My Adventist Library · Last updated: 24 September 2026
My Adventist Library ("the app", "we") is a library of Ellen G. White writings and custom books with reading, notes and community discussion, together with My Church — a place to find your local Seventh-day Adventist church, join it, and keep up with its life — and My Events, where anyone can run a camp, a training or a revival meeting and take registrations for it. This policy explains what information the app handles and how it is used. We do not sell your data, and the app shows no advertising.
When you create an account we store your name, email address, password (stored as a secure hash — we never see it), account type, and an optional profile photo. If you sign in with Google or Apple we receive your name and email from that provider instead of a password.
Content you create in the app — discussion posts, comments, likes, uploaded books or PDFs, reports of inappropriate content — is stored on our server and, where you post it publicly, visible to other users together with your display name.
Asking to join a church sends that church's admin team an application. Only your name is required. Everything else is optional, and the form says so: a phone number (so the church can call or message you), a photo, the year you were born, your gender, and a home address you may place on a map.
The application also asks whether you have been baptised and whether you would like Bible studies. These answers, and your membership of a church itself, say something about your religious beliefs. We treat them as sensitive: they are used only to help your own church care for its members, they are never used for advertising, they are never sold, and they are visible only to that one church's admin team.
A church may add its own questions to its join form. Your answers to those go to that church's admin team in the same way.
You may join as a household rather than alone, and a church's admin team may add a relative to a household afterwards. For each person that records a name, their place in the family, and optionally a photo, an email address and the year they were born — including for children.
No account and no password is created for anyone added this way. If someone later signs up with the email address recorded for them, that record becomes theirs to control and delete. Until then it can be removed by the church's admin team or by whoever added it.
If you tap "Near me", the app asks your device for your location and sends it to our server once, to sort churches by distance. That position is not stored. Browsing by conference or searching by name works without it, and the app never asks until you tap.
Separately, you may set a home location on your church profile — an address, a map pin, or both. That one is stored, because its purpose is to be found: it is what lets your church's admin team see roughly where its members live. It is yours to change or remove at any time, and removing it takes you out of that search.
Fellow members cannot see it unless two separate things are both true. Your church must have turned on member-to-member visibility, and you must have switched on sharing for yourself — which starts off and stays off until you change it. Even then other members see only the map pin, never your street address, and a household appears once rather than once for each person in it. Removing your location switches the sharing off with it.
Maps are drawn with tiles from OpenStreetMap. Displaying a map sends your IP address and the area being viewed to their servers.
When a church is registered or edited and somebody drops its pin on the map, our server asks OpenStreetMap what address is at that point, so the street, city, region, country and timezone can be filled in rather than typed. Only the pin's coordinates are sent — no name, no account, nothing about the person doing it — and the answer is kept for a month so the same door is not asked about twice. This happens for a church's own pin, never for a member's home location.
Scanning your church's QR code records that you were present on that date. One scan may record your whole household. Scanning at a church you have not joined records you there as a visitor — your name and email are shown to that church's welcome team, and your own church is not told. Your baptism status and where you normally worship are not passed on.
A church may require you to be near the building to check in, so that its code cannot be used from home. Where it does, the app asks your device for your location at the moment you scan and sends it once. The position itself is not kept — only how far away you were, so the church can see whether its own rule is set sensibly.
The guest form asks for a name; an email address and a phone number are optional. A number you give there is shown to that church's welcome team so they can call or message you, and to nobody else.
Attendance is visible to that church's admin team, who can also export it.
Whoever checks in can write down the people who came with them and have no way to check themselves in — a friend, a neighbour, children too young to hold a phone. Only a name and an age are asked for, and nothing else may be recorded about them. No contact details, no address, nothing about their baptism, and no questions answered on their behalf. They are counted as present and appear on the church's attendance beneath the person who wrote them down, because that is the only thing anyone knows about them.
This is information about somebody who is not the one typing it, so two things follow. Write down only people who are actually with you and would be content to be counted; and if you are named on a church's attendance and would rather not be, ask that church's admin team, or us, and it will be removed. Whoever wrote a name down can also remove it themselves by scanning again.
A church may run a one-time programme — a revival meeting, an evangelistic series — and set the same QR code to collect a short form for its nights. While one is running, everybody who scans fills the form in, members included. It asks for a name, and optionally an email address, a phone number, an address, whether you are male or female, the year you were born, whether you have been baptized, whether you would be interested in a Bible study, and anything you would like to say. Nothing there is required except the name.
A member is only asked for what their church does not already hold; the rest is filled in from their membership record so they are not asked twice.
These records are kept separately from ordinary Sabbath attendance. Attending a meeting night does not change your church's attendance figures, and being at the Sabbath service does not put you on the meeting's list. Both are visible to that church's admin team and can be exported by them, and by nobody else.
You can correct what you submitted for five minutes after sending it. After that, ask the welcome desk.
A church's admin team can record that they visited a member's home: the date, who made the visit, and a private note about it. This is a pastoral record, and it is treated as one.
Visits are counted per household, so calling on a family of six is recorded once rather than six times. Fellow members never see any of it — not who has been visited, not who has not, and not the note. That remains true even where a church has opened its member list to its members: an open roll carries names, photos and where somebody stands in the church, and never the visit record.
You can tell your church you are not available to be visited at home. That is stored with your membership and shown to the admin team beside your name, so they know before they set out; no other member sees it. It is a request rather than a lock — it does not erase visits already recorded, and it does not stop the team recording a call that did happen.
A visit record can be corrected afterwards by the admin team — the date, or the note — and the record keeps who changed it and when, so a church reading it later can tell the visitor's own words from a later correction.
You can see the visits made to your own home, in the app under your church: the dates. The note is not shown to you. It is the admin team's own record of the call rather than a message to you, and it is only useful to them because it stays theirs. If you want to know what was written about a visit to your home, ask your church's admin team, or us at the address below.
A church can keep its books in the app: what was given as tithe, what came in as offerings, what was spent, and what each fund is left holding. Only that church's treasurer can open them — at most two people hold that key, and nobody else in the church, no denominational staff and no member of our own staff can read what a person gave. The books are the church's record and stay with the church.
A gift is written against a name. That name is only tied to a member when the treasurer says which member it is; until they do, nobody is shown it as theirs. Once it is tied, that member — and only that member — can see their own giving under My activity.
The treasurer can photograph the paper receipt and keep it with the gift. The photo is held in private storage and opened through a link that stops working after half an hour. It is shown to the treasurer, and to the member the gift has been tied to, and to nobody else. Removing it deletes the file.
A church may have the handwriting on that photograph read for it, so the treasurer does not retype what the slip already says. Where it does, the photograph is sent to the reader its church chose — Google Cloud Vision, or Anthropic's Claude — which returns the amount, name, date and receipt number. Neither keeps the photograph as part of this, and neither uses it to train their models. What comes back is a suggestion the treasurer checks and corrects before anything is saved. A church can also keep the photograph alone, and then nothing is sent anywhere.
A treasurer can copy the tithe or offering book into their own Google Drive as a spreadsheet, once or after every change. They authorise Google themselves, the sheet is theirs, and the app can only touch the one spreadsheet it created. The copy goes from their phone to Google without passing through us.
Group chat messages, and any photos, video or audio you attach, are visible to the members of that church. A one-to-one conversation — with a leader, or with another member — is visible to the two of you and to nobody else in the church. Both show when a message has been seen.
One exception, and it is deliberate: if a message is reported, our moderators can read that conversation in order to act on the report. The app stores require somebody to be able to, and a service where nobody can act on harassment is not a safer one. Nothing is read without a report.
A prayer request is the most closely held thing in the app. It is visible to the person who wrote it and to that one church's admin team — its creator and everyone holding a leadership title. Not other members. Not denominational staff. Not our own staff. You can withdraw one at any time.
A church's admin team can see its member list, member locations, attendance, home visits and prayer requests. Its treasurer, and only its treasurer, can see the money books and the receipts kept with them. Denominational staff appointed over a conference, union or division can see counts for the churches beneath them — how many churches, members and pastors — and never member details. Our own staff can see what is needed to moderate reported content and to keep the service running, with the single exception of prayer requests, which they are deliberately shut out of.
A church chooses whether its member list and its location are shown publicly or only to its members.
A church may also open its roll to its own members. Where it does, members see one another's names, photos and households — and nothing else. Phone numbers, addresses, dates of birth, baptism status and answers to the church's own questions stay with the admin team.
Anyone signed in can create an event. What you type — its title, description, dates, place, banner picture and the questions on your registration form — is shown to whoever opens its link. If you add a contact phone or WhatsApp number so people can reach you, that number is shown on the event too, so use one you are willing to publish.
You may put the event on a map. That pin is what a check-in is measured against, and it is visible to anyone who can see the event.
When you register we store the name, email address and phone number you give, your answers to the organiser's questions, and anything you write in the "let the organiser know" box. The organiser and the helpers they appoint can see all of it, and can download it as a spreadsheet. Nobody else can — the public page shows a count, never a list.
An event's registration form can be filled in from the web without an account. In that case the email address you type is the only way the organiser can recognise you at the door, which is why it is asked for.
Your answers are stored as they were written, alongside the wording of the question at the time. Re-wording a question later does not change what you answered.
You can fill an event's form in for a person who cannot fill it in themselves — a child, or somebody with no phone. That records the same things about them as about anybody else: the name, email address and phone number you give, and their answers to the organiser's questions. Most will have no email of their own, and none is required.
This is a whole form about somebody who is not the one typing it, so it asks more of you than counting somebody at the door does. Fill it in only for people who have asked you to, or whose parent or guardian you are, and answer as they would answer.
They appear on the organiser's list under your name, so that a family reads as a family. You can remove somebody you registered while the organiser has not yet decided about them; afterwards it is the organiser's to remove, and they can. If you are on a list and would rather not be, tell the organiser or contact us.
Registering somebody does not give you their account or them yours. It is a record of who is coming, and nothing else.
An organiser can let people add to a choose-one question — "which church do you come from" cannot be typed out in advance, and somebody always arrives whose own answer is missing. When you add one, the words you typed become an option on that question for everyone who fills the form in afterwards. They are shown the answer, never who added it. Type the name of a place, not anything about yourself.
Scanning an event's QR code records that you were present, on that date and at that session. If the organiser has switched on the distance rule, your device's position is sent once so it can be measured against the event's pin; the distance is stored with the check-in, and the position itself is not. Without an account you check in by typing the email you registered with, and only an accepted registration is recognised.
An organiser may run an event that takes no registrations at all — a public meeting anybody may walk into. There is nothing to sign up for and nobody accepting anyone. Scanning its code, or opening its page in a browser, shows a short form: a name, and optionally an email address, a phone number, an address, whether you are male or female, the year you were born, whether you have been baptized, whether you would be interested in a Bible study, and anything you would like to say, followed by any questions the organiser added.
Submitting it both puts you on that event's list and records that you were there. No account is needed at any point. If you give no email address we store a placeholder that cannot be delivered to and cannot be typed by anyone, purely so that two people who both leave it blank are kept apart; it is never shown and never exported.
Coming back on another night shows the form again with your answers already in it, so you can correct anything that has changed.
The organiser and their helpers can see everything you wrote and download it as a spreadsheet. Nobody else can.
Here too, whoever checks in can write down the people who came with them who cannot scan for themselves — a name and an age only. The same things apply as for a church: write down only people who are with you and would be content to be counted, and ask the organiser or us if you are named and would rather not be.
An event's announcements and its member chat are seen by the organiser, their helpers, and everyone whose registration has been accepted — not by people still waiting on a decision, and not by the public. Messages, photos, videos and voice notes you send there are stored until you or the organiser delete them.
You can also message an organiser privately from the event page, and an organiser can message somebody on their list. Those conversations are seen only by the two of you. Either side can delete their own messages; an edited message is marked as edited so the other person can tell.
An organiser can appoint helpers from the people they have accepted. A helper sees everything the organiser sees — the registration list, the answers, the phone numbers, the attendance and the spreadsheets — and can post announcements and accept registrations. They cannot delete the event or appoint other helpers. Removing a helper takes all of that access away at once.
A team is a group that publishes under a shared name. Its name, picture, description, mission and vision are public, as is its member list — joining a team is a public credit, and that is the point of it.
A published team journal is public. Anyone signed in can read it, love it and comment on it, and your name and profile picture appear beside anything you write. Drafts are visible only to the team.
Sharing a journal makes it readable outside the app. Every published entry has its own web address, and anyone holding that link can read it without an account. We ask search engines not to list those pages, so a shared link reaches the people it was sent to rather than becoming a search result — but a link, once sent, can be passed on by whoever received it. Treat publishing a journal as publishing, because that is what it is.
Comments can be reported to our moderators, and you can block someone to stop seeing anything they write. A team can turn comments off for its own journals; doing so hides the box rather than deleting what was already said. We count how many people read an entry — one per person per day, so the figure is readers rather than page refreshes — and show that count on the entry.
You can attach a photo, a video or a recording to a church message, a lesson discussion post or a comment. Whatever you attach is visible to exactly the people who can see the thing you attached it to, and to nobody else. A photo on a private lesson note stays as private as the note.
The microphone is used only while you are recording, and only after you tap Record. The app does not listen at any other time, and there is no recording in the background. A recording you do not send is deleted from your phone.
What you send is stored with the message or post it belongs to. Photos are made smaller on your phone before they are sent, and videos are re-encoded so they are not larger than they need to be; we keep the re-encoded copy, not the original. Deleting the message or post removes the attachment with it.
Audio and video can keep playing when you leave the app or lock the phone, so that a voice note or a lesson is not cut off. While it plays your phone shows a control with the title and who sent it. Nothing is recorded, and nothing is sent anywhere, while this is happening — it is your phone playing a file it has already fetched.
Uploading a book gives us no ownership of it and no claim over it. The copyright stays entirely with the author or publisher; we host the file so that others can read it. Please upload only what is yours to share or what you have the rights holder's permission to share. If you or the rights holder ask us to remove a book, we remove it — no reason needed. Your name is shown as the uploader unless you ask us otherwise.
Where a book is marked as published with permission, we may keep a copy of that permission — a letter, an email, or a photograph of a signed page — so we can answer a question about it later. That copy is held privately and is never shown in the app; readers see only the label. It may contain the name and contact details of whoever gave the permission, which is why we do not publish it. Ask us and we will delete it, and remove the label with it.
Reading progress, bookmarks, highlights, notes, downloaded books and offline content are stored locally on your device. A book's PDF downloads to your phone when you open it, and you can delete that copy from the book itself at any time without losing the book. Some of these (bookmarks, progress, highlights) also sync to our server when you are signed in, so they follow you across devices. You can delete downloaded content anytime from Settings, and remove synced data by deleting your account.
If you allow notifications, we store a device push token (Firebase Cloud Messaging) linked to your account so we can notify you about replies, likes, group discussion posts, church announcements and messages, and newly published books. The token is removed when you sign out. You can disable notifications in your device settings at any time.
We count how the app is used — which screens are opened, which books and lessons are read, what is searched for — in two places, and they know different amounts about you.
Firebase Analytics (Google) is given no name, email or account number. It does give every installation its own anonymous identifier and records your device model, operating system, app version, language and the country your connection appears to come from. That is enough to count how many people use the app and what they open; it is not enough to say that any of it was you.
Our own server keeps the same kind of record, and when you are signed in it is stored against your account. We use it to see which books and lessons are worth keeping and improving, never to build a profile for advertising.
The app does not request or use an advertising ID, and none of this is shared with anyone for advertising.
The app uses Google Firebase (sign-in, push notifications and analytics), Sign in with Apple (on Apple devices), Cloudflare (content delivery and file storage for covers, images, media and PDFs), and OpenStreetMap (map tiles). These providers process data under their own privacy policies. EGW writings are retrieved from the EGW Writings public API.
Two more are used only where a church has asked for them, and only for what is described above: Google Cloud Vision or Anthropic (Claude) to read the handwriting on a photographed receipt, and Google Drive and Sheets when a treasurer backs their book up to their own Google account. OpenStreetMap is also asked what address is at a church's map pin, as described under My Church: location.
We use your information only to operate the app: authenticate you, sync your library, deliver notifications you opted into, show your posts to the community, let your church run its own membership, attendance and messages, count views and downloads, and moderate reported content. We do not sell or rent personal data, and we do not use it for advertising.
You can report content and block other users. Reports are reviewed by moderators and may result in content removal. Blocking hides a user's content from you; the blocked user is not notified.
Your account data is kept while your account is active. You can delete your account in the app (Profile → Edit Profile → Delete Account) or request deletion at myadventistlibrary.com/delete-account; this permanently removes your profile, synced library data, church membership and device tokens from our server. Public posts you made may remain visible without your name or be removed at our discretion.
Attendance records are a historical fact about a service and are kept by the church even after someone leaves it, with their name on the row so the record stays readable. Ask that church's admin team, or us, if you want yours removed.
To remove a family member's record, ask your church's admin team, or contact us at the address below.
A church's money records are its own books and are kept as long as the church keeps them; a church is expected to hold them for as long as its own auditors require. A receipt photograph is deleted when the treasurer removes it, and deleting your account does not erase the church's record of a gift, which is the church's accounting rather than your profile.
The app is suitable for general audiences and is not directed at children. We do not knowingly let children under 13 create their own accounts without parental consent.
Adults do enter details about children: a parent joining as a household, or a church's admin team adding a child to one, records that child's name, place in the family and optionally a photo, email address and year of birth. Only a year, never a full date of birth, and never a password. An adult checking in may also write down a child who came with them, which records that child's name and age and nothing else at all. A parent or the church's admin team can remove that record at any time. If you believe a child's information is held here and should not be, contact us and we will delete it.
We may update this policy as the app evolves. Material changes will be announced in the app. Continued use after a change means you accept the updated policy.
Questions or requests about your data: [email protected]