A children’s register is not ordinary information, so this page sets out how Grained looks after it. Everything below describes how the service works today. No online service can promise that nothing will ever go wrong, and we would rather be straight with you about that than make a claim we cannot stand behind.

Passwords and signing in

We do not store your password in readable form. That means nobody at Grained can look it up or tell it back to you — if you forget it, you reset it and choose a new one.

If someone tries several wrong passwords in a row on an account, that account is locked for a short period, so guessing one password at a time is not a practical way in.

Joining your church on Grained

When your church adds a teacher or a parent, that person receives an email with a link to set their own password, and a temporary code they can use instead if the email does not reach them. Either way they choose their own password before they can see anything.

Those password links — for setting up an account or resetting a forgotten password — expire after 48 hours and can only be used once. An old email sitting in an inbox is not a spare key.

Each church’s records stay separate

Access controls restrict the people in a church to that church’s own records. Which church you belong to is taken from your signed-in session on our servers, not from anything typed into a web address, and it is applied when the information is looked up rather than by hiding things on screen. We keep automated tests covering this, which run every time the code changes.

Who can see a child

Children do not have logins. A child in Grained is a record that responsible adults keep.

• Parents see their own children — the ones linked to their account.
• Teachers see the children in the classes they have been assigned to. That limit applies to the registers and the reports alike, not just to what appears on screen.
• Church administrators see their own church, which is what allows them to answer a parent’s question and to keep the roster right.

Families using Grained at home without a church have their own separate space. It is not joined to any church, and a church cannot see into it. These family accounts are invitation only at the moment, while we pilot them with a small number of families.

When someone at Grained needs to look

Occasionally we need to open a church’s workspace to help — usually because an administrator is locked out, or something needs fixing. Grained has a support-access feature for exactly this, and when it is used the record is written before access is granted: who opened it, which church, when, and the reason they gave. That support session expires by itself after an hour, and the record stays.

If you would like to know whether support access has been used on your church’s account, ask us and we will tell you. There is more about how we handle this on the children’s privacy page.

Your connection

Grained is served over an encrypted (HTTPS) connection, and an ordinary unencrypted request is redirected to the secure one.

What we do not do

• We show no advertising and carry no advertising trackers.
• We do not sell or rent your information, and we do not share records between churches.
• We do not build profiles of children or make automated decisions about them.
• We do not store card numbers. Grained’s own records of an event registration or a donation hold the amount and who it was from, never card details.

Telling us about a security problem

If you think you have found a security problem, please email contact@grained.org with enough detail for us to look into it. We review reports promptly, we will not hold it against anyone who reports something in good faith, and we will give you an update where we can.

Please do not include passwords, password-reset links, or any child’s personal information in your message — a description of what you found is enough, and we can take it from there.

If your church needs more

For a safeguarding review, a data protection assessment, or your own records, write to contact@grained.org and we will answer your questions properly.

Last updated 24 September 2026.