How we collect, use, and protect your information — including your assessment results, which stay private to your account.
Five Fold Forward, Inc. ("Five Fold Forward", "we", "us" or "our") operates this website and the Five Fold Forward service. We are responsible for the personal information described in this policy.
This policy explains what we collect, why we collect it, who it is shared with, how long we keep it, and the choices you have. It applies to this website and to any account you create on it.
Information you give us when you create an account: your email address and a password, or — if you choose to sign in with Google — the basic profile information Google returns to us (your name, email address and profile photo). We never see or store your Google password, and we do not receive access to your Google account beyond that basic profile.
Your password is handled entirely by our authentication provider and is stored only as a cryptographic hash. It is never visible to us and cannot be recovered by us — only reset by you.
Profile information you choose to add: display name, username, profile photo, short bio, location, and your notification preferences. All of these are optional except the username generated for your account.
Assessment information: the answer you select for each statement, the scores calculated from those answers, and the resulting gift and ministry profiles. Because this service is about spiritual gifts and ministry formation, assessment answers and results may reveal information about your religious or spiritual life. We treat that information as sensitive and use it only to provide the service, save your results, recommend relevant content, support you, and keep the service safe.
We keep your individual answers, not just the scores, so that your results can be recalculated if the scoring model is revised — without asking you to retake anything.
Community information: posts, comments, reactions and the accounts you follow.
Messages you send us through the contact form.
Basic technical information that any website receives in order to serve a page, such as your IP address and browser type. Our hosting provider processes this to deliver the site and to protect it from abuse.
We use analytics to understand how the site is used, and advertising technologies to measure whether an advert brought someone here. These are optional, and they are switched OFF until you turn them on.
Nothing in those categories loads unless you allow it. If you refuse, or simply ignore the banner, no analytics or advertising cookie is set and no advertising script runs. Refusing does not limit anything you can do on the site.
Advertising technologies can involve sending limited information — such as an identifier, the page you were on, and whether you completed an action — to an advertising platform. Under some laws, including California's, that counts as "sharing" personal information for cross-context behavioural advertising. Where it does, we treat your refusal as an opt-out of that sharing.
We do not sell your personal information for money. We do not use session-recording tools that replay your keystrokes or screen. We do not build advertising profiles from your assessment answers, and your answers and results are never sent to an analytics or advertising provider.
We do not ask for and do not want sensitive financial information. If donations are enabled, they will be handled by a specialist payment processor and card details will not reach our systems.
To create and secure your account, and to sign you in.
To calculate, save and show your assessment results, and to produce the rules-based recommendations that follow from them. Those recommendations are generated by fixed rules from your scores — not by profiling you and not by any automated decision that produces a legal or similarly significant effect.
To operate the community: to display what you post, and to allow moderation where content is reported or breaches our terms.
To respond to messages you send us.
To keep the service safe and working — investigating abuse, preventing fraud, diagnosing faults, and maintaining records of administrative actions taken on accounts.
To send you service messages about your account. We will only send optional newsletters or announcements if you have opted in, and every such message will include a way to opt out.
Where the UK or EU General Data Protection Regulation applies, we rely on the following legal bases.
Performance of a contract: creating and running your account, saving your assessment results, and providing the community features you have asked to use.
Consent: optional profile details you choose to add, and any marketing email you opt in to. You may withdraw consent at any time, and doing so does not affect processing carried out before withdrawal.
Legitimate interests: keeping the platform secure, preventing misuse, moderating community content, and maintaining an audit record of administrative actions. We have considered these against your rights and consider them proportionate.
Legal obligation: where we must retain or disclose information to comply with the law.
Your answers and results are restricted to your own account at the database level, not merely hidden in the interface. Another member cannot read them.
Your chosen display name and your primary ministry calling appear alongside your posts in the community. Your individual answers and your full score breakdown never do.
Administrators of the platform can view saved results in order to support you and to administer the service. Administrative access is recorded in an append-only audit log that administrators cannot edit or erase.
We use a small number of processors, each bound to handle information only on our instructions.
Supabase provides our database and authentication. Your account, profile, assessment and community data are stored there, in a database region located in the United States.
Vercel hosts and delivers the website.
Resend sends service emails such as account confirmation, password reset, and delivery-status notices when that email route is enabled.
Google provides sign-in, and only if you choose to use it.
Analytics: Google Analytics, provided by Google LLC. Loaded only where analytics cookies are allowed. It receives page and event information, not your assessment answers or results.
Advertising: Google LLC, through Google Ads — which covers advertising on Google Search, the display network and YouTube — and Meta Platforms, Inc., through the Meta Pixel, which covers advertising on Facebook and Instagram. Loaded only where advertising cookies are allowed.
We may add further advertising platforms over time, for example TikTok or X. We will name any new recipient here and ask for your consent again before it is enabled — permission given for one set of recipients does not extend to a wider one.
If donations are enabled, payments are processed by Stripe or another specialist payment provider under that provider's own privacy terms. We receive limited payment metadata needed to confirm or administer the donation, but we do not receive or store your full card number or security code.
We may disclose information where we are legally required to, or where it is necessary to establish, exercise or defend legal claims, or to protect the safety of a person.
Where information is transferred outside the UK or European Economic Area, we rely on the transfer safeguards offered by these providers, including standard contractual clauses where applicable.
Account, profile and assessment information is kept for as long as your account exists. If you delete your account, that information is deleted with it.
Content you remove from the community — and content removed by a moderator — is retained for up to 90 days before it is permanently deleted. We do this so that a report can be reviewed fairly and so that a member cannot erase the record of their own conduct the moment it is questioned. Content attached to an open moderation case is held until that case closes, and its 90 days then begin.
Records of administrative actions are retained as a security and accountability measure.
Messages sent through the contact form are kept for as long as needed to deal with the enquiry and to keep a record of it.
You can access and correct most of your information directly in your account settings at any time, and you can delete your account.
Depending on where you live, you may also have the right to request a copy of your information in a portable format, to ask us to delete it, to object to or restrict certain processing, and to withdraw consent you have given.
If you are a California resident, you have the right to know what personal information we collect and how it is used, to request deletion or correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising those rights. We do not sell personal information for money. Where advertising cookies are enabled, the resulting disclosures to advertising platforms may amount to "sharing" for cross-context behavioural advertising — you can opt out, or withdraw an earlier opt-in, at any time through the "Cookie settings" link in the footer, which serves as our Do Not Sell or Share My Personal Information control.
We honour legally required browser or device opt-out signals, including Global Privacy Control, where they apply to the technologies we use.
To exercise any of these rights, contact us through the contact form on this website. We will respond within the time limit that applies to your request — one month under UK and EU law, 45 days under California law — and will tell you if we need longer and why.
If you believe we have handled your information improperly, you may complain to your data protection regulator. In the United Kingdom that is the Information Commissioner's Office.
Traffic between your browser and this site is encrypted in transit.
Access to your records is enforced in the database itself through row-level security policies, so a fault in the interface does not expose another member's data.
Passwords are stored only as hashes by our authentication provider. Administrative privileges are granted deliberately and every administrative action is written to an append-only log.
No system can be guaranteed completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant regulator and, where required, you — without undue delay.
This service is not directed to children under 13, and we do not knowingly collect personal information from them. If you are under 18, please use it only with the involvement of a parent, guardian or church leader.
If you believe a child under 13 has given us personal information, contact us through the contact form and we will delete the account and its data promptly.
If we change this policy we will update the date shown at the top of this page. Where a change materially affects how we use your information, we will give you notice in the service before it takes effect.
You can reach us at any time through the contact form on this website, and we will route your message to the right person.
Privacy requests and formal notices may also be sent through the contact form. If a law requires a postal address or another method for a specific request, we will provide the appropriate address or method when responding.
