Trust

Security and privacy

A missions gallery holds information that can matter for people's safety: where families live and serve, who they are, and what a congregation gives. This page explains how Missionary Lane protects it, and what your church should do too.

Each church's data is kept apart #

• Every record belongs to one church. The database's row-level security rules decide what each request may read or change, so one church's members can't see another church's data, even by mistake in the code above it.
• Records that belong to a missionary, such as letters, photos and family, are forced to the same church as the missionary.
• Server functions check that the caller is a member of the church before acting, and every query they make is limited to that church.
• Uploaded files are stored under the church's own folder, and only that church's members can add, change or delete them.
• An API key works for one church only.

Two-step sign-in for every staff account #

Everyone who works in the admin signs in with a password and a 6-digit code from an authenticator app. The database refuses member actions from a session that hasn't passed the second step, so a stolen password alone isn't enough. See two-step sign-in.

What's public, and what isn't #

• Each missionary's details have their own switch. Phone, mailing address, monthly support, dates of support and visits, and staff notes start private.
• Drafts and Hidden missionaries never appear in the gallery.
• The AI is told to keep phone numbers and home or mailing addresses out of everything it writes from a letter, and staff approve its work before it appears.
• Photos are re-saved in the browser before upload, which leaves out the location and camera details phones store inside the file.
• All uploaded files are kept in private storage. A visitor's browser can open a file only while the gallery is showing it: the gallery asks for it at your gallery's own /media/ address, which checks first and then hands out a link that works for one hour. Anything else, such as a Draft or Hidden missionary's photos, a letter that isn't published, or a picture you removed, can't be opened by visitors, even with the exact address.
• When you hide a file from the gallery, new visitors can't open it straight away; a link already handed out stops working within about an hour.
• In the admin, signed-in staff see their own church's files through links that also last an hour.
• A suspended church's gallery stops showing, but nothing is deleted.

Restricted missionaries #

A Limited kiosk shows a made-up name and the region only. The database itself leaves out the real name, place, photos, letter text and pages, family, dates, contact details and briefing, so they never reach a visitor's browser. Its web address is a random code, its map pin is only roughly placed, and it never gets a field view or a Support button. The AI writes their kiosk words and narration from the public name and region only, and earlier AI text and recordings are taken down the moment a kiosk becomes Limited. No news briefing is made for them, so their real name and place are never sent to a news search. Their portrait, photos, letter pages and PDFs, and any other file their record uses, are never opened for visitors, whatever their address; only the narration recorded from their restricted-safe words is.

The AI doesn't read a restricted missionary's letters unless an admin turns on Let the AI read restricted missionaries’ letters in Settings. While it's off, staff type the summary, prayer requests and praises themselves, and the letter is never sent to an AI service. When it's on, the letter's pages go to your AI provider with instructions to leave out names and places in everything it writes; read those results before they go public.

Giving privacy #

• A signed-in giver sees only their own gifts. Givers are matched by a verified email address, and someone whose email isn't in the church's records sees nothing until a treasurer matches them.
• Only owners and members with Finance, signed in with two-step sign-in, can see giving records. Editors and admins without Finance can't.
• Restricted missionaries reach givers only by their alias. On the public Our missions page, their support is added together as “Restricted fields”, without names or individual amounts.
• Payment documents are stored in a private place that only Finance members can open. The email-in address is private to your church.
• Missionary Lane never holds or moves money.

Read-only giving connections #

Connections to Planning Center, Breeze, Rock RMS, MinistryPlatform and Pushpay only read gifts. Missionary Lane never creates, changes or refunds anything in your giving platform.

Keys are kept in Vault #

• AI, voice, map and giving-platform keys are stored encrypted in Supabase Vault. They're write-only from the admin: once saved, they're never shown again, not even to the person who saved them. Only server functions read them, when they need to call the service.
• API keys are stored only as a one-way fingerprint and shown once, when they're created.
• Visitors' IP addresses, used only to limit visits and anonymous feedback, are stored as a keyed one-way fingerprint (HMAC-SHA256 with a secret key), never as the address itself.
• On a self-hosted gallery, the desktop app keeps its tokens and passwords in your computer's keychain, and AI and voice keys go straight into your own Supabase project's Vault.

What visitors' browsers contact #

Galleries, the admin, this website and these docs load their code, fonts and flags from Missionary Lane itself, not from code libraries (CDNs) or Google Fonts, so opening a page doesn't give those companies the visitor's IP address. A few things still come from other providers, only where they're used:

• Google Maps on the World Map, and Google's 3D view in the World Tour, only when your church adds its own Google key.
• Map tiles from CARTO and OpenStreetMap on the World Map and World Tour pages, when your church hasn't added a Google key.
• YouTube and Vimeo videos linked in a kiosk. The kiosk shows a play button first, and nothing is loaded from YouTube (in its privacy-enhanced mode) or Vimeo until the visitor presses it.
• 360° field views from Wikimedia Commons, Mapillary, Google Street View or Poly Haven, when a kiosk has one and the visitor opens it.

One thing goes through our servers instead, so the provider sees our server, not the visitor:

• Fonts your church picks that we don't already host. Our server fetches them from Google Fonts once, keeps them in private storage and serves them itself (on a self-hosted gallery, your own Supabase project does this). The fonts of the five starting looks are already hosted.

In the admin, place search goes through our server to Google Maps. Staff browsers contact YouTube for video thumbnails and CARTO when checking a map key. The Privacy Policy lists every provider (section 8.5).

How long data is kept #

• A church whose trial ended or subscription was cancelled is paused for 90 days, then deleted with all of its records and stored files, including payment documents and feedback screenshots. Files are removed from storage however a church is deleted.
• A church 14 days past due is paused for visitors; nothing is deleted.
• Feedback, with any screenshot: 24 months after it was sent or last updated.
• The audit log and billing statements: 7 years. Statements are kept even after a church is deleted.
• Withdrawn or denied self-hosting requests: 24 months.

Owners can download all of the church's data at any time (Export), and givers can download their own giving and delete their My missions account (Your data). The full list is in section 10 of the Privacy Policy.

Your church's part #

• Ask missionaries what is safe to show before you publish them, especially anyone serving somewhere sensitive.
• Give people the least access they need: Editor for content, Admin for settings, Finance only for treasurers.
• Remove members who no longer help, and reset two-step sign-in only after confirming who is asking.
• Keep CSV exports, data exports, API keys and the email-in address private.
• With your own AI and voice keys, use a paid plan and turn off training: a paid Gemini project, ElevenLabs' “Improve the models for everyone” off, the AWS AI services opt-out for Polly, and OpenRouter's data policies. Settings shows this next to each provider.