Privacy Policy

Last updated August 24, 2026

Shepherd is built for volunteer small group leaders — hosts and helpers who lead a recurring meeting. This page explains what we collect about you and the people in your group, who inside your church can see it, and how long we keep it. If something here is unclear, see Contact.

What we collect

• Group members. Names, entered by a leader, and which nights a person attended. We don’t require a phone number, email, or any other contact detail for a group member — most never have one on file.
• Leaders. A leader’s own name and phone number, used only to send them their link and their check-in reminders. We never collect a group member’s phone number for messaging purposes.
• Observations. What a leader writes or says after a meeting, in their own words — how it went, who they’re concerned about, who they’re glad about. Voice answers are transcribed automatically; see Check-in audio below.
• Attendance and engagement. Whether someone was at a given meeting, and a leader’s rough read of how much they participated (quiet, chimed in, opened up). This is never shown to anyone as a score or a rating.
• Consent records. When a leader agrees to receive text messages, we store the timestamp, the IP address, and the exact wording they were shown. This is the record we produce if a mobile carrier ever asks us to prove consent.

Who can see it

A group has two leaders, host and helper, with equal standing. Both see everything recorded about their own group — attendance, observations, and the notes each of them has written. Neither sees another group’s notes.

Church admins and program directors never see observations, extracted facts, the pre-meeting brief, or a leader’s assignments. This is enforced in how the product is built, not just a policy — the admin surfaces are wired to a narrower set of data. What an admin can see is limited to:

• Attendance, per person and per group
• Engagement, aggregated to the group rather than shown per person
• Whether a check-in was completed for a given night
• An escalation, only if a leader chose to send one — see below

A leader can send an escalation to an admin when a group needs something (attendance collapsing, another helper needed) or when a specific person needs pastoral care beyond what the leader can offer. That escalation, written by the leader, is the only per-person content that ever reaches an admin. Shepherd itself never decides to escalate, and it never sends a message to anyone on a leader’s behalf.

Check-in audio

The after-meeting check-in is answered mostly by voice. That recording is uploaded, automatically transcribed, and then discarded once the leader confirms the transcript is accurate. We do not keep a library of recordings, and Shepherd never records or listens to the meeting itself — only the leader’s own answers, given afterward, by choice.

How long we keep it

Attendance and program records are kept for the life of the program. Observations and the facts extracted from them default to a twelve-month retention window, after which the facts are purged. A church admin or program owner can request a shorter window.

Export and deletion

A leader can ask for their own notes, or a group member can ask what’s been recorded about them, by writing to us at the contact page. We’ll export or delete on request, and we’ll confirm once it’s done. Deleting a person’s record removes their observations and facts; it does not rewrite attendance history that other people’s records depend on.

Text messages

Shepherd texts small group hosts and helpers who have opted in — never group members or guests. Phone numbers collected for messaging are never sold or shared with a third party for marketing purposes. Full detail on frequency and how to stop is in our SMS terms.

Questions

Reach us at the contact page with any question about this policy or a request about your own data.