Privacy

What we collect

• Your phone number. It is how you sign in, and it is verified by a code sent to you by SMS.
• Your name, and anything else you choose to add: an email address, a city, a photo, your preferred language.
• Your password, stored only as a slow one-way hash. Nobody at the platform can read it, including us.
• What you post: business listings, events, job posts, reviews, mutual-aid posts, delivery profiles and any photographs attached to them.
• Your date of birth, so we can be sure members are at least 13. It is never shown to other members.
• The date you accepted these terms and which version, so your agreement is a record rather than an assumption.
• Sign-in sessions, which record the IP address and browser the session was started from, so a stolen session can be recognised.
• Anonymous usage statistics, described below.

How usage statistics work

The platform counts how often pages and listings are viewed. Those records deliberately hold no IP address, no browser string and no cookie.

Visitors are counted using a salted digest that is regenerated every day. Within one day the same visitor counts once; across two days there is no way to tell it was the same person. That is a deliberate limit on what the platform can learn, not an oversight.

Approximate location is recorded as a country, a state and a town. A town with only a handful of visitors is pooled into an unnamed group rather than listed, because in a community this size one reader from a small town is a person rather than a statistic.

When your phone number reaches somebody else

Your number is not published because you have an account. It reaches another member only in these situations:

• You put it on a business listing, which is public by design.
• You register as a delivery driver and tick the box to show it on your card. Left unticked, it reaches a family only at the moment you accept their job.
• You post on the mutual-aid board and choose to share contact details.
• You reply to somebody who asked for help, in which case they can see how to answer you.

What moderators can see

Posts are reviewed before they appear. The people who review them see the account behind a post, including one posted without a name on the mutual-aid board. The board says so where you choose that option, because it would be wrong to let anyone believe otherwise.

Moderation decisions are recorded in an append-only log: who decided, when, and why. That record exists so the platform can answer for its own decisions.

How long things are kept

• One-time verification codes: deleted after one day.
• Expired or revoked sign-in sessions, and the IP address recorded with them: deleted thirty days after they stop working. Sessions you are still using are never touched.
• Usage statistics: deleted after thirteen months.
• Records of failures: when something on the platform breaks while you are using it, what broke is recorded so it can be fixed, along with the address you were on and your account id. The value you typed is removed from it. Deleted after ninety days.
• What you posted, and your account: kept until you remove it or ask us to.

Who else sees your data

The platform does not sell personal information and does not share it for advertising. Data is handled by the services that run the platform: hosting, and the providers that send verification messages and email. Advertising on the platform is sold directly and is not targeted using your personal data.

Your choices

• You can edit or delete what you have posted, and remove a delivery driver profile, from your dashboard.
• You can unsubscribe from the newsletter from any email it sends.
• You can ask for a copy of your data or for your account to be deleted.

Your rights under Minnesota law, and how to use them

The Minnesota Consumer Data Privacy Act gives you the right to know whether we hold data about you and to obtain a copy of it, to correct anything inaccurate, to have it deleted, to receive it in a portable form, and to be told the categories of third parties it has been disclosed to. You may also opt out of targeted advertising, sale of personal data and profiling. The platform does none of those three, so there is nothing there to opt out of.

To make a request, write to the address below and say which of the rights above you are using. We will confirm we received it and answer within forty-five days. If the request is genuinely complicated we may take a further forty-five days, and if so we will tell you why before the first period runs out. There is no charge for a reasonable request.

We have to be able to tell it is you. Where a request concerns an account, we will ask you to make it from the phone number on that account rather than ask you for new identity documents. If we cannot verify it, we will say so rather than answer to the wrong person.

If we refuse a request, we will tell you why, and you may appeal by replying to that refusal. An appeal is reviewed by someone other than the person who decided it, and answered within forty-five days. If the appeal is refused you may contact the Minnesota Attorney General at ag.state.mn.us.

Who to contact

This section is missing a detail nobody has supplied yet, and is left open rather than filled in with something nobody has approved.

This still needs the legal entity behind the platform and a contact address for privacy requests. Everything above describes a process that is real; only the address it is sent to is missing.

Age

Membership starts at 13. Everyone joining is asked for a date of birth, and an account is not opened below that age. We ask for the date rather than asking whether somebody is old enough, because the second is a question with an obvious right answer.

Registering as a delivery driver starts at 18, because a driver arrives at somebody's home.

Your date of birth is never shown to other members. If you believe an account belongs to a child under 13, tell us and we will remove it.