Ward Management System
In effect from 3 September 2026
Ward Management System is used by the leaders of a congregation to look after that congregation. This notice sets out everything it collects, why it collects it, who can see it, and how long it is kept.
Ward Management System is operated on a private server for the congregations that use it. Each ward's own leaders decide who may use their ward's system and what is recorded in it. Enquiries — including a request to see, correct or delete anything held about you — go to support@ysa-lds.org.
This applies to a ward leader signing in to the application.
email), basic
profile (profile) and sign-in
(openid).The email address is the whole point of signing in: it is matched against the addresses your ward has recorded for its leaders, and that match decides what you are allowed to see. An address the ward does not recognise is shown a page saying so and nothing else. Your name and profile picture are used to show who is signed in.
Your email address, and a record that you signed in and when. Your name and picture are held in your own browser for the session and are not stored on the server. No password from your Google account is ever seen or stored — Google performs the sign-in and tells the application only that it succeeded.
This applies only to a member of a bishopric who chooses to connect a calendar to Ward Appointments. It is optional, and nothing here applies to signing in or to members booking appointments.
calendar.events) — used solely to add a booked appointment to
the calendar you selected, and to remove it again if it is cancelled.calendar.readonly) —
used to list the names of the calendars on your account so you can choose
which one to use, and to ask which time ranges on it are busy.Availability is worked out through Google's free/busy query, which returns blocked time ranges — a start and an end — and nothing else. Titles, guests, locations, descriptions and attachments are not returned by it and are not requested. The application does not read your appointments and does not store the contents of your calendar.
| Item | Why | Kept until |
|---|---|---|
| A Google refresh token | So availability can be checked and appointments added without asking you to sign in each time | You disconnect, or revoke access at Google |
| The email address of the connected account | So the admin screen can show which account is connected | You disconnect |
| The identifier of the calendar you chose | So the right calendar is used | You disconnect |
| The identifier of an event the application created | So a cancelled appointment can be removed again | The appointment is deleted |
Disconnecting the calendar from the Appointments screen in your ward's system deletes the stored connection immediately. You can also revoke access at any time from your Google account permissions.
Limited Use. Ward Management System's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is never sold, never used for advertising, never used to train any artificial-intelligence or machine-learning model, and never shared with anyone else.
A ward's system holds what a bishopric needs to look after its congregation. Members supply most of it themselves through their ward's new-member survey.
This information is visible to that ward's leaders, and — where you gave permission — to other members through the ward directory, which is itself behind a question only members of the ward can answer. It is not visible to other wards.
When you book a time with your bishop, the following is recorded: the member identifier your ward already uses for you, your name as it stood at that moment, your email address, which kind of appointment it is, and the time. The name is kept as it was so an appointment can still be described if you later move away. The booking is deleted the day after the appointment was due.
To confirm it is really you, a short code is emailed to the address your ward already holds. Only a scrambled form of the code is stored, never the code itself, and it stops working after ten minutes or five wrong attempts.
A reminder is emailed to you before the appointment. Afterwards your ward's executive secretary is emailed and asked whether the meeting happened, so the ward's own records stay accurate.
| What | Kept until |
|---|---|
| A booking | The day after the appointment was due |
| A verification code | Ten minutes, or five wrong attempts |
| A calendar connection | Until disconnected or revoked |
| A member's details in a ward's system | While they are in that ward, and until its leaders remove them afterwards |
| Server logs | Rotated and discarded routinely; they record requests, not the contents of a calendar |
| Backups | Taken regularly and kept for a few days, then discarded |
Nobody outside your ward. Information is not sold, rented, or given to anyone for their own purposes. Three services are involved in delivering the application, and only that:
Information may be disclosed if the law genuinely requires it. Nothing else.
Congregations include young people, and a ward's records may include members under 18. Only what is described above is held, it is visible only to that ward's leaders, and it is supplied by the member or recorded by their leaders in the ordinary course of looking after the congregation.
If this notice changes in a way that matters, the date at the top changes with it and the wards using the application are told.