect. If we discover a breach affecting a church’s directory, we will tell that church without undue delay and help them meet whatever obligations they have.

Telling us about a security problem

If you believe you have found a way to see something in Fold you should not, please write to support@cotek.live and describe it. We would far rather hear from you than not. Please do not access, download or alter anybody else’s data while demonstrating it — tell us what you found and we will reproduce it ourselves. We will acknowledge you within a few days, keep you informed while we fix it, and we will not pursue anyone who reports something in good faith and in that way.