Privacy is part of pastoral care

Protecting sensitive stories is love of neighbor. Choose tools and permissions that keep confidences, and close leftover access when roles change.

By Caleb Brooks · Published September 2026· Editorial standards · Conflict of interest

Field guide page: steps and costs from hands-on church-tech work, written under a pen name. Church names stay private. See how we write and verify.

pastoral-carestewardship

Where do confidences usually leak?

Not in dramatic hacks. They leak in a volunteer group chat, a shared Gmail inbox, a screenshot in a slide deck, or an export emailed “just for this week.” Proverbs warns that a gossip goes around telling secrets (Proverbs 11:13). Modern church tools make that easy without anyone meaning harm.

A greeter forwards a prayer update to the hospitality thread so people can “cover them.” A volunteer emails a full people export to finish a directory. A former media helper still has export rights six months after stepping down. A counseling detail lands in Slack because that channel felt faster than finding the pastoral note. Speed in the wrong place is not care. It is exposure with a spiritual vocabulary.

Privacy is not coldness. It is how a church loves people who trusted you with a hard story on a hard week.

What is a safer pattern?

Separate pastoral care notes from the public email list and the volunteer chat. Limit exports to one administrator and one backup. Write which fields greeters may see. If a benevolence request needs a form, route answers to pastoral staff only. When a tool offers “share with team,” ask which team, and for how long.

Treat church software like filing cabinets with locks, not like a family group text. Hospitality is public. Counseling is not. Guest welcome texts can be warm without including a medical update. Prayer lists can invite intercession without publishing an address, a diagnosis, or a custody detail the household never approved.

Also separate jobs inside the tools you already own. Giving reconciliation does not require counseling notes. Kids check-in does not require benevolence attachments. Ministry leads need their roster, not a whole-church CSV on a laptop that also holds youth photos.

Permission tiers that fit a small church

1. Greeters: search and check-in fields only.
2. Ministry leads: their roster, not whole-church export.
3. Finance assistant: giving records without counseling notes.
4. Pastor or admin: full access with a logged export habit.

Write the tiers on one page and review them when someone changes roles. Most leaks are permission leftovers, not brilliant attackers. Role change should include a five-minute access checklist: remove login, remove export, remove shared-drive folders, confirm the backup owner still works.

If your ChMS (church management system) cannot separate these tiers cleanly, tighten process while you plan a better setup. Do not wait for a perfect product before you stop pasting crisis details into GroupMe.

What should you do this week?

Open your people database permissions and remove full-export rights from anyone who does not reconcile giving or run payroll support. Move crisis prayer details out of the all-staff thread. Tell volunteers out loud: hospitality is public; counseling is not.

Test whether old export accounts still work after last year’s software change. Old doors stay open longer than anyone remembers. Ask one quiet question in staff meeting: if a screenshot of this channel appeared on a parent’s phone tonight, would we still call it care?

For benevolence and counseling, prefer a private form or a pastoral-only note with a delete-by habit after the case closes. Downloads sitting in three inboxes for months are not an archive. They are a delayed leak.

Culture beats the settings panel

You can buy careful software and still gossip in the foyer. You can run a humble spreadsheet and still honor confidences. Settings help. Habits decide.

Train the sentence greeters use: “I can help you start a private request” instead of “tell me everything so I can pass it on.” Train the prayer team to ask permission before any public line. Train media not to show name tags or counseling spaces in hallway video. Train elders that minutes can record decisions without pasting the whole story.

When someone mis-shares, correct it without theatrical shame. Remove the post or forward. Repair with the household. Update the rule on one page. Privacy failures are discipleship moments, not only IT tickets.

What privacy is not

Privacy is not secrecy that hides abuse. Safeguarding reports, mandated pathways, and elder accountability still apply. Protecting a confidence is not the same as protecting a predator. Write that distinction into policy so staff are not improvising under pressure.

Privacy is also not a reason to avoid follow-up. You can assign a meal-train owner without publishing the surgery details to sixty phones. You can text a guest thank-you without storing their hardship story in the same thread as volunteer logistics.

One practice for this month

Pick one channel that mixes public ministry with private care. Split it. Name who may export. Name who may read benevolence. Put a review date on the calendar for the next ministry handoff season.

If you changed software last year, test old accounts this week. If you have never written permission tiers, write the four levels above on a single page and bring them to the next elder meeting. Pastoral care includes closing doors you no longer need.

Common questions

Can we still share prayer requests with the congregation?

Yes, with permission and restraint. Ask what may be shared, in which channel, and for how long. A one-line request with a first name is often enough. Medical detail, addresses, and family conflict usually are not.

Who should be allowed to export the full people list?

Usually one primary admin and one backup who already handle sensitive finance or membership work. Exports should have a written reason and a delete-by date. “Directory project” is not a standing license to keep the file forever.

What do we do if a volunteer already forwarded something sensitive?

Act quickly and calmly. Remove the message where you can. Contact the household. Document what happened. Tighten the permission that made the forward possible. Teach the team the corrected path without turning the volunteer into a public lesson.