Privacy Policy

Overview

Shepherd is a church health platform built on the conviction that pastoral care requires trust. This policy explains how we collect, use, and protect the information you and your team share with us.

Data in Transit

All communication between your device and Shepherd is encrypted in transit using HTTPS (TLS 1.2 or higher). This includes every check-in response, every pastoral message, and every piece of data your team submits through the platform.

Check-In Privacy

Check-in responses — including the Win of the Week and On Your Heart text fields — are private by design. Specifically:

• Text content shared in check-ins is accessible only to the ministry lead who submitted it and the pastor of their church.
• Church administrators (Shepherd Stewards) can see whether someone has checked in, a general health word, and whether that is improving or declining. They cannot read anything a leader wrote, see any numeric score, or read Monthly Reflection answers or pastoral messages.
• No other ministry lead can see another lead’s check-in responses.
• No data from one church is ever visible to another church.

Who can see what you share

What a ministry leader writes in a check-in or reflection is visible only to their own pastor, and to the leader themselves. Other leaders and Stewards can see whether someone has checked in and a general health word, never what they wrote.

Shepherd’s team

Like any online service, our team can technically access stored data to keep Shepherd running. We never read leaders’ check-ins, reflections, or messages unless your church asks us to help with a specific problem. We don’t sell your data, use it for advertising, or use it to train AI models.

AI

Shepherd has no AI features today. Nothing your team writes is sent to any AI service, and nothing is used to train a model. If we ever add an AI feature, we will describe it here and tell church administrators by email before it is switched on.

Leaving Shepherd

A pastor can delete their church and all of its data from Settings. Deletion happens after a 7-day grace period.

• During those 7 days everything keeps working, and the deletion can be cancelled with one click. We email the pastor when it is scheduled, and again 24 hours before.
• When it runs, every check-in, reflection, message, care record, custom answer and member record for that church is removed. Accounts belonging to people who are not part of any other church on Shepherd are deleted too, including their login. We keep only the church’s internal identifier and the dates the deletion was requested and completed — no names, no email addresses, no content.
• Deleted data may remain in our hosting provider’s encrypted backups for a short period afterwards, until those backups expire on their own schedule. It is not reachable through Shepherd by anyone, including us.
• You can also ask us to do it for you at hello@shepherd-church.com, and we will confirm when it is done.
• If you’re removed from a church, you stop receiving anything from Shepherd, and your pastor can delete what you shared. No email, no reminders, no notifications on your phone, and any invitation still waiting for you is cancelled. When they remove you, your pastor chooses whether to keep what you shared — privately, for them alone — or to delete it. If that church was the only one you belonged to and they delete it, your Shepherd account and login go too.

Authentication and Sessions

Shepherd uses Clerk for authentication. Passwords are never stored by Shepherd — they are managed securely by Clerk. Session tokens expire after a maximum of 7 days, after which you will be prompted to sign in again. Invitation links sent to new ministry leads expire after 7 days.

What We Collect

We collect only what is necessary to provide the service:

• Name and email address (for account creation and notifications)
• Check-in responses submitted through the platform
• Health scores computed from check-in responses (used for dashboard display)
• Reminder preferences and timezone (for email scheduling)
• Billing information (handled by Polar — we do not store card details)

Third-Party Services

Shepherd uses the following third-party services to operate:

• Convex — real-time database and backend infrastructure
• Clerk — authentication and session management
• Resend — transactional email delivery
• Polar — billing and subscription management

Each provider operates under its own privacy policy and data processing terms. We select providers that meet our standards for data security and confidentiality.

Security Concerns

If you discover a security vulnerability or have concerns about how your data is being handled, please contact us directly at hello@shepherd-church.com. We take security disclosures seriously and will respond promptly.

Changes to This Policy

We may update this Privacy Policy as Shepherd evolves. If we make material changes, we will notify church administrators by email before those changes take effect. Continued use of Shepherd after notification constitutes acceptance of the updated policy.

Contact

Questions about this policy or your data? Reach us at hello@shepherd-church.com. We are a small team that genuinely cares about the trust you place in us.