This notice explains what Astray does with personal information in Astray. It covers two different groups of people, and the difference matters.
Your staff and volunteers have Astray accounts. We hold their information as the business responsible for it.
Your congregation does not have accounts. Their information reaches Astray because your church connected Planning Center and asked us to help you care for them. We hold that information on your behalf and under your instructions. Your church decides what happens to it; we act on your direction. Once your church accepts it, the Data Processing Addendum sets out those terms.
If you are a member of a congregation using Astray and you want to know what is held about you, ask your church. They control it. We will help them answer.
For people with Astray accounts we hold name, email address, the organization and role they belong to, authentication data including multi-factor enrolment, a record of security-relevant actions they take, such as granting another person access, and a record of which versions of the Terms of Service and this notice they accepted, and when.
We use it to run their account, to keep the service secure, and to contact them about the service. We do not send marketing email to account holders without asking first.
What we hold depends on which features you use.
From Planning Center, using the connection you authorized: identifiers, names, contact details, membership and attendance information, group and service participation, and check-in records — limited to the scopes the features you use require.
Written by your team in Astray: pastoral care notes, follow-up flags, next-step assignments, and the people your team has chosen to set aside from attention lists.
Derived by Astray: participation rhythms, attendance drift signals, and congregational health metrics. These are calculations about people, and they can be sensitive precisely because they are inferences rather than facts.
Giving is deliberately narrow. The giving index stores minimal Planning Center identifiers and first and last known gift dates. It does not store donation rows, names, amounts, funds, payment methods, campuses, notes, filenames, or uploaded files. Astray can tell you someone gave for the first time recently. It does not keep what they gave.
Almost none of it comes from the people it describes. It comes from your Planning Center account, from what your team writes in Astray, and from calculations we run over both.
That is worth stating plainly, because it means your congregation has not personally agreed to anything with us. Your church is responsible for having a proper basis to use their information this way, and for telling them how their church uses software like ours.
When your team uses an AI drafting feature, we send the context needed to write that draft to our AI provider, Anthropic.
For a care-related draft that includes the person's first name, why they are on a care list, how long since the last meaningful contact, and the recent pastoral care notes your team has written about them, in full.
We do not send your giving data to the AI provider. We do not send data from one organization to help another. Under our agreement with the provider, your data is not used to train their models.
AI features are optional and can be disabled for your organization. If your team's notes contain things you would not want leaving your systems, turn them off — that is a real decision to make deliberately, not a formality.
We use other companies to run Astray. Each holds only what its job requires, and each is contractually bound to protect it:
Planning Center is not one of them: it is your church's own system, which your church connects and can disconnect.
Beyond those providers, we share personal information only when the law requires it, when we must to protect someone's safety or defend legal claims, or if the business transfers to a new owner — in which case the same commitments follow the data.
We do not sell personal information. We do not share it for advertising. We have no advertising business.
Account information is kept while the account exists.
Congregational information is kept while your organization uses Astray, because it is what makes the product work. When your agreement ends, the deletion terms in the Data Processing Addendum apply if your organization has accepted it. If it has not, your organization may ask us within 30 days for a copy of its congregational information; after that, or once we have provided the copy, we delete it from live systems within 30 days and from backups within 90 days as backups expire.
Security and billing audit records are kept longer, because their purpose is to show what happened after the fact. They hold identifiers and event types rather than pastoral content. The record of which versions of the Terms of Service and this notice each person accepted is kept after their account ends, for the same reason; it holds an account identifier, the version, and the date.
Astray is built so one organization cannot reach another's data, and that boundary is enforced in the database rather than only in application code. Data is encrypted in transit and at rest. Planning Center credentials are encrypted with keys held outside the database. Administrator actions require multi-factor authentication, and sensitive ones require a recent check.
Pastoral care notes are stored in the database and encrypted at rest by our hosting provider. They are not separately encrypted in a way that would prevent us reading them, and you should assume that anyone with administrative access to the database could read them.
Astray is not built to meet the requirements of HIPAA, the U.S. health privacy law; the Terms of Service explain what that means for a church that is covered by it.
No system is perfectly secure. If a breach affects your data we will tell you without undue delay and give you what you need to meet your own obligations.
Astray runs in the United States. If your congregation includes people outside the United States, tell us before you subscribe, because it may change what both of us have to do.
If you hold an Astray account, you may ask us for a copy of your account information, ask us to correct it, or ask us to delete it where we are not required to keep it. Write to info@astray.care.
If you are a member of a congregation, your rights run through your church. They decide; we assist them.
Depending on where you live you may have additional rights, including the right to complain to a data protection authority.
Astray is used by churches that minister to children, so information about children can reach it through your Planning Center check-in and people records. We do not knowingly collect information directly from children, and children do not have Astray accounts.
Your church is responsible for having a proper basis to hold information about minors and for any additional protections your jurisdiction requires.
We will update this notice as Astray changes. For a material change we publish the updated notice at least 30 days before it takes effect, show a notice in Astray, and ask each person with an account to acknowledge it there before they continue after that date.
Paul Swiech, doing business as Astray info@astray.care