jgraham,
Found some more info about the "perceived" data issue. Church policy states that Memership data cannot leave the meeting house.
To the less informed this is perceived as all data. In fact, it is limited to "senstive" data which is only available via the MLS export function. This function is password protected and only available to administrators.
This was not intended to mean non-export function data. This non-export function data is limited to public record information (such as head of household names.)
So the concern about using the non-export function data for this application is a non-issue.