Product rules · enforced in code

Your pastor sees the body. Never the person.

Version 1.0.0 · effective 23 August 2026

Versioned — every change logged below

FaithPulse asks people to record honest things: what they are wrestling with, what they prayed, where they are drifting. A church leader who could read that would be handed something no leader should hold, and a member who suspects it is possible will simply write nothing true.

So these are not settings, and not a preference a plan upgrade unlocks. They are product rules, enforced in code, and this page is versioned so a change to them is a change you can see.

A church leader can see

How many people opened this week's sermon, and how many acted on it
Which books of the Bible the church has preached, and which it hasn't
Prayer themes, aggregated — never a prayer, never a name
Whether a group is meeting, and whether it is growing
Reading and recall participation across the congregation

A church leader can never see

Your journal, your Walk answers, or anything you told the Shepherd
Your Spiritual Vitality Score — or anyone else's
A named list of people the system considers to be struggling
Which member a number refers to, in any aggregate on this page
Anything you marked private, under any circumstance, including a data request

The floors

Every aggregate has a minimum cohort size. Below it the figure is withheld entirely — not rounded, not blurred. Rounding a cohort of three is still a cohort of three, and a number a leader can decode is worse than a blank, because it looks like disclosure and behaves like a leak.

Deficit signals

Drift, inactivity, tier distribution, pillar averages, pastor-nudge segments — anything that could point at one person's struggle.

Collective signals

Circle-level and positive participation figures, where the worst case is knowing a small group is engaged.

The two numbers differ on purpose. “Eleven people finished the reading” names nobody however small the church. “One person has drifted” in a group of two is an accusation with an address.

How this is kept true

A promise about a number is worth the code behind it. These floors live in a single file, lib/formation-privacy, and a build check fails if any other part of the system declares its own copy — so a new feature cannot quietly pick a weaker number while this page still says 10.

If a floor changes, the version at the top of this page changes with it and a row appears below. That is the difference between a commitment and a claim.

Changelog

Version	Date	Change
1.0.0	23 Aug 2026	First published. Floors consolidated into a single enforced source and stated here: 10 for deficit signals, 5 for collective signals.

What this page is not

It is not the whole privacy policy — see Privacy for how data is stored, retained and deleted, and Terms for the agreement itself. This page covers one question only, because it is the question every thoughtful pastor and every cautious member asks first.