Privacy

Your account

We keep your first and last name, email address, phone number, address, postal code, country and any resolved place when you register.

We record when you agreed to our Privacy Policy; if you gave us your contact details through our earlier sign-up form, that can be the time of that earlier agreement.

For password accounts, we store a password hash rather than your password.

We keep your profile answers and summary to help match you with opportunities.

We also keep earlier versions of your profile as snapshots; deleting your account removes these snapshots.

If you choose Use my location, your device’s position is sent to our server to find your town; we use it for that lookup without saving the position.

If you choose Google or Apple sign-in, we keep the provider name and your provider user ID linked to your account, along with your verified email address.

We also receive a name if the provider supplies one, to help you fill in registration.

If you abandon sign-in, the provider name, your provider user ID, email and name can remain in our sign-in records until a later sign-in flow clears expired records.

Emails we send

We send email confirmation links when you register or change your email address, and an undo link to the old address after a change.

We send password-reset links when you request a reset or restore your old email address.

We email staff replies to your Contact us conversation using your account email address.

We can send opportunity ping emails when you have opted in and a person has approved the ping.

Our mail provider receives the destination address and email content to deliver these messages.

Cookies

We use ifavours_subject to remember your browser, opportunities and account session.

It lasts up to 365 days for an anonymous browser or 30 days for an account session.

It is signed and hidden from page scripts, but its contents are readable, not encrypted.

Its Secure setting depends on our server environment and the web request’s HTTPS origin.

For Google or Apple sign-in, we use __Host-ifav_oidc_google or __Host-ifav_oidc_apple to tie the sign-in steps to your browser.

These sign-in cookies expire after 10 minutes and are cleared when the flow finishes.

For staff access, we also use ifv_ping_admin to check the staff session.

We can keep intake drafts and their attached files on your device in IndexedDB.

We also use sessionStorage in your browser tab for an anonymous intake draft key, skipped-reaction markers and the Earlier today panel setting.

AI help and contact conversations

When our AI helps you, for example reading your profile, finding matches or answering a Contact question, we keep what you wrote and what the AI answered for up to 90 days to check and improve the quality of our answers.

After 90 days we keep only counts and timings, not your words.

This is deleted with your account and included in your data export.

We use Anthropic’s Claude through its API directly to understand what you write and to write your summary.

Anthropic normally deletes these requests and responses within 30 days and does not use them to train its models by default.

Anthropic can keep them longer for safety enforcement or legal requirements.

When configured, we can also use our own model server over a private network for intake text.

AI help can understand answers, write your summary and edits, suggest words, find and rank opportunities for your request, check text for safety, and read opportunity reports.

For AI search, we may send your request and up to 2,000 characters of your profile summary to Anthropic, even if you have no account.

If you are signed in, facts saved from your files are added to it.

When AI safety checks are enabled, text from search, intake answers, account edits, personal reflections and summary edits can go to Anthropic for classification.

We screen intake text for recognizable contact details and leave the display-name answer out of answer prompts, but a name typed in another answer can still be sent.

These checks can miss unusual forms of personal information.

Opportunity report text can go to Anthropic without a screen for private details.

We store opportunity report text, up to 1,000 characters, and delete reports linked to your account when you delete it.

Reports sent without an account are kept under a browser identifier; if that identifier is not linked to your account, deleting your account does not erase them.

We store Contact us messages and attachments with your account.

We check every Contact us message for safety risks, such as self-harm, threats or abuse, by sending its original text to Anthropic without your account identity.

If contact AI help is enabled, we screen message text for contact details before sending it to Anthropic, and check answers against approved information.

You can ask for a person to take over.

Files you add to your profile

We read documents and images to find facts about your skills, experience, certifications, education, languages and causes.

We send the extracted document text or processed image to Anthropic as is, without removing names or contact details first.

We send your saved profile links with each file read.

Leave out documents or images that contain details you do not want sent.

We do not save the original upload to server storage.

We keep the extracted facts, their source snippets and the filename, and use the facts in your profile and matching.

You can remove a file’s saved facts from your profile; deleting your account also removes them.

Summary text you accepted that was written from file facts stays in your summary until you edit it.

Actions and organizer visits

We record match cards being shown, reactions and decline reasons, saved matches, requests, organizer visits, intake steps and email-confirmation events.

This history uses a browser or account identifier rather than your name or email address.

For request text, this action history records only its length; for contact messages, it records how they were handled and any approved answer IDs.

This action history contains no message text, IP addresses or browser details; our separate access logs do record IP addresses and browser details.

Deleting your account removes the history for its browser identifier, including actions before registration.

Activity from other browsers before sign-in or after sign-out is not linked to your account and is not erased with it.

How long we keep information

We keep account details, profile information and contact conversations while your account exists, unless you remove information earlier.

Expired matching request state is removed by a maintenance job in batches, so expiry does not mean immediate removal.

Account deletion has exceptions: we keep staff replies as an accountability record, with their conversation links and reply email removed.

Reply text may still contain information you shared.

Account deletion also leaves abandoned Google or Apple sign-in records until a later sign-in flow clears expired records.

We keep safety records if present, with personal profile fields cleared, and an erased-account identifier to prevent the account’s old browser identity being reused.

The erasure record also keeps the deletion request time, an account-age group and how far you got through registration, intake and matching.

Daily totals by action and by listing stay after account deletion without a person identifier.

We stop pings for the deleted account, but keep the ping journal, including delivery records, your reply choices and the full sent email content.

We have not set a deletion period for these retained records or a backup retention period in this notice.

Our database, including its backups, is hosted by Supabase; the ping journal is a separate file kept on our application server.

Error reports and site analytics

When configured, we use Sentry for error reports.

Our web error reports replace error messages with redacted text and drop user details, request data, stack traces and breadcrumbs.

When browser error reporting is enabled, your browser sends reports directly to Sentry, which receives your IP address and browser details with them.

Our backend error reports also remove messages, user details, request data and breadcrumbs, but keep our own code file paths and line numbers in stack frames.

The reports keep the error type, a general route label, event ID, time and configured release and environment labels.

We disable Sentry session replay and performance tracing.

Our own daily visit counts group page paths, referrer categories and known hosts, campaign tags and whether a browser is new, without storing IP addresses or browser details in those counts.

Our server access logs include client IP addresses, the full requested address with its query, browser details and the referring address; cookie and authorization headers are removed.

We have not set a server access-log retention period in this notice.

Our application error logs can contain text from a failed request, such as a display name.

Cloudflare sits in front of our site; requests that pass through it, including what you type and upload, and your IP address, are visible to Cloudflare.

We use Cloudflare Web Analytics for aggregate page views without analytics cookies.

Your choices and privacy contact

You can download your account data using Download my data while signed in.

The download lists fields left out for security or privacy.

To delete your account, open Account, choose Delete my account and confirm with your password.

Linking Google or Apple sign-in to an existing password account replaces its password.

If you use Google or Apple without a password, sign out, request a password reset and set a password, then sign in with that password before deleting your account.

For privacy questions or help with your data, use Contact us.