Privacy policy

This policy explains what Trellis stores about people, why, who can see it, and how to ask for it to be corrected or removed. Trellis is a platform that churches use to run small groups, giving, communications, serving, worship planning, event sign-ups, kids check-in and Lighthouse AI’s planning. Each church decides what goes into its own account and is responsible for it; Trellis holds those records on the church’s behalf and uses them only to run Trellis for that church. A smaller set of information is Trellis’s own to look after, which Information Trellis is responsible for itself describes.

At a glance

• A church’s records belong to the church. Trellis keeps them for the church and shows each person only what their role allows.
• Trellis never sells information, never advertises, and never combines one church’s records with another’s, even with names removed.
• Silas, the AI in Trellis, reads a church’s records only once an administrator turns him on. He runs on Anthropic’s Claude model, which doesn’t train on what he reads, and a person decides what he drafts.
• Only people 15 and over may sign in. Children appear only as records the church keeps; their care notes are seen by the check-in office and that day’s team, and their pickup codes are deleted the next day.
• To see, correct or remove what’s recorded about you, ask your church. If you can’t, write to support@trellischurch.app.

Who this covers

Three kinds of people appear in Trellis. Staff and leaders sign in and use it: administrators, pastors, office staff, group leaders, coaches, and directors of serving areas. Members, prospects, volunteers and donors are the people the church cares for; most never sign in, and their information is entered by staff and leaders, or comes from what they themselves give, sign up for, or answer. Visitors use the public pages: a church’s giving page, an event’s sign-up page, or the link at the foot of an email. People looking at Trellis visit trellischurch.app, open the demo church, ask for a call or start a church, and Trellis may write to a church about Trellis at the contact details it publishes.

What we store

About everyone who signs in: your sign-in email address, your name, your roles (a person can hold several: an administrator who also leads a group, for instance), and anything you add to your profile: a preferred email for church communication, phone number, address, birthday, neighborhood, a line about yourself, and an emergency contact’s name, relationship and phone. The emergency contact is seen only by you and the church staff. Your birthday and home address are seen by you, the church staff and the leaders of your groups, and Finance sees the address only on a giving statement. If you add a photo, people signed in to your church can see it; children have none. If you use two-step sign-in, Trellis keeps its setup, your recovery codes only as keyed hashes, and when it was turned on or off, when a recovery code was used, and when each sign-in passed it. We keep the time you last signed in and what you did in the app (see the audit log below).

Groups, for small groups: for members and prospects, name, phone, email, address, birthday, household and neighborhood; when they joined and whether they are active; attendance week by week, including a reason when one is given, and the names of guests who came; notes leaders write to remember conversations; prayer requests and whether they were followed up; and for prospects, how they heard about the group, who is following up, and a log of contact. A leader can record checking on someone, and a season when someone needs closer care; only the group’s leaders see these, and the church staff see when someone was last checked on. A member’s request to join a group, with their note, is seen by the church staff and that group’s leaders. Children may be named as part of a household so a leader knows a family.

Giving: for each gift, the amount, date, fund, method and status; the donor’s name and email as given at checkout or on a check; whether a receipt was sent; and, for recurring gifts, the schedule and its status. Card and bank details are entered on Stripe’s pages and never reach Trellis; Trellis keeps only Stripe’s reference numbers. Gifts can be matched to a person’s record so the church can prepare year-end statements.

Communications: the messages the church sends, who they went to, and what happened to each one: sent, delivered, opened, bounced, failed, or marked as spam by the recipient. Opens are reported by the recipient’s mail program when it loads the message and are not always accurate. When someone unsubscribes, the date is recorded and they get no more of the church’s mailings or group leaders’ emails to their groups. Serving reminders, receipts and sign-up confirmations still come, because they are about something the person did, and so does an email someone at the church writes to them alone. Each message records which sender it went out as. Until the church has a domain of its own, it sends from an address for the church on Trellis’s shared sending domain. On its own domain, a sender is the church’s voice, a shared address for a team, or a personal address for one person, which carries that person’s name and the reply address they choose. A group leader who emails their group or one person from Trellis writes in their own name, from a personal address made for them automatically on the church’s domain or, until it has one, from the church’s shared address, with replies going to the email the church has for them; the church’s administrators can see, edit and remove a personal address, and can turn the feature off. When someone replies to a message, the reply comes back to Trellis and is kept with it, where Communications, and a leader whose own address sent it, can read and answer it, and a copy goes on to the sender’s reply address. A person’s record also notes when the church gathered consent for text messages, where it did so, and if they opted out; Trellis does not itself send text messages today.

Serving: for each volunteer, what they said they’re interested in, when they’re available, relevant skills and background, how they came to the church, notes for the office, the date a background check was completed if the church records one, and which areas they serve in. For each service or event, who was asked to serve, whether they said yes or no, a note they left, and whether a reminder was sent.

Worship planning: for each service, its order, songs and keys, who is on each team and where they stand, notes and requests between teams, and files. For the message, the preacher’s draft, which only the person who wrote it reads, the versions the preacher shares with the team, and files on the message, which the team can open once the preacher has shared.

Registration, for event sign-ups: for the person who signs up, their name, email and phone; for each person they bring, their name, the option they chose and, when the church asks, their birthday and grade; answers to the questions the church adds for that event; and, when the event has one, the exact words of the waiver or permission form, the name typed to agree to it and when. The church may mark a question as private, such as allergies or medical needs. Private answers are seen only by the church’s administrators, its Registration role and that event’s managers, are not shown on the registrant’s own page, are kept out of the activity log, and are cleared automatically a set number of days after the event (thirty unless the church chooses otherwise). When an event has a price, the payment is taken by Stripe on the church’s own account: Trellis keeps the amount, the date and Stripe’s reference numbers, never card details, and records it apart from gifts. The person who signs up and the people they bring become records in the church’s People, marked with the event they came from, so the church knows a family the next time. When a sign-up made on the public page uses an email already in People, it is not added to that person’s record or family until the church’s office confirms it is the same family. Downloading a list with private answers is recorded.

Check-in, for children on Sunday: the church’s rooms and the times children are checked in; for each check-in, the child, the room, the family they came with, who checked them in and when, how it came in (found by a volunteer at the station, or with the family’s door pass or card) and which self-serve station made it, if one did, and who picked them up and when, with a reason when a child was released without the pickup stub or a pickup was cleared or a check-in removed, which stays in the audit log with who gave it and when; for each child, a care record of an allergy, a care note and a pickup note, which the church’s administrators, its Check-in role and that day’s check-in team see, and which the activity log records only by which note changed, never by what it says; and each family’s pickup code for the day, which is printed on the children’s tags and the parent’s stub and deleted the day after. Children have no photos in Trellis.

Self check-in: when the church turns on door passes, a parent signed in to Trellis can get a door pass on their phone for that day’s check-in, naming the children it is for; passes are deleted every night. While door passes are on, anyone in a child’s household, or its second household, who signs in sees on Your week the child’s first name, age or grade and allergy, never the care note or the pickup note. A family card, a printed label a family shows at check-in, carries the church’s name, the family’s name and a code, never a child’s name, age, room or allergy. It works until it is cancelled or replaced, by the church’s office, or by the family on Your week, and it is cancelled when an adult leaves the household, along with the door passes that adult made; a cancelled card is kept as a record, not deleted, and Trellis records when a card was last used. A self-serve station, a device the church leaves at the door for families to check in with their pass or card, shows on its screens only the family’s name and the children’s first names and rooms, never allergies, notes or a pickup code, apart from the family’s own tags and stub in the browser’s print preview. For each station, Trellis keeps who set it up and when, when it was last used and last seen, and who turned it off and when, and stores the station’s own secret only as a hash.

The write-up after a meeting: a leader may write a paragraph about how a group meeting went. Trellis keeps it as the meeting’s record. If the church has Silas, which comes with any paid part of Trellis, and one of its administrators has turned it on, Trellis sends the paragraph with the group’s roster names to Anthropic’s Claude model (called Silas in the app), which proposes attendance marks, guests, notes and prayer requests for the leader to check before anything is saved. Anthropic does not train on this data and keeps it only briefly for abuse monitoring under its API terms. Nothing is saved from the reading until the leader confirms it. Silas also reads, on the same terms and under the same switch: a serving director’s write-up of a service or event, with the day’s rosters and schedule, to propose who served, who missed, notes, tasks and seats for next time; what a new volunteer said about their interests, availability and skills, with the church’s list of serving areas, to suggest where they fit; a service being planned (its order, its songs and keys, and the message’s text and big idea), with the church’s song library, to suggest songs for the message, draft each team’s first part or point out what in the order is worth a look; and a one-line brief for a message template, with the church’s name, its groups pastor’s name and its existing templates, to draft or tighten the template’s wording. In each case a person decides what is kept: a write-up's or a volunteer's proposal is written only when a person checks it and confirms it, and the parts and flow notes Silas drafts for a service are saved as drafts, marked as his, until a person keeps or discards them. For each reading Trellis records which church and which person asked, what kind of reading it was and how long it was, to keep Silas’s daily and monthly limits; that record holds none of what was read.

A group study with Silas: when the church has Silas on, a group’s leader, co-leader or office staff can pick resources from the shelf and ask Silas to draft a study for one meeting. Trellis sends Anthropic’s Claude model the PDFs and notes picked, with their titles, the passage or topic, the length of the discussion, anything the leader types for Silas, the group’s stages of life and kind, and the church’s statement of faith if it has one. It does not send the group’s name, its roster, attendance, write-ups or prayer requests. Anthropic does not train on this data and keeps it only briefly for abuse monitoring under its API terms. Nothing is saved until the leader keeps the study. A draft that is not kept is not stored. A kept study belongs to the meeting and is deleted with it; the group’s leaders and office staff can read it, and the group’s members see only its questions, and only if a leader chooses to share them.

Lighthouse AI, which every church has: Lighthouse is for the church’s administrators and staff; group leaders and members never see it. It keeps the head counts staff enter or import (adults, first-time guests, the service and the campus), the choices on its Settings page (the church year it follows, its city and the dates it adds), and what it writes from them: forecasts, insights, suggested series, the series a church plans and the drafts made from them, which stay in Lighthouse until staff hand them on. Each week it reads counts from the church’s other parts, such as attendance, declined asks, email opens, registrations and children checked in; they appear only as figures in the insights it writes. When the church has Silas turned on and pays for More group members or is on Pioneer pricing, and an administrator turns on reading people, Lighthouse reads each night the prayer requests (a person’s own and a group’s) and group meeting write-ups from about the last five weeks, and, if the church has Serving, its serving-day write-ups. Trellis sends each one’s text to Anthropic’s Claude model, without who wrote it or when, to be tagged with up to three themes from a fixed list. Lighthouse keeps, for each week, how many different people or groups raised each theme. To count each person once, it also keeps a coded reference to each request or write-up it has read (so a changed one is read again) and a coded reference to the person or group who wrote it, made from who they are and the week. These codes are used only for that counting, are never shown to anyone, and are deleted once their week leaves the reading window; they are not the words, but they are not anonymous either, since whoever holds the database could work out which person a code stands for. It never keeps the words or anyone’s name. A theme is shown only when at least five people or groups raised it, or the larger number an administrator picks, 10 or 20. When an administrator or someone in Finance turns on reading giving, Lighthouse counts the recurring gifts that were paused or ended and those still active, and compares the last four weeks’ giving with the same weeks a year earlier; it keeps and shows no gift, amount or name. Silas, which writes Lighthouse’s insights and drafts, is sent counts, themes and calendar days, the city as the church entered it, and the dates and service names staff typed with the names of the church’s people taken out; an answer that names one of them is thrown away. A church on free Groups alone sends nothing from Lighthouse to Anthropic: its forecast is made by statistics. Lighthouse posts and sends nothing: a person hands a draft on to the part where it belongs. Anthropic does not train on this data and keeps it only briefly for abuse monitoring under its API terms. Lighthouse’s readings are counted in Silas’s usage record, which holds none of what was read, but not against his daily and monthly limits.

Ask Silas, the help chat: anyone signed in can ask Silas a question about Trellis, whether or not the church has turned Silas on. Trellis sends Anthropic’s Claude model the question and the last few turns of the conversation before it, Trellis’s own help articles, and the page the person is on, their roles and the parts the church has, so the answer comes from Trellis’s help. It never sends the church’s records, which is why it works with Silas off. Trellis keeps each question with the page and the part of Trellis it was asked from, which church it came from, the help articles the answer used, whether the help covered it, and the person’s answer to “Did this help?”, to improve the help. It never keeps the answer or who asked. Each question sent to Anthropic adds a row to Silas’s usage record with no person in it. To keep each person to 40 questions a day, Trellis counts them under a coded key rather than the person’s account, which links to no question, and clears the count within about two days. The conversation itself stays in the browser tab and is gone when the tab closes. When someone uses “Ask a person” to send a question to Trellis’s support, it is kept with their name, email and church, like a problem report, and the conversation is kept with it if they include it. The help center asks people not to type private details about others into it.

About the church: its name, time zone, pastor’s contact details, logo, group names and meeting times, series plans, serving areas and positions, funds, and the files staff and leaders put on the shelf. For billing, the parts it has on, the subscription’s status and dates, and Stripe’s reference numbers. The church’s billing address, any tax ID it enters, and its card details are held by Stripe, not Trellis; the address is used to work out sales tax and appears on invoices.

The audit log: changes to people and households, groups and their rosters, meetings, gifts and funds, lists and messages, serving, event sign-ups, check-in, the church’s settings and who holds which role are logged with who made each one, when, and what changed. Attendance, worship planning and Lighthouse are not logged. Administrators can read the log for their church. It exists so the church can answer “who changed this?” and so mistakes can be undone. When a person is removed, the log keeps that each change about them happened, who made it and when, but no longer what it said.

Technical records: the services below keep standard server logs, which include IP addresses and request times, for a limited period to keep the service running and secure. Trellis itself has no analytics, no advertising and no tracking pixels on its pages. There are two exceptions. One is the open tracking in church emails described above. The other is a pilot of the member pages: when a signed-in person opens Your week or Sunday, Trellis notes the page, the day and whether they came from the Sunday email, once a day, and nothing about the page’s content, their device or their time on it. Only Trellis reads these notes, and they are deleted with the person or the church.

Where it comes from

Staff and leaders type most of it in, usually from what a person shares with their church. Some churches first load their people from an existing directory or spreadsheet. Donors give their name and email at checkout. People signing up for an event fill in the church’s form themselves. Volunteers may sign themselves up from their own page. Members are not asked to create accounts unless the church invites them.

Why we hold it

To do the church’s work: to know who is in a group and who came, to notice when someone has gone quiet and reach out, to pray for people and remember what they shared, to help a newcomer find a group, to take gifts and account for them, to tell people what is happening, to schedule volunteers and remind them, to know who is coming to an event and how to keep them safe there, and to let the church staff support their leaders. Trellis does not sell information, use it for advertising, build profiles across churches, or share it with anyone for their own purposes. The one exception is what the law requires, such as a report of child sexual abuse material to the National Center for Missing & Exploited Children or an order from a court. It never combines one church’s records with another’s, and never uses them, even with names removed, to build statistics, benchmarks or models, or to improve Trellis.

Who can see it

Access follows the role the church gives you, and every role sees one church only. An administrator can limit any role but Administrator and Leader to some of the church’s campuses; it then sees only those campuses’ records, and those every campus shares.

• A group’s leaders see that group: its people, attendance, notes, prayer requests, prospects and shelf.
• A serving area’s directors see the volunteers in that area and the schedule for it.
• Volunteers see their own asks and answers on their own page, the name, email and phone of the leaders of the areas they serve in, and, for a worship service they are asked to serve, its plan and who else is on it. They see nothing else about anyone, apart from a volunteer on the day’s check-in team (below).
• The day’s check-in team (the volunteers the church adds to it, and, in a church with Serving, anyone confirmed to serve in its kids area that day) sees the children checked in to that day’s sessions, their care notes and pickup details, for that day only. To check a family in, they can also find any family with children by name or the last four digits of a phone, and see the children’s first names, ages and allergies and the adults’ first names.
• An event’s managers see who signed up for that event and their answers, including private ones. The person who signed up can see their own sign-up, without private answers, from the private link in their confirmation.
• Staff see every group, every person, every area and every message, apart from a leader’s check-ons and a preacher’s draft. Finance sees gifts, donors and statements. Communications sees lists, messages, everyone’s name and contact details, and which group each person is in so lists can be built by group; it never sees pastoral notes or prayer requests. Communications, Finance and Serving read people’s records but don’t change them. Registration sees every event’s sign-ups, private answers included. In a church that uses Check-in, the same role (then named Check-in, or Registration and Check-in) runs Check-in and sees each child’s care record.
• A child’s family, in a church with door passes on, sees on Your week their own children’s first names, ages or grades and allergies, the rooms they are checked in to that day, and their door pass, never the care note or the pickup note.
• Administrators see everything for their church, manage roles, and can read the audit log.
• Members do not see the app unless invited. Their group leader or the church office is the person to ask about what is recorded.

These limits are enforced by the database itself, not just by the screens you see. A leader who edits a web address to point at another group, or another church, gets nothing back. Details are in the security policy.

Information Trellis is responsible for itself

Some information is Trellis’s own to look after, not a church’s:

• Accounts: the email someone signs in with, when they signed in, and their two-step sign-in setup, so Trellis can let them in and keep the account safe.
• Billing: each church’s subscription, its billing email and Trellis’s invoices.
• What people send Trellis: email to support, problem reports, questions sent with “Ask a person”, and Trellis’s replies.
• Ask Silas’s questions and the member-page pilot, as described above.
• People looking at Trellis: a request for a call (the name, church, email and anything else the person writes), and Trellis’s own notes of the churches it writes to and what was said.
• Security records: server logs, and the counts of sign-in and form attempts.

Trellis uses these to run, secure and support Trellis, to bill churches, to enforce its terms and acceptable use policy, and to meet the law. Trellis also emails a church’s administrators about the account itself: its trial, billing, prices, closing and security. Trellis sends no marketing email to the people in a church’s records. The rights under Your choices apply to this information through support@trellischurch.app rather than through a church.

The church’s part

A church decides what it records about its people and why. It is responsible for telling them, in its own privacy notice, what it keeps and who sees it; for having their permission, or another reason the law accepts, to record it, especially the sensitive kinds below; for recording only what its work needs; and for answering their requests. Trellis follows the church’s instructions, given by how the church sets up and uses Trellis. This policy describes how Trellis handles the records, not the church’s own practices.

Sensitive information

Some of what a church keeps is sensitive, in law and in life: that someone belongs to a church at all, which can show their religion; health details, such as allergies, medical answers on a sign-up and a child’s care note; pastoral notes, check-ons and prayer requests; children’s records; the date of a background check; and giving. Each is seen only by the roles Who can see it names, and the most private, such as care notes, private event answers, check-ons and sermon drafts, by fewer still. None is used for anything but the church’s work. The church decides whether to record them, and is responsible for having the permission the law asks for.

Who at Trellis can see a church’s records

The people who build and run Trellis can reach its database. They look at a church’s records only to help the church when it asks, to fix a problem, to keep Trellis secure, to enforce the terms and acceptable use policy, or when the law requires it. The tool Trellis’s support uses answers only which churches an email address belongs to, their plan, the parts they have on and the person’s roles, never people’s records, notes, gifts or messages.

Requests from courts and the government

Trellis gives a church’s records to a court, the police or another authority only when the law requires it, and only what it requires. It asks the authority to go to the church first, pushes back on a request that asks for too much, and tells the church before handing anything over unless the law forbids it. Reports of child sexual abuse material go to the National Center for Missing & Exploited Children as the law requires.

If something goes wrong

If Trellis learns that a church’s records were seen or taken by someone who shouldn’t have them, it tells the church’s administrators without undue delay, says what happened and what it is doing about it, and helps the church tell its people and any authority the law requires it to tell.

If Trellis changes hands

If Trellis is sold, merged or reorganized, the records it holds may pass to the new owner, who must keep to this policy for them. Trellis tells each church’s administrators before that happens, and a church can download its records and close its account first.

Where it is stored

Trellis is for churches in the United States and is not offered to churches elsewhere. It is run from the United States, and its database and uploaded files are stored there, in Ohio. The services under Who processes it for us handle what they receive under their own commitments.

Who processes it for us

Trellis is a web app and a database. These services handle data on the church’s behalf, under their own security commitments:

• Supabase stores the database and uploaded files and handles sign-in, in its US East (Ohio) region.
• Vercel serves the app to your browser and runs the scheduled jobs the security policy lists, such as serving reminders and clearing private event answers and the day’s pickup codes.
• Stripe takes gifts and event payments on the church’s own connected account and bills the church for Trellis. It sees the donor’s or registrant’s name, email and payment details, and the church’s name, billing email, billing address, tax ID and card. Stripe Tax uses the billing address to calculate sales tax.
• Anthropic reads what Silas is asked to read, when the church has Silas (it comes with any paid part of Trellis) and an administrator has turned it on: a leader’s or director’s write-up with the roster names it needs, a volunteer’s own words with the church’s serving areas, a service being planned (its order, its songs and keys, and the message’s text and big idea) with the church’s song library, a brief for a message template with the church’s existing templates, or the resources a leader picks for a group study (the PDFs and notes, with their titles) with the passage or topic, what the leader types, the group’s stages of life and kind, and the church’s statement of faith. It returns the proposal and nothing else. For a church that has Silas turned on, Anthropic also reads Lighthouse’s weekly counts, themes and calendar days, and, when the church pays for More group members or is on Pioneer pricing and an administrator has turned on reading people, the text of about the last five weeks’ prayer requests and write-ups to tag their themes, as the Lighthouse AI paragraph above says. That switch decides whether Silas reads the church’s records: a church that hasn’t turned Silas on sends none of them to Anthropic, Lighthouse included: without Silas, Lighthouse makes only its forecast, by statistics. Ask Silas, the help chat, is separate and always on: for anyone signed in, Anthropic reads the question and the last few turns before it, Trellis’s help articles, and the page, roles and parts it was asked from, and returns an answer from the help. It never reads the church’s records. Claude also works for Trellis’s own team: it drafts replies to email sent to support@trellischurch.app, which a person reads before anything is sent, and reads problem reports to look for their cause.
• Cloudflare Turnstile checks that a person, not a program, is filling in the public forms the security policy lists. It sees the visitor’s internet (IP) address and browser signals for that check, and Trellis keeps only whether it passed. To stop floods of sign-ups, Trellis itself counts attempts under a keyed fingerprint of the visitor’s IP address and email, never the address or email itself, and deletes the count after about two days.
• Cloudflare R2 keeps Trellis’s weekly backup copies of the database and uploaded files, for 90 days. Each copy is encrypted on GitHub’s servers, where the backup runs, before it is stored, with a key Cloudflare never has, so Cloudflare holds them but can’t read them.
• Resend delivers email: sign-in links, church messages, serving reminders, event confirmations, and a note when a problem you reported is fixed. It sees each recipient’s address and the message, reports back delivery, opens and bounces, and receives replies to church messages and passes them to Trellis.
• GitHub holds Trellis’s code and its list of problems to fix. When someone signed in uses “Report a problem”, the report is filed there with the words they wrote, the page they were on (with the church and record numbers taken out), their browser, their role and how serious it is. Their name, email and church stay in Trellis. The form asks people to leave out private details such as prayer requests. Trellis’s weekly backup and its support-inbox helper run on GitHub’s servers: the backup copies the whole database and every uploaded file and encrypts them there, and the helper reads new email to support.
• Google Workspace holds Trellis’s own mailbox, support@trellischurch.app. What you write to Trellis is kept there. A “Get help” email from inside Trellis carries your church, your sign-in email and role, the page you were on and your browser, so we can answer without asking; you can delete any of it before you send. Every problem report is sent there too, with the person’s church and email, so we see it and can reply, and so is every question sent with “Ask a person” in Ask Silas, with the conversation when the person includes it, and a weekly list of the Ask Silas questions help didn’t cover or that didn’t help, with no church or person.
• Sentry tells Trellis when something breaks. It receives the error, the page it happened on (without the church’s search terms), the code that failed and the kind of browser. For one request in ten it also receives how long each step took, with addresses cut back to their path, and it receives logs of what the app did as ids, counts and outcomes. It is set up to receive no names, email addresses, IP addresses, notes, prayer requests or anything typed into a form, and the screen is never recorded. Its alerts reach Trellis’s team in Slack, carrying only what Sentry received.

Each of these services’ own privacy policy applies to what it holds.

Cookies and storage on your device

When you sign in, your browser keeps a session cookie so you stay signed in. It is removed when you sign out. Trellis also remembers a few display choices in your browser’s storage, such as whether the side panel is open. An Ask Silas conversation is kept in the browser tab’s session storage, so it lasts through a reload, and is gone when the tab closes. A self-serve station keeps one more cookie, trellis_station, which holds the station’s secret. It can’t be read by the page’s scripts, is sent only to that church’s pages, and lasts about 400 days. When someone signs in on a self-serve station with an emailed link, a cookie named trellis_next says only where to go after signing in, and lasts an hour. There are no advertising or tracking cookies. Stripe’s checkout pages set their own cookies for fraud prevention.

How long we keep it

Records stay as long as the church uses Trellis. When a group is removed, its roster, meetings and attendance, notes, prayer requests, kept studies and shelf files are deleted with it; the people themselves stay in the church’s People. Turning a part off keeps its records so it can be turned back on. A leader who stops leading loses access; their profile can be removed on request. If the church removes someone’s access, Trellis keeps their email so they aren’t invited again by mistake. When a church closes its account, it can download its records and files first; its records, uploaded files and email domain are deleted after ninety days, sooner on request, along with any Trellis sign-in that belonged to no other church. Trellis keeps only a note of the church’s name and web address, the sign-in that closed it, and when it closed and was deleted. Gifts and event payments stay in the church’s own Stripe account; Trellis’s invoices to the church stay in Trellis’s. Deleted information leaves Trellis’s backups as they age out, within 90 days. Private answers to event questions are cleared after the event, as described above. Sent messages, who they went to and what happened to each are kept until the church deletes them, which it can do once a message went out more than 60 days ago. Resend keeps its own delivery logs for its own period. The audit log keeps each change for seven years, then deletes it. Ask Silas questions are kept 90 days, then deleted; the counters that keep its daily limits are cleared within about two days. Trellis’s copy of a problem report, with the person’s name, email and church, is deleted a year after the problem is fixed, and a question sent with “Ask a person” a year after it was sent; either is deleted three years after it was sent at the latest. The GitHub issue for a problem, which carries no name or church, stays as the record of the fix. Email to Trellis’s support is kept three years after the conversation ends, or seven years when it is about billing or tax. Supabase and Vercel keep their server logs for up to 30 days, and Sentry keeps error reports for up to 90 days.

Your choices

Anyone can ask the church to see what is recorded about them, to correct it, or to remove it. Ask your group leader, the church office, or the contact the church lists on its pages. Trellis will help a church answer such a request, and if you cannot reach the church, write to support@trellischurch.app. The church will remove information unless it has a genuine need to keep it, such as a giving record required for tax purposes. People who sign in can edit their own profile from “Your profile”. Anyone can stop the church’s mailings with the link at the foot of each one; Communications above says what still comes. A donor who signs in can change or stop a recurring gift from “Your giving”; anyone else can ask the church, which can stop it from Giving.

Before acting on a request, the church or Trellis may ask the person to show it’s them, for instance by replying from the email on record. Requests are answered within 30 days; if more time is needed, the person is told why. Nobody is treated differently for asking. Someone can ask on another person’s behalf with their written permission, and a parent or guardian on behalf of their child. Trellis has no tracking to turn off, so a browser’s privacy signal, such as Global Privacy Control, has nothing to change.

Children

Trellis is not for children. Only people aged 15 or over may sign in, and a church should not invite anyone younger. A child’s name may appear as part of a household so that a leader knows a family, and a parent may sign a child up for an event, giving the details the church asks for, such as a birthday, a grade or an allergy. Those details are for running the event; private ones are cleared afterwards. A church that checks children in with Trellis keeps a care record for each child: an allergy, a care note and a pickup note. These are kept for the church and seen by its administrators, the Check-in role and that day’s check-in team. When the church turns on door passes, the child’s own household, or second household, also sees the allergy when they sign in, never the notes. The activity log records that a note changed, never what it says. The pickup code on a child’s tag is deleted the day after. Otherwise leaders should not record contact details, notes or prayer requests about a child beyond what the parents have shared for the group’s care. Parents can ask for anything about their child to be removed.

Changes

If this policy changes in a way that affects you, Trellis emails each church’s administrators at least 14 days before the change takes effect, and the date at the top changes. A change the law requires sooner may take effect sooner. The current version is always at this address.

Questions

Write to support@trellischurch.app.