Privacy

Qahal is the room booking system your church uses. This page says what it keeps about you, who can see it, and how to have it changed.

What we keep about you

Your name, email address, church, and role, such as ministry head or admin, and the ministry you belong to, if you have one.
If you have a password, a scrambled form of it that can’t be turned back into the password. We never keep the password itself.
To protect your account: how many wrong passwords were tried in a row. After five, the account is locked for 15 minutes.
Your bookings and places in a queue: the room, the date and times, the title and purpose you wrote, the ministry it is for, the number of people, the seating layout and the equipment you asked for.
Each booking’s history: who requested, approved, rejected, moved or cancelled it, and when.
A record of the emails Qahal sent you: your address, the kind of email, and whether it was delivered. Not what the email said.

Qahal’s administrator created your account with the name and email address your church gave. Nobody signs themselves up.
Everything else comes from what you and your church’s admins do in Qahal.
If you sign in with Google, Google tells us your name, email address and profile picture, and whether it has checked that the address is yours. We use the address only to find the account made for you, and we don’t save anything Google sends.

Everyone in your church who uses Qahal sees the calendar: each booking’s title, room and times. The calendar never shows who asked for a room.
Your church’s admins also see who made each request, each booking’s history, and the names and email addresses of the people in the church. When you request a room, they get an email about it.
A ministry head can download a schedule of their own ministry’s bookings, which names who requested each one, but not their email addresses.
Qahal’s administrator runs the service for every church and can see every church’s accounts and bookings.
Other churches using Qahal never see anything of yours.

Vercel runs the website, in Singapore.
Render runs the server that applies Qahal’s rules, in Singapore.
Neon keeps the database, in Singapore.
Resend sends Qahal’s emails.
Cloudflare stores room photos and the weekly backups (in a private store), runs the check on the sign-in form that tells people from bots, and looks after the qahalrooms.com address and its email forwarding.
GitHub runs the weekly backup.
Google handles sign-in for anyone who chooses Continue with Google.

We don’t sell your information or use it for advertising, and Qahal has no analytics or tracking.

Your account stays until your name is removed (see below).
Bookings and their history are never deleted, even when cancelled, so the church’s record stays complete. The record of emails sent is kept too.
Once you sign in, you stay signed in for 7 days.
Our server’s logs hide email addresses.
Error reports help us fix problems. They never include email addresses, and each is deleted about 90 days after the problem last happened.
A copy of the whole database is made every week, and each copy is deleted after 84 days.

A cookie that keeps you signed in for up to 7 days, and a few short-lived ones that protect the sign-in itself. Signing out removes them.
Your choice of light or dark theme.
The sign-in page loads Cloudflare’s check that tells people from bots.

To correct your name or email address, tell your church office, or write to privacy@qahalrooms.com. Qahal’s administrator makes the change.
To have your name removed, ask your church office. Your church’s admin replaces your name and email address with a placeholder and switches your account off. Your bookings and their history stay, because Qahal never deletes a booking, but they no longer show who you were.
The record of emails sent keeps your old address, and the weekly copies keep it until they are deleted after 84 days.
For anything else about your information, write to privacy@qahalrooms.com.

Last updated 28 October 2026.