Care visibility: who can see a note, decided note by note

What does a new note start as?

Private. When you log care, the visibility control reads Only me, and saving it that way means exactly that: you are the only person who can open it. Nothing is shared because a default quietly said so; the author opts into sharing, every time.

That default protects the awkward middle of pastoral work, the half-formed observation you are not ready to share, the detail told to you in confidence. You can write it down without deciding its audience yet, because the audience is already the smallest one possible.

• Every care note starts private to its author. Sharing is an explicit opt-in, never a default.
• Share with all account owners, all admins with care access, others assigned to the same person, specific named people, or any combination.
• A live summary states in words who will see the note before you save it.
• Visibility is enforced in the database: a person outside the audience never receives the record.
• Members never hold accounts and never see care notes.
• Imported Notebird history requires a whole-file visibility choice up front. Owners and admins only is the safe answer, and an import can be undone.
• Changing visibility later is a sensitive action and asks for multi-factor authentication.

Who can a note be shared with?

Switching a note to shared opens a short checklist, not a mystery. You can share with all account owners, with all admins who hold care access, and with the other people assigned to care for that same person. Each is its own checkbox, so sharing with the owner does not quietly include anyone else.

There is also a Specific people list, which names the individual teammates eligible to see records about that person, with a Suggested tag on the ones already assigned to their care. Nothing in that list is ever pre-checked. As you choose, a live summary line spells out in words exactly who will be able to see the note, so what you read is what the database will enforce.

What does each role see by default?

The account owner and admins with care access see the notes shared with their role, plus their own. Care partners see only records about the people assigned to them, and then only the notes shared with them. That boundary lives in the database, so a care partner browsing the app does not receive other records at all.

One thing sharing never changes: the member. Church members do not hold FlockConnect accounts and never see care notes. Visibility choices decide which of your staff can see a record, not whether it leaves the building. It does not.

What about confidential notes imported from Notebird?

Notebird's export includes restricted and confidential notes when an owner or admin runs it, and the file does not mark which notes those are. So the Notebird importer refuses to write your history until you answer one question: who should be able to see these notes?

Two answers are offered. Owners and admins only is the safe choice and mirrors how restricted notes worked in Notebird; care partners will not see any of the imported history. Everyone with care access is for a file you are sure holds nothing sensitive. The choice covers the whole file and cannot be changed note by note afterward, but you can undo the import and bring the file in again with the other answer.

Can I change a note's visibility later?

Yes. Changing who can see an existing record is treated as a sensitive action, which means it asks for multi-factor authentication, the same bar FlockConnect sets for exporting data or managing users.

And because visibility is written in plain words rather than icons, the person changing it sees the same sentence the author saw: exactly who can see this note, and who cannot. If a note's audience surprises you, the author or an owner can narrow it on the spot.