Never Paste a Prayer Request Into a Chatbot

Picture a well-meaning volunteer on a Thursday night. The prayer list is a mess: names, hospital rooms, a marriage in trouble, a teenager’s struggle, a job loss. She copies the whole thing into a free chatbot and asks it to organize the list into categories for Sunday’s prayer team.

It works beautifully. And she has just handed some of the most private details in your congregation to a company your church has no agreement with.

Why this matters more for churches

In my day job I lead engineering on software used in healthcare. In that world, patient data is guarded by law, contracts, audits, and real penalties. Nobody pastes a patient record into a consumer chatbot.

Churches hold information that is every bit as sensitive. Often more. A prayer request can include a diagnosis, an addiction, an affair, an immigration worry, or a family secret. People tell us these things because they trust us.

Proverbs puts it simply: “Whoever goes about slandering reveals secrets, but he who is trustworthy in spirit keeps a thing covered” (Proverbs 11:13). Being trustworthy in spirit now includes being careful with where we type.

What happens to what you type

The details vary by company and change often, but a few things are generally true of consumer AI accounts:

• Your chats may be used to train future models unless you turn that off. Some services train by default. Others ask you to choose.
• Your chats are stored for some period, sometimes a long one, even after you delete them from your screen.
• People may review them. Several providers say human reviewers may read conversations for safety or quality.
• Opt-outs only work going forward. Turning off training today doesn’t remove what was already shared.

Our church’s policy tells staff and volunteers to assume that anything typed into a public AI tool could be used to train future models and could, in theory, surface somewhere else. That’s a safe assumption.

The rule

Here is the rule from our policy, nearly word for word: no personally identifiable information about congregants goes into a public or consumer AI tool. That includes names, prayer requests, giving records, counseling notes, attendance data, contact information, and small group rosters.

The only exception is a tool the church accesses through an organizational account, with a signed data processing agreement and appropriate privacy protections. Even then, ask whether you need to.

What to do instead

You can still get the help without the risk:

• Strip the names. “A man in his 50s facing surgery” is enough for AI to help you word a prayer guide.
• Use AI on the structure, not the content. Ask it to design a prayer-list template. Then fill it in yourself.
• Use your church management system for people data. That’s what it’s for, and you likely already have an agreement with that vendor.
• Train your volunteers. Most people who make this mistake simply never thought about it.

Prayer requests are entrusted to us. Let’s keep them where they were entrusted.

I help churches set up AI tools and data practices that protect their people, drawing on years of leading software teams in a regulated industry. If that would help your church, here’s how I work.