Frequently asked questions

Who can see my ward's member data?

Only verified leaders of your ward, each seeing what their calling needs: the bishopric sees everything; the music callings and the ward communication specialist see member names and a broad age group, and nothing else — no contact details, no birthdays, none of the bishopric's work. Member data is encrypted at rest under leaders-only keys derived from your ward leaders' passwords — the bishopric's for everything, and the music and communication callings' for member names alone — and scoped per ward — other wards can't see it, and it's never sold or used for advertising. WardCentral cannot read your data from its database or backups — decryption requires a ward leader to sign in. While a leader is signed in, data is processed in server memory; fully client-side, zero-knowledge encryption is our next step.

Does WardCentral scrape or log into LCR?

No. WardCentral never logs into or scrapes LCR. The companion browser extension only reformats the two reports you are already authorized to view in LCR, and you paste that text into WardCentral yourself. Capture stays within the Church's data terms.

What data is stored?

The three standard reports — Member Directory, Member Callings, and Organizations — and the callings, calling groups, and assignments WardCentral builds from them. We minimize personally identifiable information (PII): sensitive fields (names, phone, email) are encrypted, and continuity data is focused on the bishopric, clerk, and executive secretary.

How does bishopric verification work?

You sign up with an email and password. WardCentral matches your email to a Member Directory record for your ward, checks that you hold a bishopric calling (bishop, counselor, clerk, or executive secretary), then confirms you over two channels: an email confirmation link and a one-time code sent by text message (SMS). Both must succeed before admin access is granted.

What can block activation?

Each blocker comes with a clear message: your signup email doesn't match a directory record; you match but don't hold a bishopric calling; your record is missing a phone or email so a channel can't be reached; or a code or link expired. To bootstrap a brand-new ward, at least one bishopric member needs both an email and a mobile number on Church records.

What happens when the bishopric changes?

The ward persists as a system of record across transitions. Because the minimal continuity data stays with the ward, a new bishopric inherits a working setup instead of rebuilding from a blank spreadsheet, and released leaders' access ends.

Is WardCentral official Church software?