Privacy Policy

This Privacy Policy explains how www.ourladyofassumptionpkp.org — the official website of Our Lady of Assumption Church, Pragasapuram — handles information. The parish is a Roman Catholic parish in Pragasapuram, Thoothukudi District, Tamil Nadu, India, belonging to the Diocese of Tuticorin. The website is developed and maintained by St. Mary's Club, Pragasapuram, on behalf of the parish.

The site is purely informational. It publishes Mass timings, feast day details, parish history, substations, schools, photographs and parish contact details, and it shows a small widget when the parish's YouTube channel is broadcasting live.

There is nothing here to sign up for. The website has no user accounts, no login, no contact or enquiry form, no comment section, no newsletter and no online donation or payment facility.

The short answer is that we do not collect personal information from people who visit this website. The site never asks for your name, email address, telephone number, postal address or any other personal detail, because there is no form, account or subscription anywhere on it.

The telephone number, email address, WhatsApp and map links on the Contact page are ordinary links. When you use one, it opens your own phone, email or messaging app; anything you then send reaches the parish office through that service, not through this website. Such messages are handled like any other letter or telephone call to the parish office.

We do not use Google Analytics or any other analytics service, advertising network, tracking pixel, heat-map tool or third-party measurement script anywhere on this site. The fonts used by the site are bundled with the site itself and served from our own domain, so simply reading a page does not send a request to a font provider.

The website is hosted on Vercel. As with any web host, Vercel's infrastructure automatically records ordinary technical request logs — such as the requesting IP address, the time of the request, the page requested and the browser's user-agent string — for a limited period, so that the site can be delivered, kept secure and repaired when something breaks. We do not build visitor profiles from these logs, do not combine them with any other information, and keep no visitor database of our own. Those logs are processed by our hosting provider under its own privacy terms.

This website sets no advertising cookies and no analytics cookies. What it does use is limited to the following:

The parish broadcasts Masses, feast celebrations and other parish events on its own YouTube channel. So that visitors do not have to keep checking YouTube themselves, this website checks whether that channel is broadcasting at the moment and, when it is, shows a small "Live Now" widget in the corner of the page.

The widget displays the title of the broadcast, a short extract of its description, its thumbnail image and the number of people currently watching, and it lets you either play the stream in YouTube's embedded player or open it directly on YouTube. When the channel is not broadcasting, the widget simply does not appear.

This check happens on our server. Your browser only asks our own address, /api/live-status, which answers with the live status and those few display details.

To read the live broadcast status of the parish's own channel, the website uses the YouTube Data API v3. Access is authorised once, by the owner of the parish's YouTube channel, through Google's standard OAuth consent screen. No website visitor is ever asked to sign in with Google, and no visitor grants, or is asked to grant, any permission.

The application requests a single scope:

https://www.googleapis.com/auth/youtube.readonly

This scope is read-only. It is the narrowest access Google offers that still allows an application to read a channel's live broadcast list, which is exactly what the Live widget needs. It gives the website no ability to upload, edit, delete, publish, comment on, or otherwise change anything on the channel, and it applies only to the parish's own channel.

Using that authorisation, the website reads only the following live broadcast metadata from the parish's channel:

The broadcast information above is used for exactly one purpose: to decide whether the Live widget should be shown on the website, and to fill in what it displays — the title, description extract, thumbnail, viewer count and the link to the stream.

It is not used for advertising, profiling, marketing or any form of analytics, it is not used to train machine-learning models, and it is not sold, rented or transferred to anyone. It is not personal information about visitors in the first place: it is public metadata about the parish's own broadcast.

The website's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

None of the YouTube data is written to a database. The website has no database of visitors and no store of YouTube data.

When the server checks the live status, it keeps the answer in its own memory for up to ten seconds, so that many visitors viewing the site at the same time do not cause needless repeated calls to YouTube. After those ten seconds the value is discarded and fetched again on the next request, and it disappears entirely whenever the server restarts or the site is redeployed.

So, in terms of retention: for visitors there is nothing to retain, because no personal information is collected. Live broadcast details are held for at most about ten seconds in server memory. Ordinary technical request logs are kept for a limited period by our hosting provider, as described above. The OAuth refresh token is kept for as long as the parish uses the live feature, and stops working the moment the channel owner revokes access.

The OAuth client ID, client secret and refresh token are stored as server-side environment variables in the website's hosting environment. They are not part of the website's source code, are not included in the pages sent to browsers, and are not present in any JavaScript that runs in your browser.

Every call to the YouTube Data API is made by our server, never by your browser. Your browser receives only the finished answer — whether the channel is live and, if so, the few display fields listed above. It never receives the refresh token, the client secret or any other credential.

Access to those stored credentials is limited to the small number of parish volunteers who administer the website's hosting account.

The live streams themselves are hosted and delivered by YouTube, a Google service. This website only detects that a broadcast is happening and links to it; the viewing takes place in YouTube's player.

Because of that, some content on this site is loaded directly from Google's servers by your browser. When the Live widget appears, the broadcast thumbnail is loaded from YouTube's image servers; if you press play, YouTube's embedded player is loaded from youtube.com; and on the Contact page a Google Maps embed is loaded from Google.

In each of those cases your browser communicates with Google directly. Google may receive your IP address and information about your device and browser, and may set its own cookies, in accordance with the Google Privacy Policy and the YouTube Terms of Service. We do not control that processing and we receive no information back from those embeds.

We do not sell, rent or trade any information to anyone. The parish has no advertising or marketing partners, and runs no mailing list through this website.

The only third parties involved in running the site at all are our hosting provider, Vercel, which serves the pages and processes the ordinary technical logs described above, and Google and YouTube, which provide the live-stream API, the embedded player and the map on the Contact page.

We would disclose information if we were legally required to do so — noting that, in practice, we hold almost nothing that could be disclosed.

The website is served over HTTPS, so traffic between your browser and the site is encrypted. The Google credentials are held only as server-side environment variables and never appear in the source code repository or in anything sent to a browser. The authorisation itself is read-only, which limits what could be done with it even in the worst case. And because the site keeps no visitor database, there is no store of personal data that could be exposed.

No method of transmission or storage over the internet is completely secure, so we cannot promise absolute security. What we can do, and do, is keep the amount of data at risk as close to nothing as possible.

The Google account that authorised this application — the owner of the parish's YouTube channel — can withdraw that authorisation at any time, without contacting us, from the Google account permissions page:

Open that page, select this application from the list of apps with access to the account, and choose "Remove access". The stored refresh token stops working immediately, the website can no longer check the live status, and the Live widget simply stops appearing. Nothing else on the website is affected.

The parish may also ask us to delete the stored credentials altogether, using the contact details below.

If the website ever changes what it collects, or how it uses data from Google and YouTube, this page will be updated and the "Last updated" date at the top will change. The current version is always the one published at this address.