YOUR PLAN, YOUR CHOICE

Privacy at Parish Pilgrim

Updated October 8, 2026

ParishPilgrim is a Smitz Group LLC project operated by Abraham Smitz to help people plan visits around Orthodox feast days. You can browse churches and upcoming feasts without signing in. Community and My pilgrimage require sign-in and a completed account.

Guest plans and favorites stay on your device

A guest's saved visits, favorite churches, and favorite celebrations stay in this browser's local storage. Anyone using the same browser profile may be able to see them. Clearing the site's browser storage removes those local choices. If browser storage is unavailable, favorites remain usable for the current visit.

Signing in will not automatically import a guest plan. You choose whether to import it into your account, with a reminder that a shared browser's plan may belong to someone else. Signing out keeps the guest and account plans separate.

Account favorites are also kept separately from guest favorites; signing in does not import them. Following a church or keeping a recurring celebration as a favorite is private and does not announce attendance. Favoriting a recurring celebration applies to that church's commemoration, rather than to every church with the same patron. Liking an individual event with its heart is a visit intention and uses your like privacy setting.

What an account keeps

Your ParishPilgrim account stores the plan with Cloudflare, and Google provides your sign-in identity. The account feature keeps the information needed to recognize you and save your choices:

• Your Google account identifier, name, email address, email-verification status, and a valid profile-picture URL when Google provides one, along with account creation and update times.
• The area and date window you choose, saved feast identifiers, and the time and version of your latest account preference update.
• Your favorite church and celebration identifiers, with their update time and version. Favorites remain separate from your saved visits and community activity.
• A profile with the first name, last name and city you enter and confirm; optional biography, main parish, preferred church calendar, patron saint, patron feast dates or descriptions, picture URL or uploaded profile picture; and profile update times and versions.
• Community sharing settings, default audiences for future posts and likes, your Google Calendar or .ics preference, optional social profile links, friendship requests and accepted friendships, blocks, pilgrimages you create, attendance intentions, comments, self-reported celebrations, uploaded pilgrimage photos, and content reports, with their audiences and update information.
• Session information that keeps you signed in, and temporary information used to complete and protect sign-in.
• Limited information for preventing repeated sign-in attempts, described below.

Finish setting up your account by confirming your first name, last name and city in the signup popup. We use your Google display name to suggest the name fields when available; you can correct them before saving. Your confirmed profile name stays separate from Google. Your city sets the default nearby search when it matches a supported Florida city. Guests start within 25 miles of Tampa. You can change the city or radius in Filters; unsupported account cities start with all Florida churches. The other profile fields are optional and are stored with your account in Cloudflare's database.

Your church calendar preference concerns the liturgical calendar used for feasts and fasts: Revised Julian (New Calendar), Julian (Old Calendar), Gregorian, or Other / not sure. For now, it is a saved preference only; it does not convert feast dates or provide a fasting tool. Parish feast dates continue to follow each parish's sourced calendar practice. A separate reminder setting uses Google Calendar by default, with .ics downloads available in your settings.

Your profile, plan, favorites, and community activity can reveal religious interests. Using an account is optional. Your saved feast plan and church or recurring-celebration favorites stay private. Event likes announce an intention to visit and are public by default. We do not use these records to build advertising profiles. Browser location access is optional and is requested only to choose a nearby city for discovery.

Your account uses your Google profile picture by default when Google provides one. Use Upload picture or Remove picture in Edit profile to change it. Click the picture to view it in full. A saved replacement or removal stays in place when you sign in again. Google pictures are not always available.

Uploaded profile pictures are resized locally to a JPEG of at most 512 pixels on either edge and 240 KiB. The server validates the image and strips application metadata, including common EXIF/GPS data, before storing it in Cloudflare's database. Only one uploaded picture is kept per account; replacement or confirmed removal invalidates its old link and deletes the old bytes. Profile pictures use an opaque image link that can be displayed with the profile and contributions you share. Anyone with that link can view the current picture. Google pictures and previously saved external picture links load from their hosts in your browser.

Choosing what to share

New member profiles use a public audience, including existing profiles that have never saved Community settings. Existing saved Private, Friends and Public audiences remain unchanged. Community settings let you keep your profile details private, share them with accepted friends, or keep them public. A completed signed-in member who opens a private profile can see its confirmed name and picture and send a friend request. Private profiles are excluded from unauthorized member search, and their biography, optional details, social links and history stay hidden. Anonymous private-profile reads, blocked relationships and unavailable accounts remain unavailable. Your biography is included only when your full member profile is visible; it is not added to the author details on a contribution. Choose separately whether to show your city, main parish, patron and feast descriptions, or church calendar. Each social profile link has its own audience, within your profile's audience. These are links you enter, not social sign-in connections or verified ownership claims; opening one contacts that service.

Each created pilgrimage, event like or attendance intention, comment, completion, and photo has a private, friends, or public audience. New likes, comments, and attached photos use a public audience by default; settings let you choose Private or Friends for future likes and posts separately. Changing these defaults does not change the audience of existing contributions. Celebration history and completions start private and appear on your profile according to their audiences. Friends means mutually accepted ParishPilgrim friends. An event's audience also limits every contribution within it.

Shared contributions display your confirmed first and last names and profile picture, even if your member profile is private. Clicking the number beside an event heart shows the members whose visit intentions are visible to the viewer. Other optional profile fields stay subject to your sharing settings. Public activity can be seen without signing in. Email addresses are not included in community member cards.

Direct messages are stored in the project's Cloudflare database and are available only to their sender and recipient through authenticated account checks. A new conversation requires a recipient profile visible to the sender. Messaging settings let you receive messages from members, accepted friends only, or no one; this choice is independent of your profile audience. Existing conversation history remains available to its participants when a profile or message setting changes. Blocking either participant hides the conversation and its notifications from both accounts and prevents further messages while the block is active.

The paper plane on an event sends its link and an optional note to friends you select in a private message. Both you and the recipient must currently have access to the event, and messaging preferences and blocks apply. Sending a link does not create a visit intention. If event access is later withdrawn, its attachment displays as unavailable on future reads. Previously reposted events can remain in the friend network; their access continues to follow friendship, blocks, reports, and the original event audience.

A shared event like is a visit intention. Accepted friends who can see that intention and the event can receive an in-app notification. Private intentions do not notify friends. Withdrawing the like or restricting its audience removes affected notification access on future requests.

In-app notifications store their recipient, the member who triggered them, the linked message, visit intention, or prior repost, and their creation and read times. Opening Notifications marks displayed notices read; opening a conversation also marks incoming message notifications from that member read. Public popularity ordering counts public event likes only; private and friends-only visit intentions do not affect public popularity.

Removing a friendship, blocking a member, narrowing an event's audience, or deleting an event changes access on future requests. Information someone already viewed, saved, downloaded, or captured cannot be recalled. Profiles show only activity accessible to the viewer; celebration badges reflect self-reported completions, not verified attendance. You can remove your own posts and photos and withdraw attendance intentions or completions.

Pilgrimage photos are uploaded to the project's Cloudflare database. The browser resizes and redraws each image as a JPEG, and the server independently validates size and removes application metadata and comments, including common EXIF/GPS data. Photos can still reveal people or locations in their visible content and captions. Current limits are 20 photos per member, 1600 pixels on either edge, and 240 KiB per image; shared project storage is limited too. Photos are served only after checking the current viewer and the event and photo audiences, without browser caching.

Reports store the reporter, content reference, explanation, and review status. Reporting hides the content for you and queues it for operator review; it does not promise immediate removal for everyone. Blocks prevent community interaction and content visibility between the affected members. Contact the project operator for urgent concerns.

Location search and maps

Your saved profile city takes priority for a default 25-mile search. For visitors without an account, the search starts within 25 miles of Tampa. A saved city outside the supported Florida directory leaves the statewide view available. ParishPilgrim asks your browser for device location only when you click the GPS pin in Filters, or confirm the location pin beside your profile city. It matches that location to a nearby city using its downloaded Florida location data. Precise coordinates are used only for that match, are not stored or sent to ParishPilgrim or a geocoding service, and are discarded. You can decline permission and enter a city or ZIP code yourself. Typed searches, selected origins, and radii remain temporary browser state; a suggested profile city is stored only when you save your profile.

Distances are approximate straight-line distances from representative city or ZIP-area points, not driving distances or travel times. Church points are approximate street-address positions, not confirmed entrances. The current directory has map points for 101 of 120 active churches, missions, and monasteries; 19 remain without a verified point. Those listings stay in the directory, but a distance filter cannot place them within a radius. Confirm the current worship address and services with the parish.

When the embedded Google map loads, your browser contacts Google. Google receives map requests and network information such as your IP address and browser details, along with information about the displayed region and map view. This can occur without ParishPilgrim sign-in. Google's own cookies, account settings, and privacy policy apply. The local city/ZIP lookup is separate from those map requests. If the Google map cannot load, a local locations preview remains available.

Page links and browser history

Churches, feast details, member profiles, and pilgrimage discussions have their own page addresses. Browser history may retain those addresses and member-search queries. A link to a private or friends-only page does not grant access: the server still checks the current account and audience. Consider browser history as well as local storage when using a shared device.

Feast reminders

Liking an event enables reminders for that visit. Email and in-app reminders are enabled by default and can be turned off independently in Settings. Reminders are scheduled for Friday at 10 a.m. Eastern time, adjusting for daylight saving, at least seven days before the event. Likes added after their scheduled reminder do not receive a late reminder.

When email delivery is configured, a reminder is sent to your verified sign-in email address through the configured email provider, Cloudflare Email Sending or Resend, and includes the liked events, their dates, any published service times, event links, and links to add them to your calendar. That provider processes the recipient address and reminder content to deliver the email. We do not read your Gmail inbox or calendar, or know whether you already added an event. Settings show when email delivery is unavailable.

Your reminder preferences and a delivery record containing the scheduled date, channel, event identifiers, attempt status, and delivery time are kept in Cloudflare's database. Email addresses and message bodies are not saved in that delivery record. In-app feast reminders are private to your account and follow your current likes and event access. Sent emails cannot be recalled after a like is withdrawn or event access changes.

Google sign-in and cookies

Sign-in asks Google only for basic identity: your account identifier, email, and profile, including a profile-picture URL when available. Google handles your password. ParishPilgrim does not ask for Gmail, Drive, or Calendar access. An event's calendar button opens a Google Calendar draft by default for you to review and save. Choose .ics downloads in your settings if you prefer another calendar. Published structured service times are included; dates without a listed time remain all-day reminders. Those actions do not connect ParishPilgrim to your calendar through an API or grant Calendar access.

The account system discards Google's access, refresh, and ID tokens after sign-in while keeping a valid Google picture URL for the default picture. Google identity information can refresh on later sign-ins; a saved private-profile picture choice remains separate. A first-party session cookie is needed to stay signed in. The server checks that session before reading or changing account choices.

A session is valid for up to seven days and can be renewed while you use the site. Signing out revokes your ParishPilgrim session. Your separate Google session can remain active in the browser; on a shared device, sign out of Google too or use a private browser session. Sign-in asks you to choose a Google account.

Temporary sign-in verification information and a server record of your session are needed to complete sign-in and keep you signed in. Expiry limits access; it does not guarantee that every expired database record is immediately erased.

Hosting and protection

ParishPilgrim uses Cloudflare to deliver the website and store account records. Hosting providers receive network information, such as an IP address and requested URLs, to deliver and protect a site. Google receives information needed for its sign-in flow. Those providers handle their own services under their privacy policies: Cloudflare and Google.

When a Google or custom picture is displayed or previewed, its image host receives the image request and network information such as your IP address and browser information. Picture requests use a no-referrer policy, so they do not send the ParishPilgrim page URL as a referrer. The image host's own privacy practices apply.

Account protection limits repeated requests using a project-keyed pseudonymous value derived from an IP address and sign-in or community route, or from an account identifier for signed-in requests. It stores that value, a request count, and an expiry time. Account sessions do not store a raw IP address or browser user-agent. Expired protection counters are deleted when another limited request arrives; there is no scheduled cleanup if requests stop.

The application does not send account plans or favorites to payment services. Church, directions, Google sign-in, and support links open other services whose privacy practices apply when you use them. The embedded map's separate Google requests are described above.

Retention and deletion requests

Guest choices remain in the browser until you remove them or clear site storage. Account records, profiles, preferences, and community records remain until you remove supported items or the project operator deletes them; there is no automatic inactivity-deletion policy. Deleting a created pilgrimage removes its comments, photos, intentions, and completions from live storage. Reports can remain as review records. Expired sessions and temporary sign-in records may be removed during later activity, but there is no scheduled cleanup in the current feature.

No self-service account-deletion control is available in this preview. For privacy questions or to request deletion of account information, contact Abraham Smitz at abrahamesmitz@gmail.com. Ownership must be verified before deleting an account. Please do not include passwords, secret tokens, or detailed pilgrimage plans in email.

Deleting live account records does not necessarily remove infrastructure backups immediately. Cloudflare's database recovery retention depends on the actual plan; its Free plan currently has a seven-day recovery window. That is separate from session validity.