Privacy Policy

1. What we collect

• Content your church publishes — sermons, events, ministries, staff listings, page copy, and images. This is public by design; that is what a website is.
• Form submissions from your congregation — connect cards, prayer requests, event registrations, and ministry sign-ups. These can include names, contact details, and sensitive pastoral content: health and family situations, spiritual crises, sometimes information about children. We treat every submission as pastoral data, whether or not it looks sensitive.
• Staff account data — the names, email addresses, and roles of the people your church invites to run the site, plus their password in hashed form (we cannot read it).
• Basic operational records — the technical minimum to run and secure the service, such as sign-in attempts and error reports (see section 3 for what error reports are stripped of).

2. Who can see form submissions

Submissions go to a private admin inbox that only your church's signed-in staff can reach, and to the staff email addresses your church has chosen to notify. Every record is scoped to your church — no other church, and no visitor, can ever query it. Prayer requests are private by default and appear publicly only if your staff explicitly approves them for your church's prayer wall.

3. Pastoral data stays out of our plumbing

This is the commitment the product is built around, not a paragraph added for compliance:

• Pastoral field values never go to logs, error tracking, or analytics. Our form handlers do not log what people write. Our error-tracking pipeline runs every report through a scrubber that drops request bodies entirely and redacts names, emails, phone numbers, and prayer content before anything leaves the application — by default, not by exception.
• We run no analytics and no ad tracking. There is no Google Analytics, no advertising pixel, no fingerprinting, and no behavioural profiling anywhere on a Shepherd site — yours or ours.
• We never sell or share your data. Not submission data, not member contact details, not aggregate "insights." Nobody is paying us for your congregation's information, ever.
• Email is used to notify your staff, nothing more. We send transactional email only — form notifications, staff invitations, password resets — from our verified sending domain. No newsletters, no marketing to your members.

4. Cookies

We use no tracking cookies, which is why you will not see a cookie-consent banner on a Shepherd site — there is nothing to consent to. The complete list of what we do set:

• a session cookie for signed-in church staff, so the admin dashboard knows who they are;
• an anonymous cookie remembering which prayer requests a visitor has tapped “I prayed” on, so the count is not inflated by double-taps — it identifies requests, not people;
• anti-bot state set by Cloudflare Turnstile, the spam check on public forms, which keeps automated abuse out of your inbox.

5. Who processes data on our behalf

Shepherd runs on a small set of infrastructure providers: our hosting platform, our database provider, our transactional email provider, Cloudflare (spam protection and media storage), and an error-tracking service that only ever receives the scrubbed reports described above. Each processes data solely to run Shepherd — none of them may use your church's data for their own purposes.

6. Export and deletion

Your church's data belongs to your church. On request we will export everything you have put into Shepherd in a plain, portable format, and we will delete your church's data when you leave or whenever you ask. If a member of your congregation asks us directly to remove something they submitted, we will route the request to your church and honour the outcome.

7. Changes to this policy

If we change this policy in a way that matters, we will email your church's admin contact before the change takes effect. We will never weaken the pastoral-data commitments in section 3 quietly.