Privacy and data safety: how FlockConnect treats your church's data

Who can see your people's data?

Access starts with three roles: the account owner, church leaders, and care partners. Owners see every person in their church, and the account owner and church leaders with care access see the care notes shared with their role, plus their own. Church leaders see what their permission toggles allow, and the toggles are granular, covering things like giving signals, Collie, and user management, so giving someone forms access does not also hand them pastoral notes. Care partners see only the people assigned to them through a direct, household, group, or ministry care assignment, and their own profile; that boundary is enforced in the database, not just hidden in the interface.

Your members never hold accounts at all. They interact with FlockConnect through secure links scoped to one purpose and built to expire, so there is no member password to lose. And every church's data is church-scoped: the separation is enforced in the database with row-level security and re-checked on the server with every request.

• Your church owns its data. FlockConnect processes it on your instructions, never sells it, and never uses it for advertising.
• Three roles with scoped access: owners, church leaders with granular permission toggles, and care partners who see only their assigned people and their own profile.
• Every pastoral note carries a plain-language visibility setting, and Collie never receives the words saved in a care log entry.
• Everyday work needs only your normal sign-in. Sensitive steps like inviting a teammate, exporting data, or billing ask for a second step, and one check lasts 24 hours.
• Giving shows cadence only, never amounts, and only to staff you specifically permit.
• Collie drafts, a person approves. The account owner can export your church's data as a ZIP, and deletion opens a reversible 90-day window.

How does note visibility work?

Pastoral notes and care records carry a visibility setting written in plain language: Only me, which no one else can open, or shared with the account owners, the church leaders with care access, or specific people among them. A care partner sees only the notes they wrote themselves. When you pick a level, FlockConnect shows you in words exactly who can see the note and who cannot.

Collie works apart from visibility. Visibility decides which people can see a record. Collie never receives the words saved in a care log entry, whatever its visibility, so there is no record-by-record Collie setting to manage. Extra info is the one place you choose what Collie may read, field by field.

When does FlockConnect ask for a second step?

Only before the few steps that could expose your church's data or change who holds the keys. Everyday work needs just your normal sign-in: looking up people, writing and reading care notes, choosing who can see a note, and approving a Collie draft. Nobody is stopped at the door to verify or asked to check in again every month, and there is no separate setting for care partners: the rule is the same for everyone.

The sensitive steps are: inviting a teammate or cancelling an invitation; removing someone from your team or changing a teammate's role or permissions; exporting data; deleting your church's account; managing billing; connecting or disconnecting Planning Center, sending the link that connects Planning Center Giving or disconnecting Giving, or changing which people Planning Center brings over; and adding, changing, or removing a way to get your codes once you have one. Before any of these, FlockConnect asks for a one-time code right where you are, then picks up where you left off. One check covers you for 24 hours. Changing your password while signed in can also ask for your second step, if you have set one up. You can get your code from an authenticator app, by text message (US mobile numbers only), or by email. Email is the simplest, but it is also the least safe, because anyone who gets into your email could see the codes too.

What does FlockConnect know about giving?

Cadence, never amounts. FlockConnect records the rhythm of a household's giving, whether a regular pattern has paused or changed, because a change in rhythm is often a quiet sign that a family hasn't been seen lately. It does not record amounts, funds, or donor totals. There is nowhere for an amount to live: amounts are dropped at the import boundary, and the giving signal itself has no field for them.

Seeing giving signals at all is its own permission, separate from general access to people, so cadence is visible only to staff you specifically permit. The connection-health thresholds that use it are your church's to adjust in Settings.

What is Collie allowed to see and do?

Collie, FlockConnect's AI assistant, works behind two boundaries. The first is redaction: before any text leaves the server for an AI provider, member names are replaced with stable placeholder labels, and a fail-closed check rejects the request outright if raw emails, phone numbers, or unexpected fields appear in the context. Real names are restored only when the draft comes back, so your reviewer sees them and the model did not. Per our privacy policy, AI processing runs through providers under zero-data-retention terms, and redaction and data minimization apply where possible; we do not pretend that no sensitive detail can ever reach a model, which is exactly why the second boundary exists.

The second boundary is a person. Collie only drafts: every external write and every member-facing message requires human review and approval first, and that requirement is enforced on the server, not just in the interface. Collie is assistive and can be wrong; it is not a substitute for pastoral judgment.

Can I get my data out?

Yes, at any time. The account owner can request a full workspace export from Settings; it is an owner-only action and asks for the second step described above. The export arrives as a ZIP: tabular data as CSV files, nested records like forms and approved Collie artifacts as JSONL, a README, and a manifest with the record counts. The owner's export includes people, households, groups, forms and submissions, calendar write-backs, integration metadata, and the care notes, interactions, and care reports the owner can see. Archived records the app still lets you open, such as archived people, groups, and care reports, are included and marked with the date they were archived; a person merged into another record is left out, because that record already holds their details. A care partner's report is included once they submit it. A church leader with export permission gets a smaller export: only the kinds of records that church leader may read, never calendar or integration files. A care partner can export only the notes and interactions they kept private.

The export is built from explicit allow-lists of fields, never a raw database dump, so connection credentials, security tokens, and other secrets are never included. Download links last 15 minutes, downloading asks for the second step again if your 24 hours have run out, every download request is logged before its link is issued, and no new download link is issued once the export is 7 days old, after which a daily cleanup deletes the file.

What happens if we delete our account?

Deletion is deliberate and reversible at first. When the account owner requests it (it asks for the second step), FlockConnect opens a 90-day window: during the window you can still export your data, and you can cancel the request entirely if you change your mind.

After the 90 days, deletion proceeds in stages with safety checks along the way, including confirming there is no active subscription, legal hold, or open billing dispute, and revoking the Planning Center, Google, and Microsoft credentials FlockConnect held for your church. Two honest caveats: third-party providers keep their own records under their own policies, and backups, logs, and audit records may persist for a period after the primary records are deleted, with security and audit logs kept longer where the law or an active investigation requires it. We will not tell you deletion is instant, because it is not designed to be.

Where is all of this written down?

The privacy policy and terms of service published on this site are the governing documents (the English versions govern, with Spanish convenience translations available), and the promises above restate them: your church owns its data, FlockConnect processes it on your church's instructions, and member and pastoral data is never sold and never used for advertising. The policy names every category of provider we rely on, and if we confirm a breach affecting your data, we notify your church without undue delay.

Because members do not hold accounts, requests to access, correct, or delete a member's information route through your church, with FlockConnect assisting. Members can manage their own communication preferences through a secure link, though that page handles consent, not data access. We do not claim certifications we do not hold; what we publish on the trust and security page is what we can show. Questions are welcome at support@flockconnect.com.