Privacy and unit access

Unit access uses an app-specific unit ID and password. Do not use your Church account credentials. Sacra-Flow is independent and is not an official Church application.

Public unit directory

Registered unit numbers and names are publicly visible on the sign-in page. Anyone can register an unused unit number; this does not verify Church authority. An existing number cannot be registered again to change its password or access its history. Contact the app owner about incorrect registrations.

Cloud records

Your app owner’s Cloudflare D1 database stores unit names and IDs, salted password hashes, expiring login sessions and completed meeting timing records. Passwords are not stored as readable text. Meeting records include activity names, planned and actual durations, hymn numbers, verses, dates and timing timestamps.

Anyone with your unit ID and shared password can access your unit’s results. Shared access does not identify individual users. The app owner has database access. Change a known password while signed in, using its current password. Forgotten passwords use owner-assisted requests and privately shared reset links; a public unit number alone cannot authorize a reset. Contact your app owner to correct or remove historical records.

Owner dashboard and recovery

The app owner can view and export all units’ timing records through a separate owner sign-in. Forgotten-password requests store the requester’s name, contact details and note in the owner’s database. These details are not verified automatically and are not included in the public unit directory. The owner must independently verify unit authority before sharing a reset link.

There is no automatic email service. Reset links expire after 30 minutes by default, are single-use and are stored only as token hashes. Resetting revokes the unit’s sessions and preserves meeting history. Reset issuance and completion are recorded in a database audit table. Changing the Cloudflare owner password invalidates owner sessions and previously issued reset links. Owner sessions expire after two hours. Contact the app owner to correct or remove recovery details.

Your device

Meeting plan settings are stored on the device and separated by unit. If a completed meeting cannot sync, its timing record is kept on the device until you sign into the same unit and retry. Device storage is not encrypted by this app. Sign out on shared devices and do not put confidential member information in activity names. Excel downloads are copies you must protect yourself.

Microphone

Optional Audio Assist analyzes sound on your device. It does not record, upload or transcribe audio.

Login sessions

Sessions use secure HTTP-only cookies and expire after eight hours. Registration, login and password-change attempts are rate-limited; brief hashed-IP rate-limit records expire. Private pages and historical API results are not cached for offline access. Sign-in and viewing shared history require an internet connection.