Shepherd Privacy Policy

Last updated: September 14, 2026

Shepherd is a tool used by the leaders of a church to care for its members. Any church can request to be set up on Shepherd. Within each church, only the leaders that church's own administrator has added can sign in, and they see only their own church's information.

What the app stores

• Leaders: name, phone number, role, and notification preferences.
• Members: name, phone number, birthday, address, membership status, assigned leader, and notes entered by leaders.
• Activity: Sunday attendance, a log of calls, messages, and visits made by leaders, and reminder notifications.
• Device tokens: a push-notification token for each phone a leader signs in on.
• Activity log: which leader signed in, and what each leader viewed, added, or changed, with the time and the kind of device used. Only the church's administrators can see it.
• Onboarding requests: when a church asks to join through this website, the church name, contact name, role, email, phone, location, congregation size, and message that were entered, used only to set that church up and reply to the request.

How it is used

This information is used only to help church leaders stay in touch with members: reminding leaders of birthdays, of members who have not been contacted recently, and of members who have missed church. It is never sold, shared with advertisers, or used for any other purpose.

Who can see it

Only the church's own leaders, after signing in with a one-time code sent by WhatsApp or SMS, or with a passkey. Data is stored in a database hosted on Heroku (Salesforce) in the United States and, if the church administrator enables it, an Excel copy is written to the church's own Microsoft OneDrive.

Third-party services

• Twilio sends sign-in codes and reminder text messages to leaders.
• Expo delivers push notifications.
• WhatsApp and the phone dialer are opened on the leader's own device; Shepherd never sends messages on a leader's behalf.
• Microsoft OneDrive (optional) stores an export of the member list, controlled by the church administrator.
• Microsoft Clarity records how the app is used (taps, scrolling, and which screens are visited) so we can improve it. All text and images are masked on the device before anything is sent, so member and leader details are not shared with Microsoft; Clarity keeps these recordings for 30 days. See Microsoft's privacy statement.

Your choices

Members may ask the church at any time to see, correct, or delete the information held about them. Leaders can turn off SMS reminders in Settings and can sign out to stop push notifications on a device. An administrator can remove any leader or member. A church that submitted an onboarding request can ask us to delete it at any time.

Contact

Questions about this policy or requests to remove information can be sent to the church administrator through the app, or to daniel@codconsults.com. See also the support page.