Privacy: what we keep — and what we never collect

Everything we hold — the complete list

This list is definitive. Nothing may be added to it without a privacy review, and code that would collect something not listed here does not ship.

• Your name, email, or phone number

  Never collected

  No survivor-facing feature needs to know who you are: there are no accounts, no sign-ups, and no identifiers to type anywhere. The partner portal is the one identified surface, and it exists for NGO staff only.

• Your precise location

  Never collected

  The Resource Finder works from whatever place you choose to type. If you pick the per-use GPS option, your position is matched to an area on your own device and is never sent to us — the consent prompt says exactly this before anything happens, and the permission is never requested in advance.

• Your searches

  Never collected

  The resource directory is downloaded once and every search runs on your device, so search terms never reach a server and cannot be logged against anyone. To find coverage gaps, the site counts one thing about searching: whether a settled search found local listings, per country — never the words typed, never who typed them.

• Your escape plan

  Never collected

  Plans exist only on your screen while you build them: nothing is saved on this device, nothing is sent anywhere, and the platform has no plan storage at all today. If optional encrypted plan accounts are ever added, this row must change first — and the design contract is that the server still could not read plan contents.

• A note you send to an organization

  Only if you choose to send it

  A referral exists only because you chose to send one. The record is exactly what you typed — your message and, only if you added it, a way to reach you. Nothing else about you is attached to it.

  How long: Deleted 30 days after the organization closes it, and no later than 180 days after it was sent.

• Safety feedback you choose to send

  Only if you choose to send it

  A feedback message exists only because you chose to send one. The record is exactly the text you typed, encrypted at rest, with nothing attached — no account, no address, no device details. There is deliberately no contact field, so no one can reply or follow up.

  How long: Deleted after the team reads it, and unconditionally no later than 180 days after it was sent.

• Your IP address

  Moments, in memory only

  Rate limiting (abuse defense) counts requests per source for a few minutes. The counter key is a salted hash held only in memory: it is never written to disk or logs, cannot be turned back into an address afterwards, and is never joined to any content.

  How long: Counters expire with their window — 15 minutes at most — and none survive a restart or deploy.

• A profile of your behavior

  Never collected

  Prohibited outright. There is no advertising, no third-party tracker, no session replay, and no analytics identifier to build a profile from.

• Aggregate operational metrics

  Held — staff-facing surface

  Counts and timings only, with nothing about any person in them by construction: how long the server took to answer (as percentiles per endpoint), how often an abuse limiter tripped (which limiter — never who), failed staff sign-ins (the fact, not the account), scrubbed error reports (the code path, never the URL you visited or anything you typed), and product usage counters from a fixed vocabulary — searches that found or missed local listings per country, plans finished, printable documents generated per type, page counts per language, and how fast the Leave button finished, in speed buckets. Every counter is a name and a count; there is no identifier to join any of it to a person. These exist so we can tell the platform is up, healthy, and actually helping — without watching anyone use it.

  How long: Kept indefinitely — there is no personal data in them to expire.

• Your language choice

  Never collected

  The language picker applies to the current tab only: the choice lives in this tab's session storage on your device — never in a cookie or a URL — and disappears when the tab closes or you press Leave. In aggregate, the site counts page views per language so translation effort follows real need; the counts say which languages are used, never by whom.

• Partner (NGO) staff accounts

  Held — staff-facing surface

  Name, work email, role, organization, and authenticator enrollment. Partner staff are accountable for the accuracy of the shelter and hotline data survivors act on, so theirs is the one identified surface.

  How long: Kept for the life of the partnership. Deleted immediately on request; backup copies are gone within 30 days.

• Administrative audit log

  Held — staff-facing surface

  A record of who changed what in the resource directory — partner and platform staff actions only, never survivor activity. It is what lets us answer "who edited this shelter's address?" if data is tampered with.

  How long: Kept while the partnership is active, then for 2 years after an organization is offboarded, then deleted.

How long anything lasts

Every window below is enforced by the platform itself, not by a policy someone has to remember to follow.

Anonymous browsing (everything survivor-facing)Nothing outlives your tab

There is no server-side session to expire. Session-scoped state (like a language choice) lives on your device and is wiped by closing the tab or pressing Leave.

Rate-limit counters (abuse defense)15 minutes at most

Salted-hash counters in memory only; each expires with its window and none survive a restart or deploy.

Notes you send to organizations (referrals)30 days after closing — 180 days at most

Deleted automatically once the receiving organization closes them, and unconditionally after the maximum window even if never closed.

Anonymous safety feedback you choose to send180 days at most

Exactly the text you typed, encrypted at rest, with nothing attached that could identify you — which also means we cannot reply. Read by platform staff, then deleted after review or automatically when the window passes.

Partner portal sign-in sessions8 hours, or 30 idle minutes

Staff sessions end at whichever limit comes first and are also revoked immediately on sign-out or offboarding.

Partner staff accountsLife of the partnership

Deleted immediately on request — see “Deleting an account” below.

Administrative audit logPartnership + 2 years

Staff actions only, never survivor activity. Entries for an offboarded organization are deleted once the accountability window passes.

Aggregate operational metricsIndefinite

Counts and timings only, with no personal data by construction: response-time percentiles, abuse-limiter trip counts, and scrubbed error reports. The logging schema cannot carry free text, URLs, or identifiers, so there is nothing personal to expire.

BackupsDeletions propagate within 30 days

When something is deleted, backup copies follow within this window. Deletion means deletion.

Deleting an account

Survivors have nothing to delete — there is no account to begin with. For partner-organization staff (the one kind of account that exists): deletion is available on request and from inside the portal, takes effect immediately, and propagates through backups within 30 days. One honest exception, stated here rather than discovered later: the administrative audit log — the record of who changed shelter and hotline data — keeps its entries for its own published window above, because accountability for that data protects the people who rely on it.

Your rights

Where privacy laws like the GDPR apply, you have the right to see, delete, and take with you any data about you. We honor those everywhere — and for almost everyone the honest answer to “show me my data” is that there is nothing to show. Our own standard is stricter than any regulation: collect almost nothing, so there is almost nothing to request, breach, or subpoena.

Rules we design by

• Every feature is reviewed for the traces it creates — on your device and on our side — before it is built.
• Nothing is saved on your device by default. The few session-scoped conveniences (like a language choice) vanish when the tab closes or you press Leave.
• Where we do ask permission — using your device's location once, sending a note to an organization — the request says plainly what is stored, what is not, and what we cannot protect against. No pre-checked boxes, no pressure.
• Operational numbers we may keep about the service are aggregate counts and timings with no per-user identifiers — never profiles, never histories.

What this page cannot promise

A privacy policy controls what we do. It cannot control what your device, your browser, your network, or a person with access to any of them can see. The Learn section explains those risks honestly — including the ones no website can remove.

This policy was last reviewed on 2026-07-16. It changes only through privacy review, and this page always shows the current version.