The Foyer: Privacy Policy

Last updated: October 19, 2026

The Foyer is a free app for members and friends of local Mennonite churches to find and host small gatherings. It is run by Aaron Esbenshade. This page explains, in plain words, what we collect and why.

The short version: We collect only what the app needs to work. We do not sell your data. We do not show ads. We do not use advertising or cross-app tracking.

Questions? Write to support@irlobby.com.

What we collect

• Account basics: your first name and account email. Phone number is optional. You can sign in with Apple or Google.
• Birth date (accounts): used to check age ranges on events and, if you opt in, for birthday greetings. See "Your birthday" below.
• Profile: a short bio and profile photo(s). You can add up to 50 photos.
• Family members: name and full birth date. Only you (the parent who added them) can see this. We use the birth date only to check event age ranges. It is never shared with hosts, guests, friends, or the public. Family members do not get accounts. Children under 13 are only added this way, by a parent. Help text in the app: "Only you can see this. We use it to check event age ranges."
• Location: where a gathering is held, and a city or town you enter on your profile, if you add one. The app does not send your phone's location to us.
• Gatherings and activity: gatherings you host or RSVP to, your gathering requests, swipes, tickets, and reviews.
• Invites: contact details on invites you send.
• Messages: gathering chats, and 1:1 chats between friends or people who chose to allow messages.
• Friends list.
• Reports and blocks you make.
• Push notification token: so we can send you notifications, such as a cancelled gathering.
• Contact info you choose to show: your phone or email is shown to others only if you turn on the contact toggles.

Why we use it

Only to make the app work: to run your account, show gatherings, handle RSVPs and chats, keep people safe, and send notifications.

We do not use your data for ads. We do not track you across other apps or websites. We do not sell or share your data for advertising.

Who can see what

Profile visibility. You choose who sees your profile. The levels are:

1. Only me (the default)
2. Friends
3. Church
4. Public

Your birthday. Your birth date is used to check age ranges on events. It is not shown by default.

• If you are 18 or older, you can opt in to show your month and day (never the year). This is off by default.
• If you opt in, it is shown to the audience you chose for your profile visibility (see above).
• It is used for age checks and for birthday greetings.
• It is never shown for anyone under 18, and never to people you have blocked (or who have blocked you).
• Birthday greetings are sent as text-only chat messages inside the app. Only the sender and the person receiving it can see them, under the chat's normal rules.

Messages.

• Direct messages are friends-only by default.
• You can turn on a toggle to let people from shared events message you.
• Accounts under 18 are always friends-only.
• Blocks work both ways.

When a host requires approval. If you ask to join a gathering that needs approval, the host always sees:

• your first name, photo, and short bio;
• your party size;
• your family members' names and age bands (an age-band chip, not birth dates).

If you are under 18, the host sees only your first name and age band. A host never sees your email or phone this way.

Addresses. Private addresses on member-hosted gatherings are visible only to approved or going guests.

Photos. People who attended the same gathering can download photos from it, using signed temporary links. Once someone saves a photo, we can't remove it from their device.

Church administrators. Church administrators can review reports and remove content or accounts to keep people safe.

Safety reports

You can report and block people, messages, and photos. While your account exists, a report you make is linked to you. If you delete your account, that link is cut. The same is true for a person who was reported: if they delete their account, their link to the report is cut.

What stays on a report: the reason, a description, the date, the status, the type and ID of what was reported, and a short snapshot of the content. It holds no names or emails.

We keep a minimal record of safety reports for up to 12 months so we can protect other members.

Where your data lives and how it is protected

• Your data and our database are hosted on a cloud server in Europe (Hetzner), and encrypted backups are kept on a private server in the United States. By using the app you understand your data is processed in both places.
• Data is encrypted while it travels between the app and our server.
• No system is perfect. Please use a strong password and keep it private.

Who we share with

• Other people in the app, as described above and as you choose.
• Church administrators, for safety and moderation.
• Hetzner (Europe), which hosts our server and database.
• Expo's push notification service, a third-party service that delivers your push notifications through Apple. It gets your push token and the notification text.
• Apple or Google, if you choose to sign in with them.
• Google (Gmail), which sends our account emails, like password resets. It gets your email address and the message.
• Anyone the law requires us to tell, if we get a valid legal request.

We do not sell your data.

Your choices and deleting your account

• Edit your profile, photos, bio, family members, and contact toggles in the app any time.
• Choose your profile visibility.
• Delete your account in the app: Settings > Account > Delete my account. This removes:
  • your profile and all contact info (email, phone, birth date, bio, profile photo);
  • your login and push tokens;
  • your friends, friend requests, and blocks;
  • your family members;
  • your RSVPs, gathering requests, swipes, tickets, and reviews;
  • your one-to-one chats, including the other person's messages in those chats;
  • your own messages in gathering chats;
  • every photo you uploaded (the records and the files);
  • contact details on invites you sent;
  • your Sign in with Apple connection (we revoke the token at Apple).
• Gatherings you host: upcoming ones are cancelled first. Attendees and people with pending requests are told ("The host deleted their account"). Then the gatherings are deleted. Past gatherings you hosted are deleted.
• Other people's gathering chats stay, minus your messages.
• What we keep: safety reports, in the minimal form described in "Safety reports" above. We keep a minimal record of safety reports for up to 12 months so we can protect other members.
• When a host deletes a gathering, its photos (the records and the files) are deleted right away.
• Deleted data and photos may remain in encrypted backups for up to 30 days, then they are removed automatically.
• To ask about your data, write to support@irlobby.com.

Children

You must be 13 or older to have an account. We do not knowingly make accounts for children under 13. A parent may add a child under 13 as a family member (name and full birth date, visible only to the parent). If you think a child under 13 has an account, tell us at support@irlobby.com and we will remove it.

Changes

If we change this policy in a big way, we will tell you in the app or by email. The date at the top shows when it was last updated.

Contact

support@irlobby.com

Apple App Privacy summary

All of the data below is linked to you and used for App Functionality only. None of it is used for tracking.