Sidekick Pro – Privacy Policy

Effective date: March 1, 2026; Last updated: July 17, 2026

This Privacy Policy describes how Download Youth Ministry (“DYM,” “we,” “us,” or “our”), operated by RTC Holdings Inc., a California corporation, collects, uses, and shares information in connection with the Sidekick Pro application for macOS, iPadOS, and iOS (the “App”) and the companion audience web experience at go.sidekick.tv (the “Audience Site,” and together with the App, the “Service”). It applies to two kinds of users:

Hosts — youth pastors, leaders, teachers, student leaders, interns, and others who install and run the App; and
Audience members — people who join a live session by scanning a QR code or opening an audience link on a phone or laptop. Because the Service is built for youth ministry, audience members may include minors aged 13 and older. See Section 6.

By using the Service you agree to the practices described here. If you do not agree, do not use the Service.

This policy does not cover websites or services that DYM does not operate (for example, downloadyouthministry.com, which is governed by DYM’s main Privacy Policy), even where Sidekick Pro links to or integrates with them.

1. Summary

We try to collect as little personal information as possible. In practice that means:

Your library lives on your device or in your own iCloud / cloud storage. We do not have servers that hold copies of your slides, songs, videos, or other library files.
Hosts have a Sidekick Pro account tied to Sign in with Apple, Google Sign-In, Microsoft sign-in, a Coleader account, or a DYM membership account. We store a small amount of account and subscription metadata so the App can verify what features you have access to.
Audience members are signed in anonymously by Firebase. We do not ask for an email, phone number, password, or date of birth. If a feature prompts for a name, that name is screened by automated moderation, shown to the host and the rest of the audience during the session, associated only with an anonymous identifier, and not added to any lasting profile.
The Audience Site is built for supervised group use, is intended for participants aged 13 and older, and is not directed to children under 13. We ask audience members for as little as possible and never for contact details.
Free-text audience submissions (such as Q&A questions) are screened by automated moderation before they reach the host.
Payments are processed by Apple through the App Store; Coleader subscriptions are processed by Stripe; and DYM membership entitlements are managed through DYM’s storefront (Salesforce Commerce Cloud, Ordergroove, and Authorize.Net). We do not receive or store your payment card details.
We do not sell personal information.

The rest of this policy explains the detail.

2. Information we collect

2.1 From Hosts

Account information

The identifier and email address we receive from Sign in with Apple, Google Sign-In, or Microsoft sign-in when you sign in (you may use Apple’s “Hide My Email” to share a relay address instead);
If you sign in with a Coleader account, the email address and subscription tier returned by Coleader;
If you sign in with a Download Youth Ministry membership account, the user ID, email, and membership tier returned by DYM’s authentication system.

Subscription and entitlement information

Records of which Sidekick Pro features and audience tiers you are entitled to use, based on App Store (StoreKit) subscriptions, a Coleader subscription, and/or a DYM membership. We do not receive your credit card or other payment card details; card processing is handled by Apple (App Store), Stripe (Coleader subscriptions), and DYM’s storefront providers (Salesforce Commerce Cloud, Ordergroove, and Authorize.Net).

Usage and analytics information

Through Firebase Analytics, we collect general usage telemetry, including: app launches; which features you open; session starts and stops; counts of audience connections per session; subscription state; and high-level navigation events. This information is associated with a Firebase-generated installation identifier, not with your name.
We also collect monthly aggregates such as your peak audience count and feature usage, which we use to enforce subscription tiers and to understand how Sidekick Pro is used overall.

Marketing communications

If you sign in as a host, we share your email address and basic Sidekick engagement events (such as when you sign in or use the app) with our email marketing provider, Klaviyo, on behalf of Download Youth Ministry and Coleader. This helps us send you relevant product updates and offers. You can opt out at any time using the unsubscribe link in any marketing email; doing so does not affect your ability to use the App.

Diagnostic and crash information

If the App crashes, we collect a diagnostic report containing the crash reason, a stack trace, the App version, the OS version, the device model, and the state of the host’s current session. This report is stored in our Firebase database and is associated with your Firebase user ID and, if you are signed in, your account email. We use it solely to fix bugs.
We do not use Apple’s standard crash reporting upload; the diagnostic file is written locally and sent only on the next App launch.

Content you create or import

Your slides, songs, lyrics, playlists, announcements, polls, trivia questions, countdowns, images, videos, and other library files are stored locally on your device or in a location you choose — local disk, iCloud Drive (in your personal iCloud container iCloud.com.downloadyouthministry.SidekickMobile), or a user-selected folder backed by a third-party sync service such as Dropbox, Google Drive, or OneDrive. DYM does not host copies of your library files. Content that is purchased on Coleader or DYM is downloaded from DYM servers, but your copies are not uploaded to us or used to replace the originals on our servers.
When you run a live session, the question text and configuration needed for the session — for example poll questions, trivia questions, and countdown durations — are transmitted to our Firebase database so the Audience Site can display them.

2.2 From Audience Members

Anonymous Firebase identity

The first time you open an audience link, Firebase signs you in anonymously and issues a random user ID that lives in your browser storage. This ID lets the system count unique audience members in a session and prevent duplicate votes. It is not linked to your name, email, or phone number.

Information you type into the Audience Site

A chosen display name, if the feature asks for one (for example Live Trivia, Live Pick Me, Team Picker, or Live People Picker — up to 20 characters);
Multiple-choice selections, slider values, and ranking choices in Polls and Live Ranking;
Free-text answers (for example word guesses, up to 100 characters);
Free-text questions in Q&A (up to 500 characters).

How we handle names you enter to join a game. Names entered to join Live Trivia, Live People Picker, Live Pick Me, or Team Picker are screened by automated moderation and then stored in that game’s live-session records, associated only with the anonymous visitor ID — never with an account, email, phone number, or other identifier. They are used solely to display that participant on the host’s screen and leaderboard during the session, are not added to any durable profile, and are deleted or cleaned up as live-session data under Section 7.

Automatic information

Standard server-side information sent by your browser when you load the Audience Site, including IP address, user agent, and approximate request timing. Our Firebase hosting and Cloud Functions providers (Google) may also collect this information in the course of providing their services.
Local browser storage (used by Firebase to persist your anonymous sign-in for the duration of the session). We do not use the Audience Site to set advertising cookies.

Connection metadata

When you connect to a session, our registerAudienceConnection Cloud Function records that your anonymous user ID has joined the session. This is used to count unique connections (for enforcing audience caps and for the host’s stats), not to track you across sessions.

2.3 What we do not collect

We do not ask audience members for their full name, email address, phone number, mailing address, or date of birth.
The App does not request access to your location, camera roll, contacts, microphone, or photo library. (Local-network access is used only to discover NDI video receivers on the same Wi-Fi network; nothing is sent over the internet from that feature.)
The Audience Site does not request your phone number, email address, location, camera, or microphone.

3. How we use information

We use the information described in Section 2 to:

Run live sessions — getting your polls, slides, questions, and countdowns to the audience and bringing audience responses back to the host;
Authenticate you, verify your subscription, and enforce feature and audience-tier limits;
Moderate audience-submitted content (see Section 4);
Provide customer support and respond to your requests;
Diagnose crashes, fix bugs, and improve performance;
Understand how Sidekick Pro is used in aggregate so we can prioritize features;
Analyze anonymous, aggregated audience responses — such as poll results and the general themes of Q&A questions — to understand the needs of youth groups and to improve and develop our content and curriculum. We do not know which audience member submitted which response, and we use this information in aggregated or de-identified form;
Communicate with you about the Service, including security and service announcements;
Comply with law and enforce our Terms of Service.

We do not sell personal information, and we do not use personal information for cross-context behavioral advertising.

4. Moderation of audience content

Free-text submissions from the Audience Site (currently: chosen display names, word guesses, and Q&A questions) are screened by automated moderation before they appear to the host. Submissions are sent to a third-party classifier — currently OpenAI, with Anthropic (Claude) as a fallback — and compared against an internal blocklist. Content that the classifier scores above our thresholds for sexual content (including content involving minors), harassment, hate, violence, or self-harm may be rejected outright, or, for Q&A, flagged for the host to review through a moderator-PIN-gated queue.

The third-party classifier processes only the text of the submission, not the audience member’s IP address, name, or other identifiers, and is configured to be used in “zero data retention” mode where the provider supports it. The classifier’s terms apply to that processing.

We have zero tolerance for content that sexually exploits or endangers children. Where we become aware of apparent child sexual abuse material, we may preserve and report it to the National Center for Missing & Exploited Children (NCMEC) and/or law enforcement as required or permitted by law. See Section 6.3 of the Terms of Service.

5. How we share information

5.1 Within the audience

Your audience display name, vote counts, trivia answers, ranking positions, and Q&A questions (after moderation and after the host’s approval, where applicable) are visible to the host and may be visible to other audience members on the host’s display.

5.2 Service providers

We share information with the following service providers, only as needed to operate the Service:

Provider	Purpose
Apple (App Store, Sign in with Apple, iCloud, StoreKit 2)	Account sign-in, App Store subscription billing, iCloud storage of your library if you select iCloud
Stripe	Payment processing for Coleader subscriptions
Coleader (coleader.co)	Host sign-in via Coleader and verifying your Coleader subscription entitlement
Salesforce Commerce Cloud, Ordergroove, and Authorize.Net (DYM storefront)	Processing DYM membership payments and verifying your DYM membership entitlement tier
Google LLC (Firebase Auth, Firestore, Cloud Functions, Hosting, Analytics)	Anonymous audience auth, session database, server-side moderation gateway, App analytics
Google (Sign-In, Drive / Slides APIs)	If you import content from Google Slides
Microsoft (sign-in)	Host sign-in. PowerPoint/.pptx files you import are processed locally on your device and are not sent to Microsoft.
OpenAI	Moderation classifier (primary)
Anthropic (Claude)	Moderation classifier (fallback); AI assistance features in the host App
Google (Gemini)	AI assistance features in the host App (fallback)
Klaviyo	Marketing engagement tracking / email marketing for DYM and Coleader

These providers receive only the information they need to perform their function and are bound by contractual or platform-level confidentiality and security obligations. (Local-network discovery of NDI video receivers, used by the App, sends no information over the internet and involves no service provider — see Section 2.3.)

5.3 Other sharing

We may share information:

with your consent;
if you are a host, with the church, ministry, or other organization on whose behalf you signed up, where applicable;
to comply with law, lawful requests from public authorities, or to protect the rights, property, or safety of DYM, our users, or the public;
in connection with a merger, acquisition, financing, or sale of all or part of our business; and
in aggregated or de-identified form that cannot reasonably be used to identify you.

We do not sell personal information for money or share it for cross-context behavioral advertising.

6. Children

Because Sidekick Pro is built for youth ministry, the Audience Site is used in supervised group settings that may include minors. It is intended for participants aged 13 and older; it is not directed to, and we do not knowingly collect personal information from, children under 13. The following describes how we handle that.

6.1 Who the Audience Site is for

The Audience Site is intended for use by groups, under the supervision of an adult host, that may include minors aged 13 and older. It is not a destination a child seeks out on their own; a participant only reaches it when an adult host displays a session and invites the group to join. The Audience Site is not directed to children under 13, and if you are under 13 you should not enter your name or any other information into it.

6.2 How we minimize the data we collect

We design the Audience Site to collect as little as possible from any participant, including minors:

No account is required, and we never ask an audience member for a full name, email address, phone number, mailing address, or date of birth.
The only information an audience member may volunteer is an optional display name (which we encourage to be a first name or nickname, not a full name or any contact information) and their answers within a game.
We instruct participants not to enter their real full name or any identifying or contact information, and free-text entries are screened by automated moderation (Section 4).
The anonymous identifiers we use (the random Firebase visitor ID and IP address) are used solely to support the internal operations of the Service — counting unique participants, preventing duplicate votes, maintaining session state, security, and moderation. We never use them for advertising, profiling, or tracking participants across sessions or sites.

6.3 Host and organization responsibility

Hosts and the churches, ministries, schools, or organizations they act for are responsible for obtaining any consents required by applicable law — including the Children’s Online Privacy Protection Act (COPPA) in the U.S. and equivalent laws elsewhere — as well as any school or organizational policies, and for confirming they are authorized to use the Service with the minors in their audience. By running a session with minors, a host represents that they have the authority and any parental or guardian consent required to do so. See the Terms of Service for host eligibility and responsibilities.

6.4 Parents and guardians

If you are a parent or guardian and believe a child under 13 has provided personal information through the Audience Site, contact us at support@downloadyouthministry.com and we will review and delete that information. Because audience data is tied only to an anonymous, short-lived identifier and is not linked to a name or contact details, we may ask the host to help us locate the relevant session.

7. Data retention

Host account data is retained for as long as your account is active and for a reasonable period afterward.
Subscription and entitlement records are retained for as long as required for tax, accounting, and audit purposes.
Crash reports are retained for a reasonable period for debugging and then deleted or aggregated.
Live session data (polls, trivia, Q&A, ranking, player display names, and audience connection markers) is retained for a reasonable period after the session ends and may then be archived or deleted. Abandoned Q&A sessions are cleaned up automatically by a scheduled job. Anonymous, aggregated or de-identified insights derived from session responses (which cannot reasonably be used to identify any individual) may be retained for content and product development after the underlying session records are deleted.
Audience anonymous identities persist only in your browser’s local storage and are not linked to a long-term identity record on our side.
Moderation logs (including flagged-but-allowed Q&A items) are retained as needed for safety review.

8. Security

We use industry-standard measures to protect the Service, including TLS in transit, Firebase server-side security rules to restrict who can read or write what data, access controls on our cloud projects, and least-privilege rules for Cloud Functions. No system is perfectly secure; if you have reason to believe your interaction with us is no longer secure, please contact us immediately.

9. International users

The Service is operated from the United States. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and in other countries where our service providers operate.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards for that transfer — the European Commission’s Standard Contractual Clauses for transfers from the EEA, and the UK International Data Transfer Agreement (or the UK Addendum to the SCCs) for transfers from the UK — and our service providers (including Google/Firebase, OpenAI, and Anthropic) operate under their own such safeguards. You may request more information about these safeguards using the contact details in Section 12.

10. Your choices and rights

Deleting your account. You can permanently delete your Sidekick host account and its associated data from within the App at any time: go to Preferences ▸ Account ▸ Delete Account. You may also email us at support@downloadyouthministry.com to request deletion.

Depending on where you live, you may have rights to access, correct, delete, port, or limit our use of personal information we hold about you, and to withdraw consent. To exercise these rights, contact us at support@downloadyouthministry.com. We will respond as required by applicable law.

California. If you are a California resident, you may have additional rights under the California Consumer Privacy Act, including the right to know what categories of personal information we collect, the right to delete, and the right to limit the use of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising. You may exercise these rights by contacting us at the address above.

EEA / UK. If you are in the European Economic Area or the United Kingdom, our legal bases for processing are: (i) performance of our contract with you (running sessions, providing the App); (ii) compliance with law (tax, accounting); (iii) our legitimate interests (security, moderation, analytics, product improvement); and (iv) your consent, where required. Where an audience member is a child below the age of digital consent in their country (13–16, depending on the country), we do not rely on the child’s own consent; we rely on the authority of, and any parental consent obtained by, the adult host and their organization (Section 6.3). You also have the right to lodge a complaint with your local data protection supervisory authority.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above and, for material changes, provide additional notice (for example in the App or by email). Your continued use of the Service after the change takes effect constitutes acceptance of the updated Policy.

12. Contact us

If you have questions about this Privacy Policy or our handling of your information, contact us at:

Email: support@downloadyouthministry.com
Mail: RTC Holdings Inc. (Sidekick Pro / Download Youth Ministry), 22431 Antonio Pkwy B160-232, Rancho Santa Margarita, CA 92688
Support: support@downloadyouthministry.com