Privacy Policy

Your group's, not ours. What Hilltop collects, who can see it, how long it's kept, and the choices you have.

Effective November 1, 2026

In short

No ads, no tracking, and we never sell your information.
Hilltop keeps only what it needs to work: your account, your birthday (month and day, never the year) and what you share with your groups.
The people in a group see what's shared in that group. Prayer requests go only where you choose.
You can delete your account any time in Profile. Your profile is erased and your messages are unsent for everyone.
Questions or requests: [email protected].

This summary is for convenience. The full policy below is what applies.

1. Who we are and what this covers

Hilltop is run by Edward Samolov, an individual in Washington State, USA ("Hilltop", "we", "us" and "our"). He decides how your information is used and is responsible for it. Hilltop is independent and isn't run by any church.

This policy covers the Hilltop app, Hilltop on the web (app.hilltopapp.com) and hilltopapp.com. It goes with the Terms of Use, and the Consumer Health Data Privacy Policy adds to it for health information.

It doesn't cover websites that people link to, Apple's own handling of your Apple account, the App Store and notifications (see Apple's privacy policy), or what other people do with what you share outside Hilltop. Group leaders aren't part of Hilltop: they're responsible for how they use what they see, and the Terms limit them to using it for their group.

2. Information we collect

2.1 What you give us

Your accountYour first and last name, email address and password. The password is stored only in a scrambled form that no one can read. If you sign in with Apple, we get an Apple account number and the name and email Apple shares, which can be a private relay address.

Your birthdayMonth and day, required at sign-up. You enter your full date of birth, but your phone works out your age and drops the year: it's never sent or stored. We keep only whether you're 13–17 or 18 and up.

If you add themA profile photo, a phone number, and a username (like @edd) so people in your groups can tell you apart from anyone with the same name.

Who sees whatYour choice of who sees your phone, email, birthday and your other groups: everyone in your groups, only the Leaders, Co-leaders and Admins of groups you share, or only you.

What you shareMessages, voice messages, photos, reactions, posts, prayer requests and "I prayed", a group's weekly Bible passage with a leader's note and "I read it", events (with a place and, if one is added, its street address or video call link), RSVPs and their notes, poll votes, sign-ups, announcements, resources (links and images), group details and photos, chat names and pictures, and reading plans: plans you make (their days, readings, intros and questions), who you read them with, your checks, the plans you save, and your Think it over notes.

Safety and supportReports you make (the reason and what you reported), people you block, feedback you send from the app (your note, an optional screenshot and the app version) and emails you send us.

2.2 What other people share about you

People in your groups and chats may mention you, post a photo with you in it, write a prayer request about you, or report something you posted. Leaders may send you reminders and approve or decline your requests to join. If you host a gathering, you or a leader may add the place's address or a video call link to the event. Someone may invite you to read a reading plan with them; you can leave it any time.

2.3 What's made as you use Hilltop

Which groups and chats you're in and your role in each, join requests, which messages you've read (others in a chat see "Seen"), reminders leaders send you, your notification choices and quiet hours, pinned and muted chats, which version of the Terms you agreed to and when, and the times of all of these. "Typing…" is passed along live and never stored.

Anonymous polls stay anonymous: your phone keeps a random code in your iCloud Keychain so you can change your vote, and our server stores only a scrambled form of that code with the vote, never who you are.

2.4 From your device

If you allow notifications, your phone's push address (from Apple) and its time zone, so notifications reach you and quiet hours follow your clock. With "Gathering day on Lock Screen" on, also Apple's Live Activity addresses for that phone (one that lets us start the card, and one for each card that lets us update it), so your next gathering's card can appear and stay current without opening Hilltop. The card shows only the gathering's title, time, the place's name, a change of plans, how many are coming and your own answer; never names, notes or addresses. Like any internet service, our service providers also see your IP address and basic device details when the app or website connects, and keep them briefly in technical logs.

2.5 What stays on your phone

Drafts, settings, the welcome ideas you acted on or waved off, the group milestones you thanked people for or hid, and messages waiting to send while you're offline. Signing out clears them.
Copies of the profile pictures and group photos you've seen, so they show at once next time. Chat photos aren't kept. Signing out clears them.
A copy of what you last saw (your groups, events, the chat list with each chat's last few messages, prayer requests, polls and sign-up sheets), so the app opens filled in. It's locked by your phone's passcode protection, left out of backups and cleared when you sign out.
For Hilltop's widgets, a small file with your groups' names and colours and your gatherings for the next 7 days (the group, the title, the time, a change of plans and your own answer, plus the place's name once you've said you're going), and any answer you tapped on a widget that hasn't been sent yet. It also keeps a small copy of each of your groups' cover photos (made on your phone from the cover you can already see in the app, replaced when the cover changes and removed when you leave the group) so the Next gathering widget can show it. It never holds prayer requests, notes, names of people, faces, phone numbers or addresses. It's left out of backups, the place is hidden on the Lock Screen while your phone is locked, and signing out clears it.
Adding an event to your calendar only adds it. Hilltop never reads your calendar.
Searching by voice uses Apple's speech recognition on your phone. Nothing you say is recorded or sent.
Photos are saved again on your device before they upload, which leaves out the location and camera details stored in the original file.
The camera, microphone and photo library are used only when you choose to take, record or pick something.

2.6 On hilltopapp.com

The website has no ads, analytics or tracking cookies. Cloudflare, which hosts it, keeps short technical logs to deliver and protect the site. An invite link's code is read on the page and isn't stored.

Hilltop on the web (app.hilltopapp.com) is the same service in a phone's browser, for people without an iPhone: the same account and the same information described above, with no ads, analytics or tracking cookies either. Your browser's own storage keeps you signed in until you log out. While you confirm a new account's email, it also briefly keeps the name, the birthday month and day and the age group you entered (never the year), and clears them once you sign in on that browser. It doesn't send notifications.

2.7 What we don't collect

Your phone's location (an address someone types for an event is part of that event), contacts, browsing history, purchases, payment details, advertising identifiers, fingerprints or face data. Hilltop has no analytics, advertising or tracking code in it.

3. How we use it

Only to run Hilltop for you:

to show what you share to the people you share it with, and keep your groups, events and chats working
to show a group simple totals about itself (how many times it has gathered, counted from days when someone said Going, and how long it has been on Hilltop), only to its members and never per person
to send account emails (confirming your email, resetting your password) and the notifications you choose
to keep Hilltop safe: reviewing reports, enforcing the Terms, limiting spam and abuse, and keeping Hilltop for people 13 and older
to answer you, and to fix problems that you, or the crash reports Apple sends when you've chosen to share them, point us to
to follow the law and protect people's rights and safety

We never sell or rent your information, show ads, track you across other apps or websites, build advertising profiles, or use what you share to train AI models.

4. Who can see what

Name, photo and usernamePeople in your groups and chats, and the leaders of a group you ask to join. A username doesn't make you findable: there's no search for people outside your groups.

BirthdayYour choice in Profile → Who sees what (month and day only). It starts as everyone in your groups, so they can celebrate it.

Phone number and emailYour choice in Profile → Who sees what. Both start as only the Leaders, Co-leaders and Admins of groups you share. You can choose everyone in your groups, or only you.

Your other groupsPeople always see the groups they share with you. Whether they see your other groups is your choice; it starts as everyone in your groups.

When you joined a groupThat group's members. Hilltop uses it only on their phones, to suggest saying welcome during your first week; the date itself isn't shown.

Age groupNot shown to anyone in the app.

Group contentPosts, events, polls, sign-ups, announcements and resources: that group's members.

"I read it"Only you see that you marked a group's passage read. The group sees only how many did, never who.

Event addresses and call linksThat group's members. The Address field and a video call's link are never put in notifications or invite previews. A host's note for guests is seen by the same people.

Reading plansThe people reading a plan (or, for a group's plan, that group's members) see it and who's in it. Your checks are yours alone; they see only how many read a day, never who. Your Think it over notes are seen by the people in that plan when its maker lets readers see each other's notes, and otherwise only by you. If a plan's maker lets others save a copy, people who share a group with its maker can see the plan (its name, days, readings, intros and questions, never anyone's notes) and start their own copy, which says who made it.

MessagesThe people in that chat, including people added later, who can see earlier messages. "Seen" and reactions too.

Prayer requestsYour choice each time: the whole group, only its Leader and Co-leaders, or only you.

ReportsThe Hilltop team, and for things shared in a group, its Leader and Co-leaders (unless the report is about them). Only the Hilltop team sees who sent a report.

FeedbackOnly the Hilltop team.

A group's Leader, Co-leaders and Admins also see who asks to join it. When you block someone, their messages and prayer requests are hidden from you, and they can't start a chat with you or add you to one. Anyone who can see something can also take a screenshot of it, so share with care. If you use Bring a friend on a gathering, Hilltop writes a short message on your phone with that gathering's name, day and time, the group's name and its Leader's first name, and its place only if you choose (never its address). It goes only where you send it; Hilltop doesn't send or keep it.

6. How long we keep it

Your account and what you share: while your account exists, or until you (or, for group content, a leader) delete it.
Deleted photos, voice messages and files: removed from storage, usually within minutes.
Push addresses: removed when you sign out. Ones not used for 90 days are deleted. Live Activity addresses go with them, when you turn "Gathering day on Lock Screen" off, and when a card ends (a card's address is never kept more than 2 days).
Notification text: removed from our queue once it's sent. The queue is cleared within 14 days.
Records that limit spam: 2 days.
Reports and feedback: as long as needed to keep Hilltop safe and improve it, without your name once your account is deleted.
Technical logs at our service providers: kept briefly to run and protect their services.
Backups: deleted information leaves them as they expire, within 30 days.
When the law requires it (for example, a legal hold or a child-safety report), we keep what's needed for as long as it requires.

7. Deleting your account

In the app, go to Profile and tap Delete account. If you're a group's Leader, you'll first hand the group to someone else or delete it. Then:

Erased: your profile, photo, username, who-sees-what choices, birthday, phone number, reading plans you made (with everyone's checks and notes in them), your reading checks, Think it over notes and saved plans, prayer requests, posts, polls and sign-up sheets you created, RSVPs and notes, votes, sign-ups, reactions, group memberships, notification choices, push addresses and Live Activity addresses, and any event address or note you added as a host (also cleared when you leave that group). Votes in anonymous polls were never linked to you and stay in the totals.
Unsent for everyone: every message you sent, with its photos and voice messages. Others see that a message was unsent.
Kept for the group, without your name: events (with any place and address a leader typed), announcements and resources you created as a leader, and the reports and feedback notes you sent (feedback screenshots are deleted).
If you signed in with Apple, we ask Apple to end Hilltop's access to your Apple account.

Can't use the app? Email [email protected] from your account's email address and we'll delete it for you. Copies other people saved themselves, like screenshots, aren't in our control.

8. Children and teens

Hilltop is for people 13 and older and isn't directed to children under 13. Sign-up asks for a date of birth before any account is made; under 13, no account is made and sign-up stays closed on that phone. We don't knowingly collect personal information from children under 13. If we learn that we have, we delete it and close the account. If you're a parent or guardian and think this has happened, email [email protected].

Teens 13–17 use the same Hilltop as everyone else and confirm a parent or guardian is OK with it. We keep only whether someone is 13–17 or 18 and up, never their birth year.

9. Faith and health information

Being in a church group on Hilltop, and what you share there, can say something about your religious beliefs. Prayer requests, messages and posts often mention health, yours or someone else's.
We use this information only to provide Hilltop the way you ask: to show it to the people you choose. We never sell it, never use it for ads or profiles, and never use it for anything else without asking you first.
You choose what to share and, for prayer requests, who sees it. Please ask before sharing someone else's request or health news outside the group.
The Consumer Health Data Privacy Policy explains your extra rights under Washington's My Health My Data Act and similar laws.

10. Security

Everything travels encrypted (HTTPS), and Supabase encrypts the data it stores.
Database rules let each person see only what they're allowed to. Photos and files are private and open only through links that expire.
Messages aren't end-to-end encrypted. Only the Hilltop team can reach stored information, and only to run Hilltop, look into a report, or when the law requires it.
Notifications can show a message's first words on your lock screen. To hide them, go to your iPhone's Settings → Notifications → Hilltop → Show Previews.
No system is perfectly secure. If a breach affects your information, we'll tell you without unreasonable delay, as the law requires.

11. Your choices and rights

11.1 In the app

See and correct your details any time in Profile, choose who sees your phone, email, birthday and other groups in Profile → Who sees what, and change your username once a month.
Choose your notifications in Profile → Notifications, or turn them off in your iPhone's Settings.
Block or report anyone, delete what you've posted, and delete your account any time.

11.2 By asking us

Wherever you live, you can ask us to give you a copy of your information in a format you can take elsewhere, correct it, delete it, tell you who we've shared it with, or stop using it for something you agreed to. Email [email protected] from your account's email address so we can confirm it's you; someone acting for you needs your signed permission. We answer within 30 days, or tell you if we need more time and why.

If we turn a request down, we'll explain why, and you can appeal by replying to our answer. We'll respond to an appeal within 45 days. If you're not satisfied, you can contact your state's attorney general.

We'll never treat you differently for using these rights.

11.3 Do Not Track and Global Privacy Control

We don't track you across apps or websites, so these browser signals change nothing here: we already don't sell or share information for advertising.

11.4 California and Nevada

We don't share personal information with anyone for their own direct marketing (California's "Shine the Light" law), and we don't sell covered information (Nevada law).

12. Where it's stored

Hilltop is offered in the United States, and your information is stored and processed in the United States. If you use Hilltop from somewhere else, your information is transferred to the United States.

13. Changes to this policy

We may update this policy as Hilltop and the law change. If a change matters, we'll tell you in the app or by email before it takes effect. The date at the top shows the current version, and earlier versions are available on request.

14. Contact

Privacy questions and requests[email protected]

Safety and reports[email protected]

Run byEdward Samolov, Washington State, USA