Privacy Policy

Version 1.2  ·  Last updated: June 14, 2026

YouthVolunteer takes the privacy of students — many of whom are minors — seriously. This policy explains what we collect, why we collect it, who can see it, and how you can control it. We do not advertise to users, we do not sell data, we do not use it for targeted advertising or profiling, and we collect only what is necessary to operate the certification registry. We comply with the Children's Online Privacy Protection Act (COPPA) and applicable U.S. state privacy laws.

1. Who We Are

YouthVolunteer is a U.S.-based non-profit organization that operates a volunteer-hour certification registry for students in grades 6–12. We are in the process of obtaining 501(c)(3) status. Our registered contact for privacy matters is:

Privacy Officer — YouthVolunteer

Email: info@youthvolunteer.org

We aim to respond to all privacy requests within 10 business days.

2. What We Collect

We collect only the information necessary to process and verify volunteer certifications.

Account information

Full name, email address, and password (hashed — we never store it in plain text).

Student certification data

Date of birth, current grade, school name, and phone number (optional). These are collected at the time of submitting a certification, not at registration.

Volunteer service details

Organization name, address, and email; service dates, total hours, activity description, and acknowledgment signatures.

Supervisor information

Name, title, email, and phone of the supervising adult. This information is provided by the student and used solely to send a one-time verification email.

Uploaded documents

PDFs, images, or other files you or your supervisor upload as supporting proof of service.

What we do NOT collect

We do not collect Social Security numbers, government ID numbers, financial information, precise geolocation, or any information beyond what is listed above.

3. How We Use Your Information

  • Process, verify, and approve volunteer hour certification submissions.
  • Send transactional emails: supervisor verification requests, submission status updates, and award approval or rejection notices.
  • Display recognized students on the public registry — name and photo only, at the award levels that require it, and only after explicit consent is obtained (see Section 7).
  • Maintain an audit trail for integrity and fraud-prevention purposes.
  • Comply with applicable laws and respond to lawful requests from authorities.

We do not use your data for advertising, marketing analytics, or any purpose unrelated to operating the registry.

4. Children's Privacy (COPPA)

Special notice for children under 13 and their parents or guardians

YouthVolunteer serves students in grades 6–12, some of whom may be under 13 years of age. The Children's Online Privacy Protection Act (COPPA) imposes specific requirements when we collect personal information from children under 13, and we take those requirements seriously.

What we collect from under-13 students: We collect only the minimum information necessary to process a certification: name, email, grade, and school. Date of birth is collected to determine age. We do not collect any information beyond what is listed in Section 2 from any user, regardless of age.

Parental rights: If your child is under 13 and has created an account, you have the right to:

  • Review the personal information we have collected about your child.
  • Request correction of inaccurate information.
  • Request deletion of your child's account and all associated personal data.
  • Refuse to allow further collection or use of your child's information.

To exercise any of these rights, email us at info@youthvolunteer.org with the subject line "COPPA Request"and your child's registered email address. We will respond within 10 business days and verify your identity as the parent or guardian before taking action.

Note: Deleting an account does not automatically delete approved certification records, which may be retained as part of the non-profit's official records (see Section 9). We will inform you of any records that cannot be deleted and the reason why.

Verifiable parental consent. For students under 13, we obtain verifiable parental consent before the account is activated (a parent or guardian receives a consent request by email at sign-up). Consent to collect and usea child's information is separate from any consent to discloseit to third parties. We do not disclose children's personal information to third parties except to the service providers listed in Section 5 that are integral to operating the registry, and we never disclose it for advertising or any unrelated purpose.

Minors' data is treated as sensitive.Consistent with COPPA and U.S. state privacy laws, we treat personal information collected from minors as sensitive. We do not sell it, share it for cross-context behavioral advertising, use it for targeted advertising, or use it to build profiles. We apply privacy-protective defaults and do not use manipulative "dark pattern" designs.

Retention & security.We retain children's personal information only as long as needed for the purposes described in this policy (see Section 9 for timeframes) and protect it under a written information security program with periodic risk assessments and documented safeguards (see Section 7).

5. Information Sharing & Subprocessors

We do not sell, rent, or share your personal information with third parties for marketing or commercial purposes. We use the following service providers (subprocessors) to operate the registry:

Supabase — Database and authentication

All user data, submissions, and uploaded files are stored on Supabase-managed PostgreSQL servers. Data is encrypted at rest and in transit. Supabase is SOC 2 Type II certified.

Resend — Transactional email delivery

We use Resend to send supervisor verification emails and status notifications. Resend receives the recipient email address and the content of the email. It does not receive other personal data.

Cloudflare — Hosting and CDN

The YouthVolunteer website is hosted on Cloudflare Workers. Cloudflare processes network requests and may log IP addresses and request metadata for security and performance purposes.

We may also disclose information if required to do so by law, court order, or to protect the safety of a user or the public.

6. Public Registry & Recognition

Approved recipients at the Youth Service Excellence Award level (500+ hours) and above may have their name listed on the public registry. Recipients at the Youth Service Leader Award level (1,000+ hours) may also have a photo and short bio displayed.

Public display of your name or photo is governed by the consent you provide in the Terms of Service at the time of award acceptance. You may request removal of your name or photo from the public registry at any time by contacting us — this does not affect your certified record.

7. Data Storage & Security

All personal data is stored on Supabase-managed servers (PostgreSQL) with encryption at rest (AES-256) and in transit (TLS 1.2+). Uploaded proof documents are stored in private Supabase Storage buckets and are never publicly accessible — they can only be accessed via signed, time-limited URLs generated at the time of an authorized review.

Access to personal data is restricted to authorized YouthVolunteer staff. Staff access is logged via the admin actions table. In the event of a data breach that affects personal information, we will notify affected users within 72 hours of becoming aware of the breach.

We maintain a written information security program that governs how we protect personal information — including the personal information of children — covering administrative, technical, and physical safeguards and periodic risk assessments.

8. Cookies & Tracking

We use session cookies issued by Supabase Auth to keep you logged in. These are strictly necessary cookies — they have no advertising purpose and are not shared with any advertising network. We do not use third-party tracking pixels, behavioral analytics cookies, or fingerprinting techniques.

9. Data Retention

We retain personal data for as long as your account is active and for a minimum of 7 years after your last certification. This retention period exists so that we can respond to verification requests from colleges, scholarship committees, and employers long after a student has graduated.

You may request deletion of your account at any time. Upon verified request, we will delete your account credentials and non-certified personal data within 30 days.

Exception:Approved certification records (the fact that a specific name, school, and hours were certified on a specific date) may be retained indefinitely as part of the non-profit's official records, even after account deletion. We will always inform you of this when processing a deletion request.

10. Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Correction — request that inaccurate data be corrected.
  • Deletion — request deletion of your account and personal data (subject to retention obligations in Section 9).
  • Restriction — request that we stop processing your data in certain ways while a dispute is resolved.
  • Portability — request your data in a machine-readable format.

To exercise any of these rights, email info@youthvolunteer.org with the subject line "Privacy Request". We will respond within 10 business days.

11. Your State Privacy Rights

Several U.S. states — including California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Oregon, and a growing number of others — grant residents specific rights over their personal information. Wherever you live, we extend the core protections below to every user.

Our standing commitments to every user, in every state:

  • We do not sell your personal information for money or other valuable consideration.
  • We do not share it for cross-context behavioral advertising and do not use it for targeted advertising.
  • We do not profile you in furtherance of decisions that produce legal or similarly significant effects.
  • We treat minors' data as sensitive and obtain verifiable parental consent before processing the personal information of children under 13.

Depending on your state, you may have the right to confirm whether we process your data; to access, correct, delete, or obtain a portable copy of it; and to appeal a decision we make about a privacy request. Because we do not sell data, share it for targeted advertising, or profile users, there is no such processing for you to opt out of.

California residents may also request the categories of personal information we collect, the purposes for collecting it, and the categories of third parties with whom we share it — all described in Sections 2, 3, and 5. We do not discriminate against any user for exercising their privacy rights. To exercise any state privacy right, email info@youthvolunteer.org with the subject line "State Privacy Request". You may use an authorized agent, and a parent or guardian may submit a request on behalf of a minor. We will respond within 45 days (extendable as permitted by law) and will verify your identity before acting.

12. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the version number and date at the top of this page and, where appropriate, notify registered users by email. Continued use of the registry after the effective date of a change constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests, contact our Privacy Officer at info@youthvolunteer.org. We take all privacy inquiries seriously and will respond within 10 business days.