Checked in. Never checked out.
Every Sunday, a church check-in system prints a sticker for a child and saves a record. The sticker is in the trash by lunch. In the two vendors' systems we read about, the record has no end date. This exhibit shows what a child's file can hold, who can read it, and how long it outlives the class.
Families a KidCheck administrator can delete. The vendor says deleting a family is "not necessary (or possible)"; check-in history is kept as a historical record.
Childcare and early-education records, including children's names, exposed by one misconfigured database in December 2025. Not a church system; the same kind of file.
The longest Illinois lets anyone keep a biometric identifier, like a face template, after a person's last interaction. Ordinary check-in records have no such clock.
At a glance
- The question
- What does a church's children's check-in file hold, who can read it, and how long does it outlive childhood?
- Strongest evidence
- Two leading vendors' own help pages: one says administrators cannot delete a family and keeps check-in history as a historical record; the other keeps attendance after a profile is deleted, without the name. FACTcompany documentation
- Main uncertainty
- We read two vendors' public help pages, not their contracts or software, and found no reported breach of a church check-in system. Other vendors may work differently.
- Where Infera stands
- This is an argued position, made as fairly as we can. We weigh consent, truthful representation, limited collection and meaningful endings heavily. We frame questions for congregations and families to decide; we do not settle them for any tradition.
- A · The stickerAt one vendor, medical notes print on the name tag, and Not Authorized adults appear with photos in the same file as attendance. FACTcompany documentation
- B · The retention clockIn the two systems we read, history stays after a child leaves. A three-year purge is a rule churches could adopt, borrowed from Illinois's biometric clock, not a legal requirement. INFERENCEmodeled counts
- C · The face at the doorFace recognition at a children's door meets strict rules in Illinois and Texas and few elsewhere. The only usage count we found is one vendor's own 2015 figure. REPORTED
- D · Your nursery policyMost safety comes from a few fields: photos of authorized adults, allergy alerts and a matching code. Most lasting exposure comes from extra fields and long retention. INFERENCEeditorial model
- Both sidesThe file is a shield that gets every child home to the right adult, and a liability that outlives the reason it was kept.
How to read our labels. FACT means we read it at the primary source. It tells you what that source says: a company's own documentation, a study's finding in its own sample, a statute's text. It does not certify that the claim holds everywhere or that a product works as promised. REPORTED is a secondary account. INFERENCE is Infera's reading or model. WATCH is unconfirmed or open. Where a label needs more precision we add a note, such as company documentation, study finding, editorial model or search result.
What does her name tag tell a stranger in the hallway?
Decide what the church collects about her, and what prints on the sticker she wears all morning. The label prints onto her as you choose.
FACT Planning Center's help pages say medical notes, including allergies, print on a child's name tag, and that a manned station shows photos of the child's trusted adults and of people marked Not Authorized to pick the child up. INFERENCE A Not Authorized entry often reflects a custody order or a family conflict; it is among the most sensitive facts a church can hold about a child, and it sits in the same file as attendance.
How long does the record outlive the class?
Each dot is one Sunday she was checked in. Drag her age forward: she walks out of the picture on the wall and into the world. Then choose what the church does with what she left behind.
FACT Planning Center tells churches to inactivate people who leave and to delete only test or accidental profiles; a deleted profile's attendance history stays in Check-Ins for reporting, without a name attached. KidCheck says administrators cannot delete a family and that check-in data is kept as a historical record; a parent can cancel an account, which does not change past records. INFERENCE "Purge after 3 years" borrows the clock Illinois sets for biometrics; no law we found requires it for ordinary check-in records. Dot counts are modeled from the sliders, not taken from any church.
Some churches have tried face recognition at the door. What would protect a child's face?
Switch on recognition and watch the scanner map his face. Then choose a state and read the rules that would apply.
REPORTED In 2015, the vendor of Churchix said at least 30 churches worldwide used its face recognition to spot members who stopped attending and to keep banned people out. We found no current public count of face recognition in US children's check-in. Not legal advice.
Safety needs some data. How little can a church keep and still get every child home to the right adult?
Make six choices. The policy writes itself, and two lines show the trade: what keeps her safe today, and what follows her for years.
Shown as bands. Weights are Infera's judgment, not a measurement. INFERENCE
Is a church's children's file a shield or a liability?
A shield: the data exists to protect children
- Check-in systems were built to stop the wrong adult from walking out with a child. Photos and matching codes are how a volunteer who has never met a family tells a parent from a stranger.
- An allergy on the sticker can save a life when a volunteer hands out snacks. A medical note on paper in a binder cannot be seen in time.
- Not Authorized lists exist because custody orders are real and volunteers need to know.
- Attendance history helps a church answer the hardest question after an allegation: who was in the room, and when.
A liability: the file outlives the reason
- A sticker broadcasts a child's health to anyone in a hallway, and the record of it is never thrown away.
- The systems we read keep history by design. A child who left at 12 can still be a row in a database at 30.
- The most sensitive facts, like custody conflicts, sit in the same file as attendance, managed by volunteers, readable by whoever administers it next.
- The federal children's privacy law generally does not reach noncommercial churches, so protection depends on each church's habits and each vendor's contract.
We read two vendors' public help pages; we did not test their software or read their contracts, and other vendors may work differently. We found no reported breach of a church check-in system; the 140,000-record exposure was a childcare platform.
The Churchix figure is from 2015 and the vendor's own count. We found no current data on face recognition in US children's ministry.
Whether Illinois's biometric law reaches a church is our reading of its broad definition of a private entity, not a court ruling. Washington's 2017 biometric law is noted but not summarized. Nothing here is legal advice.
Retention counts in Room B are a model built from the sliders, not records from any church.
Five questions for parents at the check-in desk
- What prints on my child's sticker, and who can read it in the hallway?
- Who can see the Not Authorized list and the medical notes, and are they volunteers?
- When my child ages out or we leave, what happens to the record, and can I ask for it to be deleted?
- Which company stores this, and what does its contract with the church say about breaches and deletion?
- Is anyone's face, fingerprint or photo being matched by software, and did I sign anything saying so?
This is the third Faith Layer exhibit. The Replayable City measured how long a camera remembers a commute; this applies the same retention math to a nursery. The Afterlife of Your Data asks what happens when a record outlives its person; here it outlives childhood. The Quiet Guest asked who watches a congregation; The Angel at 2 A.M. asked what a church should hold, and what a teenager already tells a machine. Check-In asks what it already holds about the youngest people in the building.
- Planning Center help, "Medical notes and allergies" (notes print on the name tag; read at primary)
- Planning Center help, "Security" (security codes, trusted and Not Authorized people with photos; read at primary)
- Planning Center help, "Inactivate or delete a profile" (history kept; delete detaches it; read at primary)
- Planning Center, "Congregant privacy" (the church controls the data; read at primary)
- KidCheck FAQ, "Delete a family" (admins cannot; history is kept; read at primary)
- Church Law & Tax, "The Children's Online Privacy Protection Act (COPPA)" (applies to commercial operators)
- Church Law & Tax, "Q&A: Is it okay to post videos of kids at church events?" (Nov 2019)
- GovTech, Question of the Day, 29 Jun 2015 (Churchix facial recognition in at least 30 churches)
- IAPP, "Churches using facial recognition to monitor attendance"
- SC Media, "Misconfiguration exposes over 140K childcare center records," 18 Dec 2025
- Securiti, Illinois Biometric Information Privacy Act summary
- Blank Rome, "Meet CUBI: What Companies Need to Know About Texas' Biometric Privacy Law"
- Imagery: Infera image archive, made with Midjourney. The girl is a knitted figure and the boy a printed portrait; neither depicts a real child. Labels, clock, scanner and diagrams are drawn in code from the data.