Information We Collect
We collect information you provide directly to us when you register for services, including your name, email address, phone number, date of birth, address, and demographic information. This information is used solely to connect you with appropriate services and to ensure our platform meets the needs of the communities we serve.
How We Use Your Information
Your information is used to:
- Match you with appropriate local resources and services based on your location and needs
- Communicate with you about your service requests and referrals
- Enable our care team to provide personalized, affirming support
- Improve our platform and the quality of services we offer
- Comply with applicable legal obligations
Information Sharing
We do not sell your personal information under any circumstances. We share information only with the service providers you are matched with, and only with your knowledge and consent. All partner agencies are vetted and agree to our privacy standards before joining our network.
Data Security & Encryption
The security of your personal information is a top priority. We use multiple layers of protection to keep your data safe:
- AES-256-GCM Encryption at Rest: All sensitive personally identifiable information (PII) stored in our database is encrypted using AES-256-GCM, the same standard used by financial institutions and government agencies. This includes your phone number, home address, date of birth, and security answers. Each field is encrypted individually with a unique initialization vector, meaning even identical values produce different encrypted outputs.
- Authentication via Amazon Cognito: Your login credentials are never stored in our database. All passwords and authentication tokens are managed exclusively by Amazon Cognito, a HIPAA-eligible identity platform operated by Amazon Web Services. Cognito handles password hashing, multi-factor authentication readiness, and secure token issuance.
- Encrypted Transmission: All data transmitted between your browser and our servers is protected using TLS (HTTPS). We do not serve any content over unencrypted HTTP.
- Session Security: Your login session uses HTTP-only, secure cookies that are not accessible to JavaScript, protecting against cross-site scripting (XSS) attacks.
- Cloudflare Turnstile: All forms on our platform are protected by Cloudflare Turnstile, a privacy-preserving bot detection system that prevents automated abuse without requiring you to solve puzzles or CAPTCHAs.
What Data Is Encrypted
The following fields are encrypted in our database and can only be read by authenticated system processes with access to the encryption key:
- Phone number
- Street address (lines 1 and 2)
- City
- ZIP code
- Date of birth
- Security answer
- Account PIN
Non-sensitive fields such as your name, email, state, county, gender, race, and income level are stored unencrypted to enable matching and reporting functions.
Demographic Information
Demographic information you provide — including gender, sexual orientation, race/ethnicity, and income level — is entirely optional. This information helps us match you with affirming, relevant services and helps us understand and advocate for the communities we serve. It is never shared with third parties without your explicit consent.
Data Retention
We retain your information for as long as your account is active or as needed to provide services. If you request deletion of your account, we will remove or anonymize your personal information within 30 days, except where retention is required by law.
Unsubscribing & Account Deletion
If you no longer wish to receive newsletter or marketing emails from us, you can unsubscribe at any time by visiting /privacy/unsubscribe. Unsubscribing removes your email address from our newsletter and marketing mailing lists and adds it to our internal "do not send" list.
Please note that transactional emails — such as account verification messages or password reset emails — are not marketing materials. Unsubscribing from marketing email does not stop these account-related messages while your account remains active.
If you are a registered client or agency, you can permanently delete your entire account and all associated data at any time. Simply log in, go to your Dashboard, open the Edit Profile page, and click the Delete Account button. This will de-activate your account, remove your sign-in credentials, unsubscribe your email address from all mailing lists, and add your email address to our do-not-send list.
Your Rights
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information via your profile page
- Request deletion of your personal information
- Withdraw consent for optional data processing
- Receive a copy of your data in a portable format
To exercise any of these rights, please contact us.
Third-Party Services
Our platform uses the following third-party services, each with their own privacy practices:
- Amazon Web Services (AWS) — Cloud infrastructure, identity management (Cognito), and email delivery (SES). AWS is HIPAA-eligible. AWS Privacy Policy
- Cloudflare — Bot protection (Turnstile) and CDN services. Cloudflare Privacy Policy
- Google Fonts — Typography. Font files are loaded from Google's servers. Google Privacy Policy
Cookies
We use a single session cookie to maintain your login state. This cookie is essential for the platform to function and does not track you across other websites. We do not use advertising cookies or third-party tracking cookies.
Children's Privacy
Our services are not directed at individuals under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of significant changes by email and will update the "Last updated" date at the top of this page.
Contact
If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us.