The Locust Army International
Privacy Policy
This Privacy Policy explains how The Locust Army International (“we”, “us”, “the Ministry”) handles personal information when you use sermons.thelocustarmy.org and the Locust Army Sermons Android app (together, the “Service”).
Nigeria’s Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act inform how we treat this data. This notice is written in plain language so a listener can see what we actually store — not a generic template.
1. Who is responsible
The Locust Army International is the controller of personal data for this Service. The Service runs on our own server. Audio files are stored with Cloudflare R2 and delivered from audio.thelocustarmy.org.
To ask about your data, use My account on this website or speak to the media team at the Ministry.
2. What we collect
2.1 Account
If you register we store your email address, the name you give us, and a hashed password (we cannot read the password back). If you sign in with Google we receive the verified email (and name, if Google sends it) so we can create or recognise the same account. We do not receive your Google password.
2.2 Session cookies
After you sign in we set an httpOnly cookie (sermons_member) so the website and the app can keep you signed in. The Android app stores that cookie value in on-device storage because the phone’s network stack has no cookie jar. A short-lived cookie is also used during Google sign-in to protect the OAuth round-trip.
These cookies are required to run an account. There is no advertising cookie and no third-party ad tracker on this Service.
2.3 Listening activity
If you are signed in we may store sermons you like, star ratings you give, and a listening history (which sermon and roughly where you stopped). Play counts on sermons are incremented when playback starts; they are not a profile of you.
2.4 Membership and payments
If you buy membership we store that your window is active, when it ends, which plan you hold, and whether automatic renewal is on. Checkout goes through Flutterwave. We store payment references, amounts, and renewal choice so we can match a successful charge to your account. We do not store full card numbers, CVV, or PIN. Flutterwave’s own privacy policy covers the payment page.
2.5 Device notifications (Android)
If you allow notifications the app sends us an opaque Firebase Cloud Messaging token, optionally with the app version. We use it only to tell that device a new sermon is out or that a live broadcast is on air. The token is useless to anyone but Google’s push service. Registering a token does not require an account.
2.6 Security and operations
Sign-in attempts are rate-limited by IP address so the login cannot be guessed at speed. Password-reset tokens are stored until they expire or are used. Server logs may include IP addresses and request paths for a short time to keep the Service up.
We do not ask for your contacts, precise location, or microphone. The Android app is configured not to request microphone or shared-storage permissions.
2.7 App statistics
The app generates a random installation identifier, which is hashed on our server. We use it to count installations, active devices, sessions, screen visits, sermon playback, listening duration and offline download success or failure. We also record app and operating-system versions and whether the app is open, playing audio or signed in. Analytics applies to guests and signed-in listeners.
These statistics are stored on our server and shown only to administrators. The analytics records do not contain your name, email, account ID, advertising ID, hardware identifier, contacts or location. We do not send the activity to a third-party analytics service. A reinstall or clearing app storage creates a new random identifier.
When offline, the app keeps a limited activity queue on the device and retries for up to seven days. Detailed events are retained for 90 days and daily device activity for one year. Installation records remain to preserve aggregate installation counts. Signing out or deleting an account does not identify or delete these separate installation records because they are not linked to an account.
3. Why we use it
We use this information to:
- Provide the Service you asked for (streaming, account, membership, downloads, live listen).
- Keep you signed in and secure the login.
- Process payments and prevent fraud.
- Send optional push notices you allowed.
- Understand what is published and how often sermons are played, in aggregate.
- Comply with law and protect the Ministry and other listeners.
4. Legal basis
Creating an account and paying for membership is a contract with us. Optional items (push notifications, Google sign-in) are consent you can withdraw. Keeping the Service secure and counting plays is a legitimate interest of the Ministry in running a public sermon library. We do not sell your information.
5. Who we share it with
We do not sell a mailing list. We share only what a processor needs:
- Flutterwave — checkout, verification, and automatic renewal.
- Google — sign-in if you choose it, and Firebase Cloud Messaging if you allow notifications. The app also loads Inter fonts from Google Fonts.
- Cloudflare — storage and delivery of sermon audio and covers. Those files are ministry recordings, not your account file.
- Expo — over-the-air app updates if you use the Android app.
- Resend (or the email provider we configure) — password-reset mail when that flow is switched on.
- The hosting provider of our VPS in the ordinary course of running a website.
6. Where data lives
Account records live on our server in SQLite. Audio lives in Cloudflare storage. Flutterwave, Google, and Expo may process data outside Nigeria. By using Google sign-in, Flutterwave, or push notifications you understand those transfers are required for those features.
7. How long we keep it
- Account, likes, ratings, and history: while the account exists, then we delete or anonymise them when the account is closed (except payment records we must keep for accounting or dispute).
- Session cookie: until it expires or you sign out.
- Password-reset and Google mobile handoff codes: minutes, then they burn.
- Device tokens: until the token is invalid, you turn notifications off (when the app can tell us), or we prune a dead token.
- Server logs: a short operational window, not a permanent profile.
8. Your rights
Under Nigerian data-protection law you may ask to see the personal data we hold about you, to correct it, to delete it where we have no duty to keep it, or to object to a use that is not required for the Service.
You can already edit your display name and sign out from My account. Email is the login identity and is not changed in the app; ask the media team if it must move. To close an account, use Delete account in the app (Profile, Edit Profile, Danger zone), on this website under My account, Danger zone, or at /account/delete. To export what we hold, contact the media team.
You can refuse push permission, or later turn notifications off in Android settings. You can choose email login instead of Google. Streaming without an account is available for ordinary published sermons.
9. Children
The Service is a church sermon library. We do not knowingly create accounts for children without a parent or guardian. Published recordings may include children’s voices from a public service. If you believe we hold a child’s account in error, contact the media team and we will delete it.
10. Security
Passwords are hashed. Membership cookies are httpOnly. Payments go through Flutterwave’s hosted checkout. No system is perfectly secure. If we learn of a breach that affects you, we will work to contain it and notify you where the law requires.
11. Changes
We may update this policy. The “Last updated” date will change. Continued use after a change means you accept the new policy. For a material change we will try to notice you on this website, in the app, or by email when we have one on file.
12. Contact
Privacy questions: use My account on this website, or speak to the media team at The Locust Army International.
These Terms of use sit at /terms on this same site.
Also see the Terms and Conditions.