Privacy Policy

Effective date: October 14, 2026

This policy explains what personal information joshuashaw.co ("the site") collects, why, who handles it, and what choices you have. The site is run by Joshua Shaw ("I", "me"), lead pastor of Vineyard Church Los Angeles, for my book Practicing the Supernatural (Zondervan, release date February 23, 2027).

Contact for privacy questions and requests: by mail to Joshua Shaw, c/o Vineyard Church Los Angeles, 3838 South Centinela Avenue, Los Angeles, California 90066.

What I collect and why

I collect what you choose to send me through a form, plus a small amount of technical information needed to keep the forms safe.

  • Newsletter sign-up (footer form). Your email address.
  • Free chapter request. Your first name, your last name (optional), your email address, and where you pre-ordered the book.
  • Resource notifications ("tell me when it's ready"). Your email address and which resource you asked about. Asking to be notified also adds you to my email list for book updates. You can leave at any time with the unsubscribe link in any email.
  • Booking requests. Your name, email address, event type and date, honorarium and travel details, and the description you write, plus whether you ticked the box to get news and updates. A scrambled (hashed) version of your IP address is saved with the request. Please do not put sensitive information in the free-text boxes.
  • Confirmation and proof of consent. For emails you ask for, I send a confirmation email first. I keep a record of your request and your confirmation: your email address, the time, the version of the wording you saw, your browser type, and a scrambled (hashed) version of your IP address. The hash cannot be turned back into your address, but it can show that the same device was used again.
  • Safety and abuse protection. When you use a form, your IP address is sent to Cloudflare Turnstile to check that you are a person and not a robot. I also keep scrambled (hashed) IP and email values for a short time, normally a few hours, only to limit how many times a form can be submitted.
  • Ordinary visit data. The companies that host the site and store its files automatically record ordinary visit information, such as your IP address and browser type, when you load a page.
  • Site administrators. The few people who help me run the site have accounts. The site keeps their name, email address, sign-in security information and a log of administrative actions, which includes their IP address.

Anyone can type an email address into a form. That is why I send a confirmation email first and only add you to a list after you confirm.

I use this information to send what you asked for (the chapter, updates about the book, resource notices), to answer booking requests, to prove that you agreed to receive email, to prevent abuse, and to keep the site secure. I do not sell your personal information.

Email

Emails you request come from this site through Resend, our email service. Every newsletter and notification email has an unsubscribe link at the bottom that works in one click. The confirmation email you get first asks you to confirm, and your mail program may also show an unsubscribe option for it.

Cookies and similar technology

The site uses Google Analytics to count visits and see which pages are read. It runs only if you click Accept in the cookie banner. Nothing from Google loads before you choose, and if you decline, nothing is collected for analytics. The banner stores your choice in a cookie so it does not ask again, and you can change your mind at any time with the Cookie settings link in the footer.

Site administrators sign in using cookies that are needed for security.

Who handles your information

I use a small number of companies to run the site, and Google Analytics if you accept analytics cookies. They may handle your information only to provide their service to me:

  • Supabase: database and file storage.
  • Vercel: website hosting.
  • Resend: sending email.
  • Cloudflare: the Turnstile check on forms.
  • GitHub: encrypted backup copies of the database, kept for about seven days.
  • Kit (ConvertKit): only if newsletter delivery is switched on. It would receive your email address, first name and labels such as where you pre-ordered.
  • Automation tools: only if I connect one, for example to copy new subscribers into a spreadsheet. It would receive your email address and the time you confirmed.

I may also disclose information if the law requires it. Retailers (Amazon, Barnes & Noble, Target, Audible) and the publisher have their own privacy policies; once you click through to them, their policies apply.

How long I keep it

  • Your subscriber record stays until I delete it. If you unsubscribe, I keep the record marked as unsubscribed, plus a do-not-email entry, so that I never email you again by mistake. If you ask me to delete your information, I remove your subscriber record and keep only your email address on a do-not-email list.
  • Records that prove consent, the log of emails sent, and booking requests are kept after you leave the list, so that I can show that I followed the rules. I plan to set clear time limits for these and will update this page when I do.
  • The companies listed above may keep their own copies until I ask them to delete them.
  • Backups are kept for about seven days.

Your choices and rights

You can unsubscribe from any newsletter or notification email with one click. You can ask me to tell you what I hold about you, correct it, or delete it, by writing to the contact above. I will respond within 45 days.

If you live in California, you have the right to know what personal information I collect, use and disclose; to request deletion; to correct inaccurate information; to opt out of the sale or sharing of personal information; and to not be treated differently for using these rights. I do not sell personal information and I do not share it for advertising, so there is nothing to opt out of today. You may use an authorized agent, and I may need to confirm your identity first. California's "Shine the Light" law lets you ask which companies receive your information for their own marketing; I do not give it to any.

In the past 12 months I have collected, only if you gave it to me or your browser sent it: identifiers (name, email address, IP address, browser type), commercial information (where you pre-ordered the book), and whatever you typed into forms. A mailing list for a pastor's newsletter may suggest a person's religious beliefs. I use it only to send you what you asked for.

I do not knowingly collect information from children under 13. If you think a child has sent me information, write to me and I will delete it.

Do Not Track

Today the site does not track you across other sites. If I ever turn on advertising cookies and you accept them, that tracking is not changed by a browser's "Do Not Track" setting, which is why the choice is yours in the cookie banner.

Security

I use encryption in transit, restricted access, two-step sign-in for administrators and encrypted backups. No online service is perfectly secure, so I cannot guarantee absolute security.

Changes

I will post changes on this page and update the effective date. If a change is significant I will tell subscribers by email.