TwoDogDev

Privacy Policy

TwoDogDev — Zita Last updated: July 4, 2026

Overview

Zita is a ministry management app for churches, built and maintained by TwoDogDev. This policy explains what data Zita handles, where it lives, and what TwoDogDev does (and does not do) with it.

The short version: your church’s operational data — members, schedules, guilds, roles, and inventory — lives entirely in your church’s own iCloud account. TwoDogDev never sees it, never stores it on independent servers, and never shares or sells it to anyone. The one exception, a small anonymous registration entry, is described below.

Who This Policy Covers

This policy applies to all users of the Zita app for macOS, including church administrators, guild leads, and standard members who have been invited to join a church in Zita.

What Data Zita Handles

Information Entered by Church Administrators

When setting up a church or adding members, administrators enter:

  • Member names (given name and family name)
  • Member email addresses
  • Church name
  • Guild and role assignments
  • Service schedules and liturgical calendar data
  • Inventory items guilds choose to track (name, quantity, vendor details, reorder thresholds)

This information is entered by the church administrator and relates to the church’s own volunteers and operations.

Apple ID (Sign in with Apple)

Zita requires Sign in with Apple for all users. When you sign in, Apple provides Zita with a unique user identifier. You may also choose to share your name and email address with Zita through this process, but this is controlled by you and Apple — not by TwoDogDev.

Zita stores the Apple-provided identifier locally to recognize you across sessions. TwoDogDev does not receive or store your Apple ID credentials.

For more information on how Apple handles Sign in with Apple data, see Apple’s Privacy Policy at https://www.apple.com/legal/privacy/.

Anonymous Church Registration

When a church is first set up in Zita, the app records a one-time entry containing the church’s name, its approximate region (e.g., country), its device timezone, and the date of registration. This is used only to produce coarse, aggregate counts — for example, roughly how many churches use Zita and in what parts of the world — and is not used to identify, contact, or track any individual user.

This entry is stored using an identifier that is a one-way cryptographic hash of your account’s CloudKit identifier. It cannot be reversed to reveal your Apple ID, your identity, or any other information about you or your church beyond what’s listed above. This matches what’s declared in the App Store’s Privacy Nutrition Label for Zita: Coarse Location and Other Data (Church Name), both marked Not Linked to You.

This is the one piece of data in Zita that lives outside your church’s own iCloud account — everything else described in this policy (members, schedules, guilds, roles, inventory, and availability) stays entirely within your church’s private iCloud data and is never seen by TwoDogDev. This entry is deleted permanently when a church’s SuperAdmin uses Remove My Church, the same as everything else described in the next section.

Scheduling and Availability Data

Members may enter unavailability date ranges (for example, vacation or travel dates). This data is stored within the app and used only to assist with scheduling within your church.

Subscription and Billing

Paid subscriptions are handled entirely through Apple’s App Store and StoreKit. TwoDogDev does not collect, process, or store payment card information or billing details of any kind. All billing data is managed by Apple. For more information, see Apple’s App Store & Privacy policy.

Where Your Data Lives

All Zita data is stored in your church’s iCloud account via Apple’s CloudKit infrastructure. This means:

  • Data is stored on Apple’s servers, under your Apple ID and iCloud account
  • TwoDogDev has no independent server or database for your church’s operational data — members, schedules, guilds, roles, and inventory
  • TwoDogDev cannot access, view, export, or modify your church’s operational data
  • Data is shared between your church’s team members using Apple’s secure CloudKit sharing, which requires an explicit invitation from a church administrator

What TwoDogDev Does Not Do

TwoDogDev does not:

  • Collect or store your data on any server owned or operated by TwoDogDev
  • Sell, rent, or share your data with third parties
  • Use your data for advertising or marketing purposes
  • Use analytics SDKs, tracking tools, or advertising frameworks in Zita
  • Have access to your church’s member roster, schedules, guilds, roles, or inventory

Data Sharing

Zita does not share your data with any third parties except as follows:

  • Apple Inc. — Data is stored in iCloud via CloudKit and processed through Sign in with Apple and the App Store. Apple’s handling of this data is governed by Apple’s own privacy policy.
  • Within your church — Data entered in Zita is shared with other members of your church who have been explicitly invited by a church administrator. Access is invite-only and role-based.

The anonymous registration entry described above is not shared with any third party — it exists solely within Zita’s own CloudKit container for internal, aggregate reporting.

Data Retention and Deletion

Because Zita data lives in your iCloud account, you control its retention and deletion:

  • A church administrator can deactivate members, guilds, and services within the app at any time. Deactivated records are hidden from active use but preserved, so past schedules and history aren’t lost by accident.
  • The church’s SuperAdmin can permanently delete all church data — every member, guild, role, service, assignment, inventory and the anonymous registration entry described above — directly within the app, from Admin → Church Settings → Remove My Church. This action requires two separate confirmations and cannot be undone.
  • Deleting the Zita app from your Mac does not delete your data. Your data remains in your iCloud account and will reappear if Zita is reinstalled and you sign back in. To fully remove your data, use Remove My Church within the app.
  • Zita has no automatic process for deleting data based on inactivity. If a SuperAdmin stops using the app without deleting their church, that data simply remains in their private iCloud account indefinitely, the same as an unused Note or Reminder would. TwoDogDev has no visibility into inactive accounts and cannot delete data on your behalf, since TwoDogDev does not have access to it.

Children’s Privacy

Zita is not directed at children under the age of 13 and does not knowingly collect data from children. The app is intended for use by church administrators and adult volunteers.

Changes to This Policy

TwoDogDev may update this privacy policy from time to time. When changes are made, the updated policy will be posted at this URL with a revised date. Continued use of Zita after changes are posted constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or how Zita handles data, please use our contact form.

Zita is an independent product of TwoDogDev and is not affiliated with Apple Inc.