Sycomore
Privacy policy
Last updated October 14, 2026
Sycomore is software that churches use to look after their people: who belongs, who came on Sunday, who needs a call, and what is coming up. This policy explains what information Sycomore holds, why, who it is shared with, and the choices you have.
Who is responsible for your information
Your church decides what it records about its members and visitors and uses Sycomore to keep those records. Sycomore stores and processes that information on the church’s behalf and only for the purposes below. Questions about what your church records should go to your church office first; you can also write to us.
What we hold
- People and households: names, phone numbers, email addresses, birthdays, household links, nationality and the church locations and ministries people belong to, as entered by church staff or by members themselves.
- Church activity: attendance and check-ins, event sign-ups, ministry membership and meetings, service plans, announcements, certificates and church reports.
- Care and follow-up: follow-up tasks and the notes church leaders write about contacting someone.
- Messages: the text messages the church prepares and sends through Sycomore, and whether each was accepted for delivery.
- Your sign-in: the email address or mobile number you sign in with, one-time codes (stored only in scrambled form), and session records such as when you last signed in and your device type.
Children’s records are entered by church staff and linked to a parent or guardian. Children do not sign in to Sycomore.
How it is used
- To run the church’s services: check-in, attendance, planning, reports, follow-up and announcements.
- To send the texts and notifications the church sets up, such as birthday greetings, welcome messages and check-ins after a missed Sunday. People who opt out of texts are not sent them.
- To sign you in securely and keep your account safe.
We do not sell personal information, show advertising, or use it to build advertising profiles.
Who we share it with
Only the service providers needed to run Sycomore, each for its own part of the work:
- Cloudflare hosts Sycomore and its database.
- Text In Church delivers the church’s text messages.
- Resend delivers sign-in codes by email, and Twilio by text where phone sign-in is turned on.
- Google Firebase delivers notifications to the Sycomore phone app. It receives a device code for your phone and the notification’s title and text.
- Anthropic helps draft some messages and report suggestions when a church turns this on. For a message it receives only what the draft needs, such as a first name and the church’s name; for reports it receives counts and totals. Church leaders review drafts before anything is sent.
We may also disclose information if the law requires it.
How long we keep it
Church records are kept while the church uses Sycomore, and are removed when the church deletes them or closes its account. Sign-in codes expire after 10 minutes, and sessions end after a period without use.
Your choices
- Delete your account: in the app, open your name in the top corner and choose Delete My Account. This removes your sign-in, sessions, settings and notification subscriptions straight away. Your church keeps its own records about you; ask your church office to change or remove them.
- Stop notifications: turn them off for Sycomore in your phone’s settings, or in the app under Notifications.
- Stop texts: reply STOP to any text, or ask your church to turn off texts for you.
- See or correct your information: ask your church office, or contact us and we will help.
Security
Sycomore uses encrypted connections, one-time sign-in codes instead of passwords, and limits what each person can see to their own role and location. Messaging credentials are stored encrypted.
Changes
If this policy changes, we will update the date at the top and, for significant changes, tell churches using Sycomore.