Data, privacy & syncing

• Individual donor names and donor-level lists are never displayed anywhere in the app. Every giving figure is an aggregate.
• Survey answers are aggregate-only. Individual submissions are not viewable in the app, and any segment with fewer than 5 responses is suppressed.
• A nightly sync pulls only records changed since the last run, using a per-entity watermark, so it is fast and safe to repeat.
• A full refresh runs weekly to catch anything a changed-since query could miss, such as deletions.
• Planning Center access tokens are encrypted at rest and are only ever used by the server, never sent to the browser.
• Your data is isolated per organization at the database level, so one church can never read another's records.
• Disconnecting Planning Center in Settings stops all syncing immediately.

Where to click: Settings → Data connection