Data, privacy & syncing

• Giving amounts are only ever shown as aggregates. No screen shows a person's or a household's dollar figures, and there is no donor-level giving list.
• One screen names people: the care list shows household and member names with contact details and a count of recent signals derived from giving rhythm and connection indicators, for pastoral follow-up. It shows no amounts. Admins, Pastors and Staff see every household; Volunteers see only the households a teammate has assigned to them. Invite accordingly.
• Survey answers are aggregate-only. Individual submissions are not viewable in the app, and any segment with fewer than 5 responses is suppressed.
• A nightly sync pulls only records changed since the last run, using a per-entity watermark, so it is fast and safe to repeat.
• A full refresh runs weekly to catch anything a changed-since query could miss, such as deletions.
• Planning Center access tokens are encrypted at rest and are only ever used by the server, never sent to the browser.
• Your data is isolated per organization at the database level, so one church can never read another's records.
• Disconnecting Planning Center in Settings stops all syncing immediately.

Where to click: Settings → Data connection