Privacy

In force from 1 October 2026 · CityTree Development, Nashville, Tennessee

Each church's Worksite is its own install with its own database. What is in it belongs to the church. This page says what is stored, where it lives, who can reach it, and the little that ever leaves.

What a church's Worksite holds

People. Names, email addresses, phone numbers, job titles and roles, copied from the church's Planning Center or imported from a spreadsheet. Home addresses are never copied; they are read live from Planning Center when someone opens a person.
The work. Events, trips, projects, tasks, maintenance requests, vendors, rooms, meetings, files people attach, and the messages between staff and volunteers.
Guests. Connect cards read from Planning Center, and the welcome and follow-up sent to them.
Consent and medical notes for trips, which are encrypted with a key that lives outside the database, so a copy of the database alone does not open them.
Sign-in records for three months, delivery records for emails and texts for three weeks, and the passkeys people choose to add.
Never: students' phone numbers. Worksite does not store them, on purpose.

Where it lives

On hosting CityTree rents in the United States, in a folder and database that belong to that church alone. Backups are made nightly and kept for two weeks in the same place. If the church asks, a copy of each night's backup is also placed in a "Worksite backups" folder in the OneDrive of a person the church names, inside the church's own Microsoft 365 — where the church's own administrators control it.

Who can reach it

The church's own people, according to the roles the church gives them. Messages between two people are private to them; there is no administrator override.
Volunteers who never sign in receive one link to one page — the job they said yes to, the form they were asked to fill in — and that page shows only what concerns them.
CityTree, for support and maintenance, with an administrator account the church can see on its People page and remove. We look only when asked to, or when something has broken, and we say so.
Nobody else. We do not sell, rent or share the church's data, and we do not use it to train anything.

What leaves the install

Email goes out through the church's own Microsoft 365, in the church's name. Texts go out through the church's own Clearstream account. Replies come back to the church's Worksite mailbox.
Planning Center is read for people, the calendar and connect cards, and written to only when the church asks Worksite to (a note on a person, a form submission).
Once a day, each Worksite checks in with CityTree's console to confirm its subscription. It sends the church's name, its web address, its build version and a plain-words health report — whether the scheduled jobs ran, whether email is being refused, how old the newest backup is, the PHP version. It never sends a person, a number, a message or a key. The console's answer is signed with the church's own licence key, so nobody else can pause or unpause a church.
Payment details go to Square. We never see or store a card number.
The scheduler that runs each install's nightly and hourly jobs is cron-job.org, which calls a web address and receives nothing back but "done".

The demo

demo.churchworksite.com is Riverbend Church, which does not exist. Everyone in it is invented, nothing it "sends" leaves it, and it is wiped and reset every night.

If something goes wrong

If we ever learn that someone reached a church's data who should not have, we tell that church's administrator within 72 hours of knowing, say what we know, and say what we are doing about it.

Leaving, and deletion

A church can download a complete copy of its Worksite at any time from its Backups page. When a subscription ends, the install becomes read-only after fourteen days and is deleted thirty days after that — database, backups and files — unless the church asks in writing for longer. The console keeps the church's name, contact and billing history as a business record.

This site

churchworksite.com sets no tracking cookies and runs no analytics. The walkthrough form emails us what you type and keeps a copy for us to reply from; nothing else is collected.

Questions, or a request to see or delete what we hold: mail@churchworksite.com.