Privacy Policy

GraceBook is operated by Liber Gratiae Inc., a nonprofit corporation in New Jersey. This policy explains what we hold about you, who can see it, and how long we keep it. What applies to you depends on how you use GraceBook:

• Visitors — anyone reading the site without signing in. See section 2.
• Seekers — anyone with an account who books sessions with a mentor. See section 3.
• Mentors — anyone who has applied to offer sessions, or been approved to. A mentor also has an account, so section 3 applies to mentors too. See section 4.

Section 5 covers sessions, which involve both a seeker and a mentor. Sections 6 to 14 apply to everyone.

A seeker has no public page on GraceBook and never appears in the directory. Nothing in this section is visible to other seekers, and a mentor sees only what they need to meet with you, such as your name and the sessions you book with them.

Your bookings, and anything said in a session, are covered in section 5.

As a mentor you also have an account, so everything in section 3 applies to you. In addition, we hold the following.

Search engines are a separate choice, and it is yours. Your page is not offered to search engines unless you switch that on in your profile editor. It starts off, and nothing switches it on for you. While it is off, you are still in the directory and still bookable. If you switch it off later, search engines generally drop the page within a few weeks.

When your page is taken down, its address answers exactly as it would for someone who never had an account, so nobody can tell from outside whether you left, were turned down, or never applied. We cannot recall copies already made elsewhere — by a search engine, an archive, or anyone who saved the page.

If we report a mentor to their bishop or superior

If we decide that a mentor has broken the Mentor Agreement, we may report it to the church authority responsible for them: their bishop, religious superior, pastor or institute, including the person they named when they applied. In that report we may share the mentor's name, what the concern is, what they did, and the dates of any sessions involved. We cannot share what was said in a session, because we do not keep it. We may make the report without telling the mentor first if telling them could put someone at risk or interfere with an investigation. Mentors agree to this when they sign the Mentor Agreement (sections 5 and 12). We do not make reports like this about seekers.

We do not host mentor notes. Mentors keep their own records outside GraceBook, so there is nothing here for us to disclose, lose, or be compelled to produce. We do not monitor, screen or review sessions, and we do not use artificial intelligence or any automated tool to analyze them.

• Your religious beliefs, sacramental history, or anything said in confession
• Your precise location — nothing finer than the city worked out from your IP address, as described in section 2
• Social media profiles or contacts
• Biometric data

We use what we hold only to:

• Run GraceBook
• Review mentor applications
• Send you confirmations, reminders and account notices, and our mailing list if you joined it
• Process donations and gifts through our payment provider
• Prevent fraud, abuse and unauthorized access
• Improve the site, using the page visit totals in section 2

We never sell, rent or trade your information, and never use it for advertising, profiling or behavioral targeting.

Some parts of GraceBook are run for us by service providers. Each receives only what it needs to provide its service to us, under its own terms and, where it offers them, data processing terms. We use providers for:

• Processing donations and gifts
• Carrying video, audio and text sessions, which the provider cannot decrypt
• Sending email
• Hosting the website and counting page visits
• Running our server and database, in the United States
• Storing mentor documents and photographs privately, and hosting mentor introduction videos
• Reporting errors in the site, with names, email addresses, IP addresses and other personal details removed first; error reports are kept for no more than 90 days

Otherwise, we disclose information only when the law requires it, such as in response to a valid court order or subpoena, and in the one case described under “If we report a mentor to their bishop or superior” in section 4. We cannot disclose the content of a session to anybody, because we do not hold it.

• TLS for everything between your browser and us
• Encryption at rest, as provided by our hosting and storage providers
• Private storage for mentor documents and photographs, opened only through short-lived links
• Role-based access for staff, and an administrative console that shows no session content
• A log of administrative actions, readable by every administrator

Where this policy says something is stored as a hash, we keep only a one-way fingerprint of it. A hash lets us recognize the same value if it is given to us again, but it cannot be turned back into the original. This is different from encryption, which can be reversed by anyone holding the key: there is no key for a hash.

No system is completely secure. If a breach exposes your personal information, we will report it to the New Jersey State Police and then tell you in the most expedient time possible and without unreasonable delay, as New Jersey law requires (N.J.S.A. 56:8-163): what happened, what information was involved, and what you can do about it.

You can correct most of your information, and delete your account, yourself, at any time, from your Account page. What is kept after a deletion is stated above, item by item.

For anything else about your information, email contact@thegracebook.com from the address on your account, or, if you have no account, from the address your question is about. We reply only to that address, so nobody can obtain your information by writing from another one.

GraceBook is not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email contact@thegracebook.com and we will delete it.

GraceBook is not offered to anyone living in the European Economic Area, the United Kingdom or Switzerland. If you live in one of those countries, please do not use GraceBook or send us your information.

We hope to open GraceBook to people in those countries once we comply with the privacy laws that apply there, including the European Union's General Data Protection Regulation (GDPR).

When you create an account, apply to list an organization or join our mailing list, we check which country your connection comes from, using your IP address, and refuse the request if it comes from one of those countries. We do not keep the result.

Our server and database are in the United States, whose privacy laws may differ from those where you live.

We may update this Privacy Policy at any time. Changes take effect when they are posted on this page, and the current version took effect on the Effective Date at the top. When a change is material, we will also tell you by email or with a notice on the site. Changes apply going forward, not to anything that happened before them.

When you create an account we record which version of this policy, and of the Terms of Service, you agreed to.

If you continue to use GraceBook after a change, you accept the updated policy. If you do not agree to it, you can delete your account at any time.

For questions or requests about this policy or your data: