Privacy Policy

We collect the details you type into your account and the records you create with it — nothing more. We do not run advertising or analytics trackers, we do not build profiles of you, and we do not sell or rent your information to anyone.

When you create an account: your name, email address, and a password. Passwords are stored only as a salted hash — nobody at ServeLocal can read yours. You may optionally add a phone number, short bio, and profile photo.

If you sign in with Google: your name, email address, and profile picture, as supplied by Google. We never receive your Google password.

When you use the site:

• Service hours you log — the date, number of hours, organization, and any description you write.
• Messages you send or receive through the site, including their contents.
• Opportunities you save to your calendar.
• If you register as an organization: your organization's name, mission, description, category, address, and phone number. This information is shown publicly on your organization page.

Automatically: a session cookie that keeps you signed in. It is httpOnly, meaning scripts on the page cannot read it. Our hosting provider keeps standard server logs containing IP addresses for security and troubleshooting.

• No advertising or third-party tracking cookies.
• No analytics or behavioural profiling.
• No payment or financial information — ServeLocal is free and does not process payments.
• No precise device location. Opportunity distances are calculated from the fixed New Haven reference point, not from where you are.

To operate your account and keep you signed in; to show your service hour records back to you; to deliver messages between you and organizations; and to display organization pages publicly, where you have registered one. We use your email to send account-related mail such as password resets, and message notifications if you have those turned on. You can turn notification email off in your settings.

We share personal information with the service providers that run the site, and with nobody else:

• Vercel — hosting and server logs.
• Turso — the managed database where account records are stored.
• Resend — delivery of account emails such as password resets.
• Google — only if you choose to sign in with a Google account.

Other users see what you choose to make visible: your name on messages you send, and your organization's public page if you have one. We will disclose information if legally compelled to, and will tell you unless prohibited from doing so.

Most listings on ServeLocal are not user submissions. Volunteer opportunities are imported from Idealist's public listings, and the nonprofit directory is built from the IRS Exempt Organization register and public Form 990 filings. That information is already public, is about organizations rather than individuals, and is refreshed weekly.

If you represent an organization and want its entry corrected or removed, write to us and we will action it.

Account information is kept until you delete your account. Service hour records and messages are kept while your account is open, because they are the record you created the account to keep. Deleting your account removes your profile, hours, and messages within 30 days. Server logs are kept for a short period by our hosting provider and then discarded.

You can view and edit your profile at any time from your settings page. You can ask us to send you a copy of everything we hold about you, to correct anything that is wrong, or to delete your account entirely. Connecticut residents have these rights under the Connecticut Data Privacy Act, and we extend them to everyone who uses the site.

To make a request, email privacy@servelocal.app. We will respond within 45 days.

Traffic is encrypted in transit. Passwords are hashed, never stored in readable form. Session cookies are httpOnly. That said, no service can promise perfect security, and you should use a password you do not use elsewhere.

ServeLocal is not intended for children under 13, and we do not knowingly collect their information. Many volunteer opportunities welcome younger family members — a parent or guardian should hold the account and sign up on their behalf. If you believe a child under 13 has created an account, contact us and we will remove it.

If we change this policy in a way that affects how your information is used, we will update the date at the top of this page and notify account holders by email before the change takes effect.

Questions about this policy, or about the information we hold, go to privacy@servelocal.app. See also our Terms of Service.