What's My Story
Opening the next page…
Opening the next page…
Privacy policy
Effective date: .
What's My Story is built to let you write privately and choose whether to submit a story for review. A story becomes public only after you submit it and our team approves it. This policy explains what information we handle along the way.
What's My Story (“WMS,” “we,” “us,” or “our”) is a service of Evangelism Explosion International, Inc. (“EE”), a nonprofit organization located at 10 Misty Valley Parkway, Arden, North Carolina 28704, USA.
Questions or privacy requests may be sent to contact@eeworks.org.
This policy applies to WMS websites, accounts, story-writing and moderation tools, public stories, emails, WMS application programming interfaces, and the optional Pathway to Grow resource signup on this application. It does not govern EE's other websites or services, which have their own notices. If you choose to connect an EE account, the connection is also described below.
When you create or use an account, we process your email address, display name, verification status, WMS role and membership status, and account timestamps. Firebase Authentication processes your credentials and may process your IP address and browser or device information to authenticate you, prevent abuse, and protect the service. WMS does not store your password.
We collect the drafts, revisions, titles, quotes, tags, and answers you choose to provide. You may also provide your name, country or region, profile image, years of faith, EE training information, and an anonymity preference.
A testimony may reveal religious beliefs and deeply personal life experiences. Depending on what you write, it may also reveal health, family, or other sensitive information. Please include only information you are comfortable giving to WMS and, if you submit the story, potentially making public. Do not include sensitive information about another person unless you have their permission and the right to share it.
We keep story status, approved revisions, moderator feedback, reports, publication decisions, role changes, and security or administrative audit events. These records help us review content, enforce our Terms, investigate concerns, and preserve the integrity of editorial decisions.
When you read, like, or report a public story, we receive ordinary request information such as your IP address, browser user-agent, and page request. For engagement controls, WMS combines a random visitor identifier with request information and converts it into a keyed, non-reversible hash. Firestore receives that hash—not the raw IP address or user-agent—to deduplicate activity and limit abuse. Our hosting provider may separately retain ordinary request logs for operations and security.
A story report includes the reason you select, any optional note, its review status, and the hashed visitor identifier. Reports are private to authorized staff.
We process your email address and message details when we send account, verification, password-reset, story-review, publication, or membership notices. These WMS messages are service-related.
Separately, if you choose to receive Pathway to Grow information and resources, we send your email address to Mailchimp to request a confirmation email. New subscribers must confirm before joining the mailing list. This signup is optional, does not create a WMS account, and is not required to use the site. You can unsubscribe using the link in resource emails. For signup abuse limits, we store keyed hashes of the email address and request IP address with short-lived counts, not the plaintext address or IP, in Firestore.
If you explicitly choose to connect an EE account, EE sends WMS a short-lived, signed confirmation containing your verified email address, display name, and a one-time identifier. WMS stores a protected hash of the EE account identifier and the connection time. WMS does not receive your EE password. Disconnecting removes the active connection but does not delete your WMS account, stories, or required audit records.
Pathway to Grow's Gospel illustrations are hosted by Vimeo. We load an embedded player only when you select Watch. Loading or playing a video shares ordinary connection information, such as your IP address, browser information, and the site origin, with Vimeo. The player uses Vimeo's do-not-track setting, but still needs to connect to Vimeo to deliver the video. You can use the page without loading videos, or choose the direct Vimeo link instead.
Drafts remain private to you and authorized WMS staff. Submitting a story sends it to staff for review but does not itself publish it. If approved and published, the public version may include:
Public stories may be indexed by search engines, shared by visitors, or copied outside WMS. Removing a story from WMS cannot remove copies that others already made or control.
We use information to:
| Name or technology | Purpose | Typical duration |
|---|---|---|
__session | Keeps an authenticated WMS user signed in. | Up to 5 days |
wms_csrf | Protects sign-in and other requests from cross-site request forgery. | About 10 minutes |
wms_visitor | Assigns a random identifier used to deduplicate public story engagement and limit abuse. | Up to 1 year |
| Pathway resource invitation (session storage) | Remembers whether the resource invitation was shown, dismissed, or submitted. Does not store your email. | Browser tab session |
| Firebase App Check / reCAPTCHA | Assesses whether requests come from a legitimate app and helps prevent automated abuse. Google may process browser, device, and security signals and store short-lived tokens in the browser. | Varies by security token |
These technologies are used for authentication, security, and core service functions. WMS does not currently activate Firebase Analytics in the application, use advertising cookies, or sell personal information. We also do not share personal information for cross-context behavioral advertising. We will update this policy and, where required, request consent before introducing materially different analytics or advertising practices.
We disclose information only as needed for the purposes in this policy:
We retain accounts, stories, revisions, moderation records, audit events, reports, and email-delivery records for as long as reasonably needed to provide and secure WMS, document publication decisions, comply with law, and resolve disputes. WMS does not yet apply one automatic deletion period to all of these records.
Short-lived engagement rate-limit records are scheduled to expire after approximately one or two days. View-deduplication records expire after approximately 32 days. Like-deduplication records currently have no automatic expiration and are retained so repeat activity from the same visitor does not add another like.
Firestore point-in-time recovery and daily backups are retained for up to 7 days; weekly backups for up to 8 weeks; and deleted Storage objects may remain recoverable for up to 7 days. When we approve a deletion request, we remove information from active systems as appropriate, but residual copies may remain until these recovery periods expire or where retention is required by law, security, or a legitimate recordkeeping need.
You can update drafts and certain profile details in your account, choose anonymous publication, disconnect an EE account, and ask us to correct, unpublish, export, or delete information. Authors can use “Delete my account” in their dashboard to delete their sign-in, profile, stories, and uploaded photos. Staff accounts require administrator assistance. Data-export requests and other privacy requests are handled by our team. Email contact@eeworks.org from the address associated with your account. We may need to verify your identity and clarify the scope of a request. The backup and record-retention limitations described above still apply.
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, receive a portable copy, or appeal a decision. We will respond as required by applicable law. You may also complain to your local privacy or data-protection authority.
WMS is not directed to children under 13, and children under 13 may not create an account or submit personal information. Users between 13 and the age of legal adulthood should use WMS only with permission from a parent or guardian where applicable. If you believe a child provided information contrary to this section, contact us so we can investigate and take appropriate action.
WMS is operated from the United States. Information may be processed in the United States and other countries where our providers operate. Those countries may have different privacy laws from your home country. Where required, we use legally recognized safeguards for international transfers.
We use measures designed to protect information, including encrypted transmission, provider encryption at rest, access controls, private data collections, role checks, abuse protection, and audit records. No service or transmission method is completely secure, so we cannot guarantee absolute security. Please use a unique password and notify us if you suspect unauthorized account activity.
We may update this policy as WMS changes. We will post the revised version and update its date. If a change materially affects how we use information, we will provide additional notice or request consent when required by law.