Ministry Margin
Menu

Ministry Margin Privacy Policy

Effective date: August 15, 2026

Ministry Margin apps are designed to keep sensitive ministry data under your control.

Ministry Margin does not operate a server that collects, stores, sells, analyzes, or advertises against your ministry data. Depending on the app, data is stored on your device, accessed directly from Planning Center, or synced through your private iCloud account. Apple services are used only as needed for the app features described below.

This policy applies to Ministry Margin for Mac, Ministry Margin Directory for iPhone, and Ministry Margin Partners for iPhone. Some features and data sources are available only in certain apps; app-specific differences are noted below.

Planning Center Data

Ministry Margin for Mac and Ministry Margin Directory sign in to Planning Center using Planning Center's secure OAuth sign-in process. These apps do not ask for, receive, or store your Planning Center password. Ministry Margin Partners does not connect to or use Planning Center.

When you connect Planning Center, the apps may read data your Planning Center account is allowed to access. Depending on the app and features you use, this may include:

Ministry Margin may import and cache selected Planning Center data on your device so the app can open quickly, search, display useful views, and remain helpful between refreshes. For example, the Mac app can import a Planning Center People source into the app for browsing, searching, contact workflows, People Map, People Nearby, and prayer-request association.

Ministry Margin Directory reads the Planning Center People records your account is permitted to access, including Everyone and available People lists. The app prepares those permitted directory sources and profile images in protected local storage so it can open quickly, switch sources without another request, and remain useful offline between refreshes.

When Planning Center permits it, Directory also reads household relationships and related People information. Household context may include household names, member names and photos, primary-contact status, child status, birthdates, and a child's gender. A child's gender appears only in the dedicated Household view, not on the child's contact card.

People shown only through household context do not become part of the selected directory source. They remain excluded from Directory-wide search, favorites, People Map, People Nearby, and the global milestone timeline.

Household and child information is kept only in protected app-owned local storage. It is not synced through iCloud, sent to a Ministry Margin server, exposed to AI, Siri, Spotlight, or widgets, included in logs, diagnostics, or exports, or written back to Planning Center.

Planning Center requests go directly between the app and Planning Center. Ministry Margin does not receive a copy of your Planning Center data on a Ministry Margin server.

Some features may send changes back to Planning Center when you intentionally use them, such as creating blockouts or updating supported Planning Center workflow data. Those changes are made through Planning Center using your account permissions.

Planning Center remains the source of truth for people, household relationships, birthdays, anniversaries, and other Planning Center records. Prayer requests and user-created milestones are separate Ministry Margin app data and are never written back to Planning Center.

If Planning Center confirms that a Ministry Margin Directory user's account no longer has permission to access People data, the app removes the affected cached People data, household information, profile images, map coordinates, and person-linked prayers and milestones. General prayer requests remain. If only household access is denied, Directory removes household context while preserving an otherwise valid directory and Planning Center session. A temporary network failure or expired sign-in session is not treated as confirmed People permission revocation and does not trigger this cleanup.

Ministry Margin Partners

Ministry Margin Partners is a separate, app-owned supporter directory for ministry workers who raise support. It does not use Planning Center, and its records and private CloudKit data are not shared with Ministry Margin for Mac or Ministry Margin Directory.

You can add partners manually, choose individual people through Apple's private Contacts picker, or explicitly select Apple Contacts lists to review for import. Every imported person is reviewed before becoming an app-owned Partners record. Partners does not monitor Contacts in the background and never writes changes back to Apple Contacts.

App-owned partner profiles may include contact details, addresses, family and relationship notes, an optional approximate support commitment, prayer requests, interaction events, and the private state used to maintain the Connect rotation. These records are stored locally. When private iCloud sync is enabled, they can sync only through your private iCloud account using the Partners-only CloudKit container. They are not sent to a Ministry Margin server and do not enter the CloudKit data used by other Ministry Margin apps.

Contacts provenance and list identifiers, map coordinates and map-preparation consent, device permissions and preferences, and fictional demo data remain on the device and do not sync through CloudKit.

Partners sends a preferred saved postal address directly to Apple's geocoding service only after you explicitly approve map preparation. It does not request or use your device's current location. Resolved coordinates remain in a protected, device-local cache.

Calls, texts, emails, and directions are handed to Apple system apps. When one of these actions is launched, Partners stores only that the action was initiated: the app-owned partner identifier, the type of action, and the time. It does not store the phone number, email address, postal address, message content, or a claim that a conversation, delivery, or visit occurred.

Partners does not expose partner, prayer, relationship, support, interaction, or Connect data to AI, Siri, Spotlight, analytics, advertising, tracking, or third-party diagnostics. It does not use a Ministry Margin intermediary server.

When an app-owned Partners record is deleted, a minimal deletion record may sync so the deletion can reach another device. These tombstones are privacy scrubbed and do not retain the deleted record's sensitive payload.

Local Storage

Ministry Margin stores app data locally on your device. Depending on the app, this may include cached Planning Center data, selected lists, household context, app preferences, profile images, prayer requests, user-created milestones, app-owned partner records, interaction events, Connect rotation state, and connection state.

Planning Center OAuth tokens are stored securely using Apple's Keychain.

If you sign out of Planning Center in the app, Ministry Margin removes the local Planning Center session and local account-scoped Planning Center caches from that device. This includes the affected app-owned People and map-location caches. In Ministry Margin Directory, it also includes the cached directory snapshot, household context, and profile images. Deleting the app removes its local app data from that device.

Your original church records remain managed by your church in Planning Center.

Prayer Requests

Prayer requests are private Ministry Margin app data. Prayer requests in Ministry Margin for Mac and Ministry Margin Directory are not written back to Planning Center.

You can use prayer requests locally without iCloud Sync. In that case, prayer requests stay on the device where they were created.

If you turn on iCloud Sync, prayer requests sync through Apple's CloudKit service using your own private iCloud account. Ministry Margin for Mac and Ministry Margin Directory can keep their supported prayer data updated with each other. Ministry Margin Partners prayer requests use the separate Partners-only CloudKit container and do not sync with those apps.

Prayer requests are not sent to a Ministry Margin server and are not shared with analytics, advertising services, or Planning Center.

When a prayer request is deleted, it is removed from normal app views. To prevent old offline devices from bringing deleted prayer text back, Ministry Margin may retain a minimal deletion record in iCloud sync metadata. That deletion record is designed not to retain the prayer text, the person's name, or the person's Planning Center ID.

Milestones

Ministry Margin Directory reads birthdays and anniversaries made available by Planning Center as read-only Planning Center data.

You can also create private milestones connected to people in your directory. User-created milestones are Ministry Margin app data stored in protected local storage. They are never written back to Planning Center.

If iCloud Sync is enabled, user-created milestones sync through Apple's CloudKit service using your private iCloud account. The person identifier, name snapshot, milestone kind or title, date, and recurrence are stored as encrypted CloudKit fields. Ministry Margin does not operate an intermediary server and does not receive your milestone data.

When a milestone is deleted, Directory may keep a minimal, privacy-scrubbed deletion record so the deletion can reach another device. That record does not retain the person's identifier or name, the milestone title, its date, or its recurrence.

Apple Contacts

Ministry Margin for Mac and Ministry Margin Directory may help you save Planning Center contact information into Apple Contacts when you choose to do so. Ministry Margin Partners can instead copy people from Apple Contacts into its own app-owned directory through an explicit import.

Ministry Margin Directory saves a selected person to Apple Contacts only when you choose Save to Contacts.

Ministry Margin for Mac may add or update contacts from a selected Membership list when you explicitly choose the Contacts sync feature. The app asks for Contacts permission before using this feature. It uses Apple Contacts locally to add missing cards or update clear matches. Unclear matches are skipped.

Ministry Margin Partners lets you choose individual contacts through Apple's private picker. Its separate contact-list import explains the permission before requesting broader Contacts access, reads detailed information only from lists you select, and asks you to review people before importing them. Imported records become app-owned Partners data. Partners never writes changes back to Apple Contacts.

Ministry Margin does not upload your Apple Contacts database to Ministry Margin, Planning Center, or any advertising or analytics service.

Contact Actions

When you choose to call, text, email, or open directions, Ministry Margin hands that action to the appropriate Apple app or system service, such as Phone, Messages, Mail, Contacts, or Maps. Those Apple services are governed by Apple's privacy practices and your device settings. Ministry Margin Partners stores only the minimal initiated-action event described in the Partners section above.

Maps and Locations

Ministry Margin for Mac and Ministry Margin Directory can prepare People Map and People Nearby from addresses in the Planning Center People source you selected. Directory may begin preparing those locations after a selected directory is available so its maps are ready when opened.

The apps send the needed addresses directly to Apple's geocoding service. Ministry Margin does not receive or log those requests. The resulting coordinates are kept in protected local storage using hashed address and Planning Center organization identifiers; the location cache does not contain raw address text or raw Planning Center organization identifiers.

The apps do not request or use your device's current location. People Nearby compares mapped addresses within the selected People source. Its distance ordering is an approximate straight-line comparison, not driving time and not a recommendation about who should provide care.

Signing out or a confirmed loss of Planning Center People permission removes the affected protected location cache with the other app-owned People data. In Directory, an App Store-confirmed inactive subscription also removes that cache under the Directory subscription cleanup described below. A temporary network, Apple geocoding, StoreKit, or App Store failure preserves the cache and does not trigger destructive cleanup.

Ministry Margin Partners prepares maps only after you explicitly approve map preparation. It sends preferred saved addresses directly to Apple's geocoding service, keeps resolved coordinates in protected local storage, and lets you revoke map consent and remove that local cache in Settings. Partners does not use the device's current location.

iCloud

Ministry Margin Directory provides one optional setting, labeled “Sync prayers and milestones with iCloud,” for its private app-created data.

When enabled, private prayer requests and user-created milestones sync through Apple's CloudKit service using your private iCloud account. Sensitive CloudKit payload fields are stored as encrypted values. Ministry Margin does not operate an intermediary server for this data and does not receive a copy of it.

Turning off iCloud Sync stops future syncing on that device. It does not necessarily erase prayer requests or milestones already stored in your private iCloud data. Where available, delete records in the app while sync is enabled so the deletion can reach other devices, or manage the app's data through Apple's iCloud settings.

Ministry Margin Partners uses a separate private iCloud setting and Partners-only CloudKit container for its app-owned partner profiles, contact details, family and relationship notes, approximate support commitments, prayer requests, interaction events, and Connect rotation state. Partners data does not sync into Ministry Margin for Mac or Ministry Margin Directory.

Purchases and Subscriptions

Purchases and subscriptions are handled by Apple through the App Store. Ministry Margin does not receive your payment card number.

Apple may provide subscription status or transaction information needed to unlock paid features. Apple's handling of payment and App Store data is governed by Apple's own privacy policy.

Eligible new subscribers may receive an Apple-managed introductory free trial when Apple offers one for the selected plan. The purchase screen displays the trial duration and the renewal price and billing period that follow it unless the subscription is canceled.

If the App Store confirms that a Ministry Margin Directory subscription is inactive, the app disconnects Planning Center and removes its OAuth credential and app-owned People, list, contact, household, map-location, and avatar caches.

Saved prayer requests are not automatically deleted when a subscription ends. They remain available in a read-only recovery view for reading, consent-first export, or deletion. Subscription management, purchase restore, and support links also remain available.

User-created milestones are connected to Planning Center people. When subscription access ends and Directory removes access to the associated contact data, milestone information is intentionally unavailable rather than shown without that person context.

A temporary StoreKit, App Store, or network verification failure is not treated as subscription expiration and does not trigger destructive cleanup. The Planning Center connection and local app data are preserved unless the App Store confirms that the subscription is inactive.

In Ministry Margin for Mac, a confirmed inactive subscription gates access to live Planning Center content. The current Mac release does not automatically delete local Planning Center caches, prayer requests, or the Planning Center credential merely because the subscription is inactive. A temporary StoreKit, App Store, or network verification failure is not treated as an inactive subscription.

Demo Mode

Demo mode uses fictional sample data on your device, including fictional milestones and fictional Partners records. Demo mode does not connect to Planning Center, upload demo ministry data to Ministry Margin, sync fictional data through iCloud, geocode fictional addresses, or initiate real contact actions.

Analytics, Advertising, and Tracking

Ministry Margin apps do not include third-party advertising SDKs.

Ministry Margin apps do not track you across apps or websites.

Ministry Margin does not sell personal information.

Ministry Margin does not use church, partner, contact, Planning Center, prayer, milestone, interaction, or support data for advertising.

Apple may provide developers with App Store, TestFlight, crash, or performance information under Apple's own systems and privacy practices. Ministry Margin does not use that information to identify church members, ministry partners, prayer requests, milestones, or Planning Center records.

Website Analytics

The Ministry Margin website uses Cloudflare Web Analytics to understand aggregate visits, page views, referral sources, and website performance. Cloudflare describes this service as privacy-first and cookie-free and states that it does not collect or use website visitors' personal data.

The website analytics beacon does not receive Planning Center records, church, partner, or contact data, prayer requests, or information about how you use Ministry Margin apps. Ministry Margin does not use website analytics for advertising or cross-site tracking.

Logs, Search, and AI Features

Ministry Margin is designed not to place prayer text, milestone data, household or child information, partner or contact data, relationship or support notes, interaction data, pastoral-care data, or Planning Center records into diagnostic logs.

Prayer, milestone, household, partner, contact, relationship, support, and interaction data are not intentionally exposed to Spotlight, Siri, Apple Intelligence, AI features, or widgets.

Household and child information is not included in app-generated exports.

If you manually copy, export, screenshot, email, or share information from the app, that action is controlled by you and may be handled by the service you choose.

Children and Ministry Data

Ministry Margin is intended for ministry leaders and church staff, not for use by children.

Depending on your Planning Center permissions, church data visible in the app may include information about children, families, or household relationships. Directory keeps this context in protected local storage and uses it only in its dedicated Household view. A child's gender appears there only when Planning Center provides it and is not added to the child's contact card.

People visible only because they share a household with someone in your selected directory remain outside Directory-wide search, favorites, People Map, People Nearby, and the global milestone timeline.

Data Retention and Deletion

Local app data remains on your device until you sign out, delete the app, clear the relevant data through app settings where available, or your operating system removes it. Protected map-location caches follow each app's account-scoped cleanup rules described above.

Planning Center data remains controlled by Planning Center and your church's Planning Center account.

Prayer requests and user-created milestones stored only locally are removed when you direct the app to delete them or when the app's local data is removed. Ministry Margin Directory does not automatically delete saved prayer requests when a subscription ends.

Prayer requests and user-created milestones synced with iCloud may remain in your private iCloud data until deleted through the app or managed through iCloud. Minimal privacy-scrubbed deletion metadata may be retained to keep deleted records from reappearing on other devices.

App-owned Ministry Margin Partners records remain locally until you delete them in the app, delete the app, or your operating system removes its local data. Records synced through the Partners-only private CloudKit container may remain in your private iCloud data until deleted through the app or managed through iCloud. Partners may retain minimal privacy-scrubbed deletion metadata so deleted records do not reappear on another device.

Apple Contacts created or updated by Ministry Margin remain in Apple Contacts until you edit or delete them in Contacts.

Ministry Margin Directory's subscription-required recovery view can delete all prayer requests for the currently connected Planning Center organization when you choose that action. The app privacy-scrubs those requests and keeps only the minimal deletion records described above. When iCloud Sync is enabled, the app attempts to sync before and after deletion so other devices also learn the deletion. If iCloud cleanup cannot be confirmed, the app reports that clearly; when iCloud Sync is off, the deletion affects only the current iPhone.

Third-Party Services

Ministry Margin uses these services only as needed for app functionality:

Ministry Margin does not share your church or partner data with third-party advertising networks, data brokers, or analytics services.

Your Choices

You can:

Changes to This Policy

This policy may be updated as Ministry Margin apps change. If the apps add new data practices, this policy and the App Store privacy information will be updated to reflect those changes.

Contact

For privacy questions, contact jonny@ministrymargin.com.