Privacy Policy

Version 1.1  ·  Last updated: June 13, 2026

YouthVolunteer (operating as the National Youth Volunteer Service Award) takes the privacy of students — many of whom are minors — seriously. This policy explains what we collect, why we collect it, who can see it, and how you can control it. We do not advertise to users, we do not sell data, and we collect only what is necessary to operate the certification registry.

1. Who We Are

YouthVolunteer is a U.S.-based non-profit organization that operates a volunteer-hour certification registry for students in grades 6–12. We are in the process of obtaining 501(c)(3) status. Our registered contact for privacy matters is:

Privacy Officer — YouthVolunteer

Email: info@youthvolunteer.org

We aim to respond to all privacy requests within 10 business days.

2. What We Collect

We collect only the information necessary to process and verify volunteer certifications.

Account information

Full name, email address, and password (hashed — we never store it in plain text).

Student certification data

Date of birth, current grade, school name, and phone number (optional). These are collected at the time of submitting a certification, not at registration.

Volunteer service details

Organization name, address, and email; service dates, total hours, activity description, and acknowledgment signatures.

Supervisor information

Name, title, email, and phone of the supervising adult. This information is provided by the student and used solely to send a one-time verification email.

Uploaded documents

PDFs, images, or other files you or your supervisor upload as supporting proof of service.

What we do NOT collect

We do not collect Social Security numbers, government ID numbers, financial information, precise geolocation, or any information beyond what is listed above.

3. How We Use Your Information

  • Process, verify, and approve volunteer hour certification submissions.
  • Send transactional emails: supervisor verification requests, submission status updates, and award approval or rejection notices.
  • Display recognized students on the public registry — name and photo only, at the award levels that require it, and only after explicit consent is obtained (see Section 7).
  • Maintain an audit trail for integrity and fraud-prevention purposes.
  • Comply with applicable laws and respond to lawful requests from authorities.

We do not use your data for advertising, marketing analytics, or any purpose unrelated to operating the registry.

4. Children's Privacy (COPPA)

Special notice for children under 13 and their parents or guardians

YouthVolunteer serves students in grades 6–12, some of whom may be under 13 years of age. The Children's Online Privacy Protection Act (COPPA) imposes specific requirements when we collect personal information from children under 13, and we take those requirements seriously.

What we collect from under-13 students: We collect only the minimum information necessary to process a certification: name, email, grade, and school. Date of birth is collected to determine age. We do not collect any information beyond what is listed in Section 2 from any user, regardless of age.

Parental rights: If your child is under 13 and has created an account, you have the right to:

  • Review the personal information we have collected about your child.
  • Request correction of inaccurate information.
  • Request deletion of your child's account and all associated personal data.
  • Refuse to allow further collection or use of your child's information.

To exercise any of these rights, email us at info@youthvolunteer.org with the subject line "COPPA Request"and your child's registered email address. We will respond within 10 business days and verify your identity as the parent or guardian before taking action.

Note: Deleting an account does not automatically delete approved certification records, which may be retained as part of the non-profit's official records (see Section 9). We will inform you of any records that cannot be deleted and the reason why.

5. Information Sharing & Subprocessors

We do not sell, rent, or share your personal information with third parties for marketing or commercial purposes. We use the following service providers (subprocessors) to operate the registry:

Supabase — Database and authentication

All user data, submissions, and uploaded files are stored on Supabase-managed PostgreSQL servers. Data is encrypted at rest and in transit. Supabase is SOC 2 Type II certified.

Resend — Transactional email delivery

We use Resend to send supervisor verification emails and status notifications. Resend receives the recipient email address and the content of the email. It does not receive other personal data.

Cloudflare — Hosting and CDN

The YouthVolunteer website is hosted on Cloudflare Workers. Cloudflare processes network requests and may log IP addresses and request metadata for security and performance purposes.

We may also disclose information if required to do so by law, court order, or to protect the safety of a user or the public.

6. Public Registry & Recognition

Approved recipients at the Youth Volunteer Service Excellence Award level (500+ hours) and above may have their name listed on the public registry. Recipients at the Youth Service Leader Award level (1,000+ hours) may also have a photo and short bio displayed.

Public display of your name or photo is governed by the consent you provide in the Terms of Service at the time of award acceptance. You may request removal of your name or photo from the public registry at any time by contacting us — this does not affect your certified record.

7. Data Storage & Security

All personal data is stored on Supabase-managed servers (PostgreSQL) with encryption at rest (AES-256) and in transit (TLS 1.2+). Uploaded proof documents are stored in private Supabase Storage buckets and are never publicly accessible — they can only be accessed via signed, time-limited URLs generated at the time of an authorized review.

Access to personal data is restricted to authorized YouthVolunteer staff. Staff access is logged via the admin actions table. In the event of a data breach that affects personal information, we will notify affected users within 72 hours of becoming aware of the breach.

8. Cookies & Tracking

We use session cookies issued by Supabase Auth to keep you logged in. These are strictly necessary cookies — they have no advertising purpose and are not shared with any advertising network. We do not use third-party tracking pixels, behavioral analytics cookies, or fingerprinting techniques.

9. Data Retention

We retain personal data for as long as your account is active and for a minimum of 7 years after your last certification. This retention period exists so that we can respond to verification requests from colleges, scholarship committees, and employers long after a student has graduated.

You may request deletion of your account at any time. Upon verified request, we will delete your account credentials and non-certified personal data within 30 days.

Exception:Approved certification records (the fact that a specific name, school, and hours were certified on a specific date) may be retained indefinitely as part of the non-profit's official records, even after account deletion. We will always inform you of this when processing a deletion request.

10. Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Correction — request that inaccurate data be corrected.
  • Deletion — request deletion of your account and personal data (subject to retention obligations in Section 9).
  • Restriction — request that we stop processing your data in certain ways while a dispute is resolved.
  • Portability — request your data in a machine-readable format.

To exercise any of these rights, email info@youthvolunteer.org with the subject line "Privacy Request". We will respond within 10 business days.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the version number and date at the top of this page and, where appropriate, notify registered users by email. Continued use of the registry after the effective date of a change constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests, contact our Privacy Officer at info@youthvolunteer.org. We take all privacy inquiries seriously and will respond within 10 business days.