Trust, Privacy & Security

• Sign-in is handled by our managed authentication provider using email/password or Google sign-in.
• Passwords are never stored in our application database — they are managed by the authentication provider.
• Sessions use signed bearer tokens. Signing out clears your session on this device.
• Administrative access is restricted to a single authorized administrator account.

• Account details: your name and email address.
• Assessment data: your answers, computed gift scores, ranked results, and any AI-generated narrative tied to your account.
• Donation records: donation status, amount, currency, and the payment provider's order/capture identifiers — used to unlock your report and maintain an audit trail.
• Operational logs: transactional email delivery status and basic request logs used to keep the service running.

We do not sell your personal information.

Donations are processed by PayPal. Card and bank details are entered directly with PayPal — they do not pass through, and are not stored by, Kingdom Gifts. We store only the PayPal order and capture identifiers needed to verify your donation and unlock your report.

• Per-user access controls are enforced in the database so each signed-in user can only read and modify their own assessment, donation, and profile data.
• Sensitive fields on completed assessments (such as report content and unlock status) can only be modified by the server, not directly by the browser.
• Administrative reports are gated by a server-side role check on every request.
• Traffic between your browser and our service is served over HTTPS.

• Lovable Cloud — hosting, managed database, authentication, and serverless runtime.
• PayPal — donation processing.
• Google — optional Google sign-in.
• Resend / email provider — transactional emails (receipts, account messages).

We retain account, assessment, and donation records while your account is active so you can revisit your results and so we can maintain a donation audit trail. To request deletion of your account and associated assessment data, email kimberly@kastrategists.org. Donation records that are required for financial recordkeeping may be retained in anonymized form after account deletion.

For questions, data access, correction, or deletion requests, contact kimberly@kastrategists.org.

If you believe you have found a security vulnerability in Kingdom Gifts, please email kimberly@kastrategists.org with details so we can investigate. Please do not publicly disclose the issue until we have had a reasonable opportunity to address it.