Isaac’s Well

Proposed draft · 24 October 2026 · revised 27 October 2026

Privacy notice

This notice says what Isaac’s Well collects, who sees it and when, and how long it is kept. It is a draft for the working group and counsel. Nothing in it is adopted yet, and it takes effect only when the site opens. It carries out charter 9 and principles 7 and 8.

In short. We collect only what we need. We never sell or rent it, show advertising, or use analytics or tracking. Your elders see your application and nothing more, except in the few cases section 4.3 sets out. Only affirmed members see your profile, which shows your first name, never your last name, town or contact details. Before an introduction, the other member is told your marital history and children, and their counselor, if they named one, learns your first name and church. Your messages are private, but they are not end-to-end encrypted: those who run the site open them only to deal with a report or fix a fault, and opening them through our tools is recorded and reviewed. When you leave, your profile and photographs are deleted within [30] days, and backups are overwritten within a further [60] days. We keep only payment records, for [7] years; anything bearing on an open report or a matter given to the authorities, until it is closed; a brief record if your account was closed for misconduct, for [10] years; reports you made, while the member you reported remains a member; reports not borne out, for up to [12] months; and the record of your acceptance of the terms and your consents. Messages you sent stay with those you wrote to, as letters do.

1. Who we are, and whom this covers

  1. Isaac’s Well is [legal name], a nonprofit corporation organized in [Tennessee]. It is responsible for the information described here. How to reach us is in section 11.
  2. This notice covers members and those applying to join, the elders who affirm them, the counselors members name (charter 6.3), those who give, and anyone a member names to hide from.
  3. Isaac’s Well is for adults 18 and over. If someone younger gets in, we close the account and keep only what the law requires to protect the child and to report it (charter 9.12).
  4. Survey answers are governed by charter 10.2, not by this notice. Individual answers to the 2026 surveys stay with the working group, and are never joined to any account.

2. What we collect

  1. When you join. Your name, email address, date of birth, whether you are a man or a woman, the state [or region] where you live, the church you choose from our list, and your sign-in details. Passwords are stored only in a form no one can read.
  2. Your marital history. Whether you have never married, are widowed or are divorced, and whether you have children (charter 5.3). We do not ask for your children’s names.
  3. Your elders’ details. The name and email address [and phone number] of the elder each church names to affirm members, which we confirm ourselves and you never give us (charter 4.6), and a record of each affirmation and renewal.
  4. Your profile and photographs. What you write about your faith, character, hopes for marriage and interests, and the photographs you add, and any short commendation your elders write for you (charter 6.2). Location data is stripped from every photograph at upload. We never use face recognition, or scan photographs for facial geometry.
  5. A counselor, if you name one: their name, email address and relationship to you.
  6. Interest and messages. Whom you show interest in, the introductions made, the members, churches and named people you block or hide from (for a named person, the name and date of birth you give us, used only to keep your profile from them), and the messages you send and receive.
  7. Reports. Reports you make, reports made about you, your answers, and what was decided.
  8. Payments and gifts. The amount, date and purpose of each fee or gift, and any waiver or refund. Stripe takes your card details. We receive only [the card type and last four digits].
  9. Technical logs. A record of requests to the site, with the internet address and time, used only to keep the site secure and look into abuse. Cookies only keep you signed in [and remember your settings].
  10. What we do not collect. No analytics, tracking scripts, advertising cookies or social-media pixels. No location, contacts or bought data. No scripts from other companies, except Stripe’s on the payment page. No Social Security number, no health information, and no background checks (charter 5.2).
  1. We use your information only to do what Isaac’s Well exists to do (charter 2): to confirm with your elders, each year, that you may take part; to show your profile and make introductions; to keep members safe and handle reports; to take fees and gifts and keep the accounts; and to write to you about your membership.
  2. Personal information. Some of what you give us is personal: your faith, your church, whether you have been married. Some state laws ask for your clear agreement before a site collects this, so when you join we ask you to agree to it on its own, in plain words. Isaac’s Well cannot work without it, because every profile is built on church and faith.
  3. You may withdraw that agreement at any time by leaving (section 8.3). We then delete your information as section 6 says.
  4. We will not use your information for any other purpose without first asking you.
  5. No decision about you is made by a computer alone. Your elders decide whether to affirm you, and people decide what follows a report. Any fraud check on messages only warns the person receiving them (terms 9.5).
  6. We do not use members’ profiles, photographs or messages to train artificial intelligence. We choose providers whose terms do not allow it, where we can.

4. Who sees what

  1. Other members. Only signed-in, affirmed members [of the opposite sex] see your profile, never the public or search engines. It shows your first name, age, state or region (a wider region where your state has fewer than [3] participating churches), your church’s confession and association (RBNet or FIRE), your photographs and what you wrote, and your elders’ short commendation if you choose to show it, never your last name, last initial, town or contact details. Your church’s name is shared at introduction, or earlier if you choose. Your marital history and children show only if you choose, but are always told to the other member before an introduction. You may hide your profile from your own church’s members, any other church you list, or a named person (charter 5.6).

  2. Interest and introductions. No one is told of your interest until it is mutual. Then we introduce you privately, without showing contact details.

  3. Your elders. Your church’s affirming elder, who has accepted a confidentiality undertaking, sees your application when you apply and at each renewal: your name, email address, church, marital history, children and any counselor you name [and your main photograph]. He confirms that you are at least 18, but is not shown your date of birth, and sees only his own church’s applications. Your elders never see the rest of your profile, your messages, or whom you are interested in (charter 6.1). They are told more only:

    • if, after hearing both sides, we pause or close your account for misconduct: then, after the person who reported is told, the kind of conduct found and what was done, never who reported without that person’s written agreement (charter 9.7);
    • if you are accused of a possible serious crime that has been reported to the authorities, only as an accusation, and as charter 9.8 further limits; or
    • if you report harm, and choose to have them told (charter 9.9).

    A pause while a report is looked into, a block, and any step that only keeps two members apart are never reported to elders.

  4. Your counselor. A counselor you name, whose name and relationship your elders confirm, accepts a confidentiality undertaking, is told of each mutual interest and is copied on each introduction. They learn only the other member’s first name, church and profile summary, never their messages. Every profile shows whether that member has named a counselor, and by showing interest you agree to this (charter 6.3).

  5. Those who run the site. A few people the board approves can reach the systems that hold your information. Each is commended in writing by their own elders and has signed a confidentiality undertaking (charter 7.3). They read messages only to deal with a report or fix a fault. Opening a member’s messages through our tools is recorded, and the chairman, or another director if he must stand aside, reviews that record. Direct access to the database is limited to [named roles], used only to repair faults, and logged by our hosting provider (charter 9.2).

  6. Those who handle reports. The directors, and any stand-in or adviser asked to help, handling a report (charter 9.6). No one close to a member involved takes part. A member who is reported is told what was reported, but not who reported it. We will not name you, but in many cases the member you report will be able to tell who you are (charter 9.5, terms 12.4). Individual members are discussed only in closed session, and left out of shared minutes (charter 7.9).

  7. Service providers. A few companies run parts of the site for us, under written contracts that keep your information confidential and let them use it only for us:

    • hosting and database: [provider];
    • photograph storage: [provider];
    • email delivery: [provider]; and
    • payments: Stripe, which holds card details and also uses payment and device data to prevent fraud, under its own privacy policy.

    They store your information in the United States. We update this list before adding a provider.

  8. The authorities. We give information to the police, a court or a child-protection agency when the law requires it, always when a child may be at risk, and when someone is in danger of death or serious injury (charter 9.8). If you are harmed, we give the police what you ask us to. When a court or agency demands your information, we tell you first, unless the law forbids it, the authorities ask us to wait, or telling you could put anyone at risk or hinder an investigation of harm (charter 9.9).

  9. If Isaac’s Well ends or passes on, your information is never sold, and passes to an organization of like faith only with your consent (charter 12.3).

5. What we never do

  1. Sell, rent or trade your information, to anyone, for any reason (charter 8.3).
  2. Show advertising, use analytics or tracking, or share your information with social-media or advertising companies.
  3. Let anyone pay to see who is interested in them, or to be shown more often.
  4. Show contact details, a last name or a town on a profile.
  5. Tell your pastor whom you are interested in, or tell your elders anything beyond section 4.3.
  6. Give your information to RBNet, FIRE or any church other than your own elders, except to an adviser asked to help with a report (charter 9.6), who is never one RBNet or FIRE names (charter 11.4). Reports to RBNet and FIRE give totals only, never names (charter 11.3).
  7. Buy information about you, or combine what you give us with information from anywhere else.
  8. Use face recognition on your photographs.

6. How long we keep it

  1. While you are a member, we keep your information. An old version of your profile is replaced, and a photograph you remove is deleted within [30] days.

  2. When your membership ends, for any reason (charter 5.4), your profile is hidden at once. Your profile, photographs, interests, blocks, application and your copy of your conversations are deleted within [30] days, and copies in our backups are overwritten within a further [60] days. Messages you sent stay in the conversations of those you wrote to, as letters do, until they leave or delete them (charter 9.10). We email you to confirm the deletion without your having to ask, stating exactly what was kept, why and for how long, and the date by which backups are overwritten.

  3. What we keep after that:

    • payment and gift records, for [7] years, for tax and accounting;
    • anything bearing on an open report or a matter given to the authorities, until it is closed, and at least as long as the law requires;
    • a brief record of anyone whose account was closed for misconduct, or recorded as closed under charter 9.11: their name, date of birth, church, email address, the date and a one-sentence reason, kept for [10] years and used only to check anyone who applies to rejoin;
    • reports the member made, kept while the member reported remains a member, so that a pattern can be seen;
    • reports not borne out, for up to [12] months; and
    • the record of the member’s acceptance of the terms and of their consents.

    A report the reporter chose not to have put to the member is not counted as not borne out. It is kept like other closed reports.

  4. Applications that are not affirmed are deleted within [30] days, and the fee is refunded (charter 8.2).

  5. Elders’ details are deleted when the church names another elder or leaves.

  6. Technical logs. Our own logs are kept [30] days. Our providers keep theirs under their published terms.

7. Keeping it safe

  1. Your information is encrypted on its way to and from the site and where it is stored.
  2. Messages are not end-to-end encrypted, which is how reports can be dealt with. Judge what you write accordingly.
  3. Only the people in sections 4.5 and 4.6 can reach members’ information, each with [two-step sign-in], and their access ends when they stop serving.
  4. No system is perfectly secure. If a breach puts your information at risk, we tell you promptly, and within the time the law sets: what happened, what was affected and what you can do.

8. Your choices and rights

  1. See and correct most of your information in your settings, or write to us for the rest.
  2. Get a copy of your information in a common file format, and download any conversation you are part of.
  3. Delete or leave. Leave at any time, or ask us to delete a particular thing, such as a photograph (section 6).
  4. Choose what shows. You choose your photographs, whether your marital history and children show, whether your elders’ commendation shows, when your church’s name is shared, whom you hide from, and whether to name a counselor.
  5. Answers. We answer within 45 days, free of charge, once we confirm the request is from you. If we cannot do what you ask, we say why, and you may ask the chairman to review it, or complain to your state’s attorney general.
  6. No penalty. Using any of these rights never counts against you.
  7. Do Not Track. We track no one, so a browser’s Do Not Track or Global Privacy Control signal changes nothing: we already do what it asks.

9. Email

  1. We write to you about your membership, and you choose which notices about messages and interest you receive.
  2. Emails about messages say only that something is waiting for you, never its words.
  3. We send news, word of gatherings or appeals for gifts only if you ask for them, and stop promptly when you ask.
  4. Our emails carry no tracking images or tracked links, and never ask for your password.

10. Members outside the United States

  1. Your information is stored in the United States, and what applies to members abroad is for the board to decide [board decision]. Until then, a member who moves abroad has their profile [paused] (terms 13.3).

11. Changes, and how to reach us

  1. If we change this notice in a way that matters, we tell members by email and on the site at least [30] days before the change takes effect. We will not use information you have already given us in a new way without your consent.
  2. Earlier versions are kept, and we send one to anyone who asks.
  3. Write to us at [privacy@ address] or [postal address]. The project lead answers. If your concern is about the project lead, or about how we answered you, write to the chairman at [address].

Notes for counsel

  • Which US privacy laws could apply. About 20 states now have comprehensive consumer privacy laws. Most exempt nonprofits, but several do not. Each counts residents of its own state only, so none is likely to reach a site of a few thousand members soon. The draft is written to meet the strictest of them anyway, because the cost is small and the data is sensitive.
    • Colorado (C.R.S. 6-1-1301 et seq.) has no nonprofit exemption. It applies at 100,000 Colorado consumers a year, or 25,000 with revenue from selling data. “Sensitive data” includes data “revealing … religious beliefs … sex life or sexual orientation”, and needs prior consent (6-1-1303(24), 6-1-1308(7)). Its rules (4 CCR 904-3) also govern how consent is obtained and refreshed. Colorado AG.
    • Oregon (ORS 646A.570 to 646A.589) has covered nonprofits since July 1, 2025, and applies at 100,000 Oregon consumers. Sensitive data includes “religious beliefs”. ORS 646A.570, 646A.572.
    • Delaware (6 Del. C. ch. 12D) exempts only insurance-crime nonprofits. It applies at 35,000 Delaware consumers, falling to 10,000 on January 1, 2027 under HB 380. Sensitive data includes religious beliefs and sex life, and from 2027 inferences. Delaware Code, Morgan Lewis on HB 380.
    • Minnesota (Minn. Stat. 325M.10 to 325M.21) exempts only insurance-fraud nonprofits, and applies at 100,000 Minnesota consumers. 325M.11.
    • New Jersey (N.J.S.A. 56:8-166.4 et seq.) has no nonprofit exemption, and applies at 100,000 New Jersey consumers. Sensitive data includes “religious beliefs” and “sex life”, and needs consent. Statute.
    • Maryland (Com. Law 14-4701 et seq.) does not exempt nonprofits, and applies at 35,000 Maryland consumers. Sensitive data, including religious beliefs and sex life, may be collected only where “strictly necessary” for the service asked for. Every sensitive field in section 2 should pass that test. Maryland AG.
    • Tennessee’s Information Protection Act (Tenn. Code Ann. 47-18-3201 to 3213) exempts nonprofits. Virginia, Connecticut, Indiana, Kentucky and most others also exempt them. California’s CCPA reaches only for-profit businesses. Please confirm Oklahoma and Alabama, which take effect in 2027.
    • If any of these laws applies, it also requires a written data protection assessment. We suggest the board do one before opening regardless.
  • Marital history as “sex life”. Section 3.2 deliberately says “personal” in plain words. Whether being divorced, widowed or a parent is “sex life” data under these laws is unsettled, and Delaware’s 2027 text reaches inferences. The draft treats the whole profile as sensitive and asks a separate consent for it.
  • Washington My Health My Data Act (RCW 19.373) has no nonprofit exemption and no size threshold, and “consumer health data” includes a disability. So Isaac’s Well collects no health information (section 2.10), and the disability refund is granted without medical information (terms 8.3), although California Civ. Code § 1694.3(a) would let it ask for a physician’s note. Secondary sources: IRMI, Perkins Coie. Please confirm against the statute.
  • Illinois Biometric Information Privacy Act (740 ILCS 14) carries a private right of action for collecting “face geometry” without written consent. Section 2.4 rules out face recognition, and the build must not use any provider feature that scans faces, including automatic photo moderation, without counsel’s review.
  • CalOPPA (Cal. Bus. & Prof. Code § 22575(b)(5)) requires a website collecting personal information from Californians to say how it responds to Do Not Track signals. Section 8.7 does so. It requires disclosure only, not that the signal be honored.
  • The FTC Act and keeping promises. Section 5 (15 U.S.C. 45) reaches “corporations” organized for profit (15 U.S.C. 44), so the FTC generally lacks jurisdiction over a genuine nonprofit. A broken privacy promise could still be pursued under state consumer law, such as Tenn. Code Ann. 47-18-104, or in contract. The draft treats every sentence as binding, so the build must deliver each of these before opening:
    • a record of every opening of a member’s messages through our tools, reviewed by the chairman, and hosting-provider logs of direct database access (4.5);
    • a counselor flag on profiles (4.4);
    • location data stripped from photographs, and no face recognition (2.4);
    • no third-party scripts or fonts, with Stripe’s script on the payment page only (2.10);
    • hiding from one’s own church, other listed churches and a named person (4.1);
    • deletion within 30 days, backups within 90, and an automatic email confirming it and stating what was kept, why and for how long (6.2);
    • conversation download (8.2);
    • email without tracking (9.4).
  • AI training. Section 3.6 promises only what Isaac’s Well controls. Provider terms vary and change, so it says “where we can” rather than promising a contract term no provider may offer.
  • Children. COPPA (16 C.F.R. Part 312) applies only to services directed to children under 13 or with actual knowledge of them, so it should not apply. If a minor gets in, a report to NCMEC under 18 U.S.C. 2258A is treated as a request to preserve its contents for one year (subsection (h), as amended in 2024), and the provider may keep them longer to fight child exploitation. Section 6.3 keeps such material “at least as long as the law requires”. Tennessee also requires every person to report suspected child abuse (Tenn. Code Ann. 37-1-403 and 37-1-605).
  • Reading and disclosing messages. As a provider of electronic communications, Isaac’s Well may disclose stored messages with a party’s consent, to protect its users, or to the authorities in an emergency involving danger of death or serious physical injury (18 U.S.C. 2702(b)(8)). Charter 9.8 and section 4.8 say so. The terms of use take members’ consent to the reading described in section 4.5.
  • Breach notification. Tennessee’s law (Tenn. Code Ann. 47-18-2107) requires notice within 45 days but defines personal information narrowly. California (Civ. Code 1798.82) also counts a username or email with a password, which Isaac’s Well would hold. Section 7.4 promises notice regardless.
  • CAN-SPAM (15 U.S.C. 7701 et seq.). Membership notices are transactional. Section 9.3 meets the opt-out rules for any optional email anyway. FTC guide.
  • Dating service laws with privacy duties. New York Gen. Bus. Law § 394-c, subd. 5, forbids transferring a member’s personal information without prior written consent, and subd. 6 requires its return or deletion, with certification, when the contract ends. The joining consent (terms 4.2) and the unasked deletion email (section 6.2) are meant to meet these. Subd. 6 allows information to be kept only “where required by law or court order”. The safety retentions in section 6.3, the record of accounts closed for misconduct, reports kept so that a pattern can be seen, and reports not borne out, go beyond that. Counsel is asked to accept or narrow them for New York members. The online dating safety acts of New Jersey, New York, Illinois and Texas impose notice duties, which belong in the terms of use; see its notes.
  • Members outside the United States. FIRE has churches outside the United States (Wikipedia; not verified against FIRE’s directory). The GDPR and UK GDPR (Art. 3(2)) would apply to members in Europe or the UK, treating religious belief as “special category” data (Art. 9) and requiring local representatives (Art. 27). Brazil’s LGPD (Art. 3) reaches services offered in Brazil. Canada’s PIPEDA reaches only commercial activity, but provincial laws may reach nonprofits. Charter 4.1 is not narrowed here. Whether and how to serve members abroad is a board decision, on counsel’s advice in each country. Until then, section 10 pauses the profile of a member who moves abroad.
  • Choices proposed for the board. These are in brackets in the text:
    • deletion within 30 days, with backups within a further 60 (charter 9.10 leaves the period to the board; the terms of use use the same figure);
    • payment records kept seven years (counsel to confirm against IRS and Tennessee rules);
    • the record of closed accounts kept ten years;
    • our own technical logs kept 30 days;
    • whether profiles are shown only to members of the opposite sex;
    • whether the affirming elder sees the applicant’s photograph;
    • which roles may reach the database directly.
  • Open questions.
    • Should the 2026 survey working group formally hand its records to the board, or keep them apart as section 1.4 assumes?