Privacy

What Ward Desk is

Ward Desk is a private administrative tool used by the bishopric of the River Heights Ward of The Church of Jesus Christ of Latter-day Saints, and by a small number of other ward leaders, each of whom sees only the part of it their calling needs. It exists to help those people carry out a calling: preparing sacrament meetings, keeping track of assignments, and remembering to look after people. It is not a social network, it is not a public directory, and it has no accounts that anyone can sign up for.

This page describes how it handles information about members of the ward. It is written to be read by the people whose information it is.

Where the information comes from

Member information in Ward Desk comes from the official Church directory exports that the ward clerk and bishopric already have access to as part of their callings. Ward Desk does not collect anything from members directly, and there is no form anywhere in it that a member fills in about themselves.

What it stores

For members of the ward, Ward Desk holds:

• Name, as it appears in the Church directory export — and, where the bishopric has recorded one, the name someone actually goes by and a title used on printed programs. Both are typed in Ward Desk by a person; neither changes the name on anybody’s membership record.
• Household — which family someone belongs to
• Organization — the quorum, class or auxiliary someone is part of
• Participation status — whether someone is still in the ward and involved. This is not imported from anywhere. It is a judgement recorded inside Ward Desk, one household at a time, by the bishopric or by one of three ward leaders who review membership status — the ward mission leader and the presidents of the elders quorum and the Relief Society — and until somebody has looked it says only “not looked at yet”. Ward Desk holds no attendance records and cannot work this out on its own.
• Birth month and day only. Ward Desk stores the day and month so that birthdays can be remembered. It never stores the birth year, and so it does not hold anyone’s age or date of birth.
• Gender, as the Church directory export records it — one of two values, or nothing where the export has nothing. It is held for one purpose: to put young men, young women, adult men and adult women on the birthday list of the organization that looks after them. It is never used to put Brother or Sister in front of a name. The bishopric can correct it, and a correction is kept through later imports.
• A phone number, an email address and a home address — for any member except one who has asked not to be contacted, for whom nothing is held. These have their own section below, because the rules around them — who is held, who may be sent anything, who may be visited — are the strictest thing in Ward Desk.

What it deliberately does not store

• No birth years, and therefore no dates of birth or ages.
• Nothing worked out from an address. A home address is kept exactly as the Church directory prints it, line by line, and is never turned into a city, a postcode or a point on a map.
• No confidential ecclesiastical records. Anything discussed in confidence with a bishop belongs in the Church’s own systems, or nowhere, and never in this tool.
• No financial information, and no donation or tithing records.

Phone numbers, email addresses and home addresses

These are treated differently from everything else in Ward Desk, and the difference is worth reading in full.

Ward Desk may hold a phone number, an email address and a home address for any member except one who has asked not to be contacted. The bishop has cleared this with the Church. The reason is the people nobody has an answer for: holding a way to reach a member whose status is still “not looked at yet” is what lets somebody be sent to visit them. They come from the same Church directory export as everything else, or are typed in by a member of the bishopric; no member is ever asked for them.

An address is kept exactly as the directory prints it, as lines, and is never read into a city, a postcode or a map. It is used by a person going to a house and for nothing else.

Holding a detail is not permission to use it. Ward Desk sends nothing to anybody today. When it can, it may send a message only to a member marked active, and it may send a visit only to a member who has not moved out and has not asked not to be contacted. Both of those rules are enforced by the database itself, not by the people using it: a request to send to anybody else is refused where the information is kept.

The directory import carries these three for everybody in the export except a member who has asked not to be contacted; anything about that member is dropped on the computer the export is read on, before anything leaves it. A detail can also be typed in, or corrected, on that person’s page by a member of the bishopric.

For a member who has asked not to be contacted, nothing is held, and marking somebody “asked not to be contacted” deletes their phone number and email address there and then, whoever makes the change — the ward leaders who review membership status can make it, and they cannot see the details it deletes. The screen that makes the change says so before it makes it. This is not a tidy-up that runs later and might not: the database itself refuses to keep a contact detail for anybody who has asked not to be contacted, so it goes as part of the same change. Every other change of status keeps what is held.

A phone number or an email address can also be corrected, or removed outright, by a member of the bishopric on that person’s page.

Ward Desk keeps a record of who changed what. For contact details that record says only that a detail was added, changed or removed — never what it was. Deleting somebody’s phone number does not leave a copy of it inside the record of the deletion.

They appear on no printed program and on no shared link. They are on one screen in the app, visible to the bishopric and to nobody else: not to the ward leaders who review membership status, and not to the music leader. The database refuses those accounts the contact details, rather than the screens merely not showing them.

Working notes disappear

The bishopric keeps a short list of things to do — ring someone, visit someone, prepare something for Sunday. Some of those notes name a member, because that is what the note is about. They are written by the bishopric and are visible only to the bishopric.

The words do not stay. Thirty days after a task is marked finished, the note itself is deleted: its title, any detail written with it, and the link to the member it was about are all removed. Nobody can read them afterwards, and they are not kept anywhere else — not in a copy, not in an archive, and not in the record Ward Desk keeps of who changed what.

To be exact about what does remain, because it would be easy to overstate this: the bare fact that a task existed and was completed stays, along with who it belonged to and when. What is gone is everything that said what it was about. No member’s name is attached to it any more.

A task nobody ever finishes would otherwise sit there for ever, so those expire too: a task untouched for six months is flagged as stale, and one untouched for a year is deleted outright.

Who can see it

Everybody who can sign in does so with their own Google account, individually invited by name. There is no shared password and no generic login. What each person sees is decided by the database itself, according to their calling:

Anybody who can sign in can report a problem with Ward Desk from the More tab. A report holds their own words, their account, the time, and which screen they were on. Only the reporter and the bishopric can read it; the bishopric replies inside Ward Desk, and the reply is read there. Reports are kept, with the reporter’s name. They are about the app, not about members, and they hold no member record.

The bishopric — the bishop, his counselors and the ward clerk — see everything described on this page.

Three ward leaders who review membership status — the ward mission leader and the presidents of the elders quorum and the Relief Society — see one screen: each household, the names in it, their age group, their calling if they have one, their current participation status, which they can set, and their home address, because they are the ones sending the missionaries. They do not see phone numbers or email addresses, birthdays, speaking records, working notes, programs, or the record of who changed what, and they cannot change an address. The two of them who also lead an organization — the elders quorum and Relief Society presidents — have that organization’s birthday list as well, with the Text and Email buttons described next.

The ward music leader sees the programs and the hymns, and can set the hymns, the musical numbers, and who is leading the music and at the organ. For that she can see members’ names, as the printed program shows them. She does not see the directory, contact details, participation status, working notes, or anything about a member beyond their name.

The auxiliary presidents — Primary, Young Men, Young Women and Sunday School — see one list: the names and birthdays (month and day, never a year) of the members in their own organization, and — for each person on that list and nobody else — a Text button and an Email button. Tapping one opens the president’s own Messages or Mail app with the member’s number or address and the president’s own birthday message filled in; so a president does see the number of a person on their list, in their own phone. The button appears only for a member the ward messages (marked active, or less active and still in touch), and only for people on that president’s own list: the database refuses a link for anybody else, by the same rule that decides who is on the list. Nothing is sent from Ward Desk and nothing is recorded about the message. Which organization an account sees is set by the bishopric on the invitation; the account cannot choose. The elders quorum and Relief Society presidents, who also review membership status, see their organization’s birthdays the same way. The Sunday School list is everybody aged twelve and up who is active or not yet looked at, and shrinks to the active ward as the review is completed.

Nobody else can sign in. A Google account that has not been invited gets no access at all, and creates no record of a member in the app.

There is one exception, and it is deliberate: a single Sunday’s program can be shared as a link. That is described below.

Sharing one Sunday’s program

The bishopric can give one meeting’s program a web address and share it — by message, or by the QR code that is then printed on the paper program. Anybody holding that address can open it without signing in, and can forward it to somebody else.

The address is a long random string. It is not listed anywhere in the app, there is no page that lists shared programs, no way to move from one Sunday’s address to another, and search engines are asked not to index it. It cannot be found by searching for the ward — but it is not a secret once it has been passed on.

A shared program shows the ward name, the kind of meeting and its date; who is presiding and conducting; the order of service with the names on it, hymn numbers and hymn titles; the week’s Come, Follow Me reading; and any announcements that have been marked to go outside the room. Announcements are not marked by default — each one has to be marked, one at a time, and an announcement about somebody’s health or circumstances is not marked and does not appear.

That same mark governs one other thing: a one-page announcements sheet the bishopric can print and pin to the noticeboard, which carries those announcements and the QR code and nothing else — no order of service, no names, no birthdays. It is one mark rather than two because the question behind both is the same one: could this reach somebody outside the room. Anything not marked is still read out and still printed on the paper program.

It shows nothing else. No contact details, no birthdays, no household information, no membership or participation status, and nothing at all about anybody who is not named on that Sunday’s program.

A link can be switched off. When it is, the address stops working immediately — including for anyone who already has it, and for any printed QR code pointing at it. Sharing the same Sunday again creates a different address; the old one does not come back.

What is never done with it

Member information in Ward Desk is never sold, never shared with anyone outside the ward leadership described above, never used for advertising, and never used for any purpose outside ward administration. There is no analytics tracking of members, and the information is not used to train any automated system.

Where it is kept

Ward Desk runs on two hosted services — Vercel, which serves the website, and Supabase, which stores the database. Access to the database is restricted at the database itself, not merely hidden in the app, so that an unauthorized request returns nothing even if it bypasses the screens entirely.

One screen is also kept on a phone. The person conducting sacrament meeting can choose to save that Sunday’s program to their own phone, so that it still opens if the building has no signal. That saved copy contains the meeting as it will be read out: the hymns, and the names of those praying, speaking and conducting.

It is saved only when somebody presses the button to save it, never merely by opening the screen. It is deleted when they sign out, and programs for Sundays that have passed are removed automatically. No other page of Ward Desk is ever stored on a phone.

How long it is kept

Member information is kept only while it is useful for ward administration, and is refreshed from the Church directory rather than being allowed to go stale. A phone number or an email address is deleted the moment a member asks not to be contacted, as described above. When somebody is released from the calling that gave them access, their access to Ward Desk is removed.

Asking for your information to be removed

Any member of the ward may ask to see what Ward Desk holds about them, ask for it to be corrected, or ask for it to be removed. You do not have to give a reason.

Speak to a member of the bishopric, or write to admin@riverheightsward.org. Requests are acted on promptly. Removing someone from Ward Desk does not affect the official Church directory, which is a separate system maintained by the Church.

Current status

As of 12 October 2026, Ward Desk holds directory information for 636 members of the ward, loaded from an official Church directory export. Until this date it held none, and this section said so; it is kept current because a privacy policy that describes the past is worse than one that says nothing.

For each of those members, what is stored is:

• Their name as the export writes it, plus — for the small number of people somebody has entered one for — the name they go by and a title for programs.
• Which household they belong to, worked out from the export and recorded as a grouping — the households are named after the surnames of the people in them.
• An age group only — child, youth or adult. Not an age, and not anything an age could be worked out from.
• Their birth month and day, so that birthdays can be remembered.
• Their calling, if they have one, and the date they were sustained.
• When they last spoke in sacrament meeting, and how many times they have spoken since January 2025, taken from the ward’s own speaking schedule.
• A participation status, where the bishopric or one of the ward leaders who review membership status has recorded one. Every such change is written to the record of who changed what, under the name of the person who made it.
• A phone number and an email address, where the export carried one for a member marked active or a member of the bishopric typed one in — and never for a member who has asked not to be contacted.

Just as importantly, here is what is not stored, and the reason it is worth stating plainly. Ward Desk holds no ages and no birth years — and it does not hold them because the database has no column for either of them to go in. They are removed as the export is read, on the computer it is read on, before anything is sent anywhere. This is not a promise to be careful with that information. It is an arrangement in which there is no such information to be careless with. Home addresses were on that list until October 2026 and are not any more; the paragraph below says so plainly.

Phone numbers, email addresses and home addresses are the things that changed, and this page would be worth nothing if it did not say so plainly. Ward Desk now holds those three for any member except one who has asked not to be contacted. Because there is a column for them, the promise cannot rest on the shape of the database in the way the ones above do, so it rests on the database refusing instead: none of the three can be written for a member who has asked not to be contacted, any already held is deleted the moment that status is recorded, a message may be sent only to a member marked active or “less active — still in touch” (the one answer whose meaning is that the ward is deliberately staying in touch), and a visit is never sent to a member who has moved out or asked not to be contacted. All of those are enforced where the information is kept rather than by the screens that reach it. Nothing is sent from Ward Desk today.

The directory import carries all three for everybody in the export except a member who has asked not to be contacted; anything about that member is discarded on the same computer, in the same run, before anything is sent — just as the ages and birth years are. Nothing is set aside.

Changes to this page

If how Ward Desk handles information changes, this page is updated and the date at the top changes with it.