This is the document that makes the promise enforceable. It is written to be read by an
ordinary person, not only by a lawyer.
A · Terms of Reference
What this platform is. Prayer Basket is a confidential, invitation-free facility for
submitting personal prayer requests to a closed body of intercessors (“the Prayer Council”), for the purpose
of intercessory prayer, and for the sender to record the outcome privately.
What this platform is not. It is not a crisis or emergency service, a medical or
psychological service, a legal or financial advisory service, a counselling practice, or a substitute for
your local church, your doctor, your lawyer, or the emergency services.
Purpose and scope
- To receive personal prayer requests, with or without identifying details.
- To assign each request to a minimal, closed, covenant-bound group of intercessors.
- To carry those requests in prayer according to the sender's stated preference.
- To allow the sender to record, privately, whether and how the request was answered.
- To do all of the above without ever publishing, broadcasting or otherwise disclosing a request
against the sender's wishes.
Roles
- The Steward — accountable for the platform, the covenant, and compliance.
- The Safeguarding Lead — the named person to whom any risk to life or safety is escalated.
- The Duty Officer — the single person who triages incoming requests.
- Intercessors — members of the Prayer Council who have signed the Covenant.
- The Sender — you. You retain ownership of your request and your story.
Conditions of use
- You must be 18 or over, or submit with a parent or guardian's knowledge and consent.
- Do not submit another person's confidential information without lawful authority. Pray for them by
first name only.
- Do not submit material that is unlawful, or that makes an allegation against a named person, or that
identifies a child.
- Do not use this platform to advertise, fundraise, recruit, or promote any cause.
- Requests that breach these conditions may be declined or removed. Where possible you will be told why.
B · Confidentiality Covenant
This is the operative “non-disclosure” instrument. It applies in two directions: to every intercessor
who receives a request, and to the platform itself.
B1 · The promise made to the sender
- The platform and every member of the Prayer Council shall treat each request as confidential
information belonging to the sender.
- A request shall not be published, posted, broadcast, livestreamed, projected, read
aloud, preached from, taught from, screenshotted, photographed, recorded, forwarded, printed, filed
publicly, shared in any group (including private messaging groups), or disclosed to any third party —
including a spouse, family member, church officer, ministry partner, or “prayer network”.
- A request shall not be used for content, media, engagement, testimonies, fundraising, promotion, or any
personal or organisational advantage, at any time.
- A request shall not be sold, licensed, traded, bartered, or disclosed to any advertiser, data broker,
analytics provider, or artificial-intelligence training pipeline.
- The obligation in this clause survives the end of the sender's involvement, the end of an intercessor's
term, and the closure of the platform. It has no expiry.
B2 · The intercessor's undertakings
- To sign this Covenant before being granted access to any request.
- To keep no private copy: no personal notebooks, no exported lists, no screenshots, no saving to personal
devices, drives, or cloud accounts.
- To record only the minimum necessary in the prayer log, and never to enrich it with identifying detail
the sender asked to withhold.
- To disclose a conflict of interest immediately — for example, if the request names someone known
personally to the intercessor — and to recuse from it.
- To submit to access logging, and to accept that access may be withdrawn at any time without reason.
- To refer (not conceal) any matter falling within clause E (Limits & safeguarding).
- To keep the Covenant after stepping down, retiring, resigning, or being removed.
B3 · Reporting a breach
Any suspected breach of this Covenant must be reported to the Steward immediately. The Steward will
(a) contain it, (b) determine which senders are affected, (c) inform those senders without delay, and
(d) record the outcome. A confirmed deliberate breach is grounds for immediate removal and, where the law
allows, referral.
C · Privacy Notice
Who holds your information. The Steward of Prayer Basket acts as the data controller for
the requests submitted here. Contact details are published in the footer.
What is collected
- The name you give, or your choice to remain anonymous.
- Contact details — only if you choose to supply them.
- The content of your request, and the categories and urgency you selected.
- The visibility level you chose, and your consents.
- A private reference code, and a minimal prayer log (that the request was carried — and no more than
that).
- Technical data strictly necessary to deliver and protect the service (for example, minimal security
logging and anti-abuse signals). No advertising identifiers.
Sensitive information
Requests frequently contain what the law calls sensitive personal data — information about health,
sexuality, religious belief, family circumstances, or allegations of wrongdoing. Prayer Basket treats
every request as sensitive by default, without needing to classify it. It is processed on the basis
of your explicit consent, which you give when you tick the consents on the submission form,
and which you may withdraw at any time.
Why it is processed
- To pray for you, as you asked.
- To show you the status of your own request.
- To keep the service safe, and to meet legal duties where they apply.
Nothing else. Prayer requests are not used for marketing, not profiled, not scored, not
used to train any model, and not shared with any commercial partner.
Alignment
This Notice is designed to align with the Zambian Data Protection Act No. 3 of 2021 and its
principles of lawfulness, purpose limitation, data minimisation, storage limitation, integrity and
confidentiality, and accountability. Where a sender is in the European Union or the United Kingdom, the
platform is additionally intended to align with the GDPR and the UK GDPR. See clause G — this is an
alignment statement for consideration by counsel, not a legal opinion or certification.
D · Security model
The promise of confidentiality is only as strong as the controls behind it. The production build is
intended to operate as follows.
D1 · Designed-in controls
- Encryption in transit — TLS on every connection; no plain HTTP endpoint.
- Encryption at rest — each request sealed with its own key (envelope encryption,
AES-256-GCM). A stolen database on its own yields ciphertext, not confessions.
- Least privilege — only the intercessors assigned to a request can open it. There is no
“read all” account that any single person holds by default.
- Access logging — every opening of a request is recorded: who, when, and why. Logs are
append-only and reviewed.
- No third parties — no advertising pixels, no third-party analytics, no social plugins,
no external font or script CDNs. The page you are reading now makes zero external network requests.
- No indexing — the platform is marked
noindex, nofollow and is never
submitted to search engines. Requests are not addressable by a guessable URL.
- Anti-abuse — rate limiting and a human-verification challenge on submission, without
invasive fingerprinting.
- Strong authentication — multi-factor authentication is mandatory for every intercessor
account. No shared logins.
- Deletion that means deletion — erasure removes the record and its key material, with
written confirmation to you.
D2 · Honest limitations
No system is invulnerable, and this platform does not claim to be. Confidentiality can be defeated by a
determined insider, by a compromised device, by legal compulsion, or by your own act of forwarding your
reference code. We therefore promise procedural and technical rigour — covenant, access
control, logging, and minimal retention — not mathematical impossibility. Where a risk remains that we
cannot remove, it is stated openly in clause E.
E · Limits & safeguarding
Confidentiality has one hard limit, and it protects the vulnerable. It cannot be a hiding
place for harm.
Confidentiality will be set aside — to the minimum extent necessary, and with the sender informed wherever
it is safe to do so — where the team learns of:
- an imminent risk to life, including suicidal intent or serious self-harm;
- abuse, neglect, or exploitation of a child or a vulnerable adult;
- a serious crime in progress, or an ongoing threat of serious violence to an identifiable person;
- a clear and present risk to public safety; or
- a lawful and binding order of a court or competent authority.
If you are in danger now, contact the emergency services before you contact us.
Zambia: Police 999 / 112; Lifeline Zambia 933. Elsewhere: your local emergency number.
Third-party allegations. Where a request names a person and alleges wrongdoing, the
platform will not investigate, adjudicate, or circulate it. The sender will be directed to the proper civil
or church authority. No allegation will ever be published here.
Minors. Requests from under-18s are accepted only with a parent or guardian's knowledge.
Requests concerning a child protect the child's identity above all else, and the child's name is never
recorded.
F · Your rights
- To know — what is held about you, and why.
- To correct — anything inaccurate. You may update your request at any time using your
reference code.
- To erase — to have your request destroyed, along with its key material, with written
confirmation. There is no retained shadow copy.
- To withdraw consent — at any time, without needing to give a reason, and without
penalty. Withdrawal ends the prayer; it does not retroactively legalise anything done before it.
- To complain — to the Steward first; and to the relevant data protection authority if
unresolved.
Because the platform holds no searchable index of requests, and because a request may be anonymous, we may
need your reference code to act on any of the above. This is a deliberate trade-off: what cannot be searched
for cannot be leaked or compelled.
G · Status of this document
This document is written to state the platform's genuine intentions in plain, enforceable language. It is
not legal advice and has not been reviewed by counsel. Before the platform
receives real requests from the public, the following must be completed:
- Review and adaptation by a qualified lawyer in the operating jurisdiction, including the position under
the Zambian Data Protection Act No. 3 of 2021 (and GDPR/UK GDPR if any senders are in those regions).
- Registration, where required, as a data controller with the relevant data protection authority.
- Adoption of a written child and vulnerable-adult safeguarding policy, with a named Safeguarding Lead and
a documented escalation path.
- A written retention schedule, and a tested deletion procedure.
- A signed covenant on file for every intercessor, before access is granted.
- A named, insured legal entity to act as controller — the Steward cannot hold this personally.
Demonstration data appearing on this site is fictional. This build stores nothing on a server:
everything you type remains in your own browser.