Privacy Policy

1. Information we collect

Information you give us

• Account information. If you create an account to save listings, we collect your email address, a password (stored only as a one-way hash — we cannot see it), and your age. You may optionally tell us the organization you work or volunteer with. We also record the date you accepted our Terms and whether you opted in to email updates.
• Saved listings. The resources and support groups you bookmark.
• Messages to Purpose Partner. What you type into the assistant, so it can answer you and so we can learn what people are looking for.
• Reports and feedback. If you report a listing as outdated or tell us whether a listing helped, we keep what you submit.
• Emails you send us. If you contact us, we keep the correspondence.

Information collected automatically

• Usage events. When you search or filter the directory (including the city or category you choose), open a listing, tap a phone number, website, email, or directions link, save or share a listing, or ask Purpose Partner a question, we record that event with the date and time. These events are tied to a random identifier stored in your browser, not to your name. If you are signed in they may also be tied to your account so your saved list works.
• Device and log information. Like most websites, our hosting provider's servers record your IP address, browser type, operating system, referring page, and the pages you visit.
• Cookies and similar technologies. See section 4.

Information we do not ask for

We do not ask for your name, home address, phone number, Social Security number, immigration status, health conditions, income, or payment information, and we ask that you not put those details into Purpose Partner or a listing report. If you do, we will treat them under this policy but may delete them.

2. How we use information

• To run the Site and keep your saved listings private to your account.
• To answer your Purpose Partner questions and point you to relevant listings.
• To understand community need: which kinds of help people look for, where searches come up empty, and which parts of Southwest Georgia have gaps. We report this to our board, partner agencies, and funders only in aggregate or de-identified form — counts and trends, never your individual activity.
• To keep listings accurate (for example, acting on outdated-listing reports).
• To protect the Site and its users: detecting abuse, preventing unauthorized access, and debugging.
• To send you email updates about new resources, events, and news — only if you opted in. Every such email includes an unsubscribe link. We may also send essential account emails (for example, a password reset you requested) whether or not you opted in.
• To comply with the law and enforce our Terms.

3. Purpose Partner (automated assistant)

Purpose Partner is an automated assistant powered by a large language model. It is not a person, counselor, caseworker, or emergency service, and it only knows about the listings in our directory.

• Your messages are sent to our secure cloud provider and its AI model provider to generate a reply, and are stored by us so we can improve answers and understand community needs.
• We do not use your messages to train AI models, and our providers are contractually limited to processing them on our behalf.
• Before storing a message for analysis we try to remove phone numbers, email addresses, and other obvious identifiers, but automated filters are imperfect — please keep private details out of the chat.
• If you are in immediate danger call 911. For a mental-health crisis, call or text 988. The National Domestic Violence Hotline is 1-800-799-7233.

4. Cookies, local storage, and analytics

• Session cookie (essential). When you sign in we set a secure, HTTP-only cookie so you stay signed in. It expires after 7 days of inactivity. Signing out, or using Quick Exit, removes it.
• Usage identifier (analytics). We store a random ID in your browser's local storage so that the usage events in section 1 can be grouped into a visit. It contains no personal information. Clearing your browser data resets it.
• Google Analytics. We use Google Analytics 4 to measure traffic, device types, and the general region visitors come from. Google sets its own cookies and processes data under Google's Privacy Policy. IP addresses are not logged or stored by Google Analytics 4. You can opt out with the Google Analytics opt-out browser add-on.
• Maps. Map tiles are loaded from OpenStreetMap, which receives your IP address when a map is displayed, under the OpenStreetMap Foundation Privacy Policy.
• We do not use advertising cookies or tracking pixels, and we do not share personal information for cross-context behavioral advertising. We currently do not respond to browser "Do Not Track" signals because there is no agreed standard, but we honor Global Privacy Control signals as an opt-out of any sale or sharing — which we never do anyway.

5. When we share information

We do not sell personal information and never have. We share it only in these situations:

• Service providers who process data on our behalf and only on our instructions: our secure cloud hosting and database provider, the AI model provider that generates Purpose Partner replies, Google (analytics), OpenStreetMap (map tiles), and an email delivery provider for account and opted-in emails. A current list of providers is available on request.
• Aggregate reporting. De-identified statistics (for example, "housing searches rose 40% in Dougherty County") with our board, partner organizations, funders, and the public.
• Legal requirements and safety. If required by law, subpoena, or court order, or when we believe in good faith it is necessary to protect someone's safety or the Site's integrity. Where legally permitted, we will try to notify you.
• Organizational changes. If Created for Purpose merges with or transfers the Site to another nonprofit, information may transfer with it; the new organization must honor this policy.
• Listed organizations. When you tap a listing's phone number, website, or email you are contacting that organization directly. What you share with them is governed by their policies, not ours. We do not tell them who viewed their listing.

6. How long we keep information

• Account information and saved listings: until you delete your account or ask us to, or after 3 years with no sign-in, after which we delete it.
• Usage events (searches, listing views, contact taps): kept in identifiable form for up to 24 months, then reduced to aggregate counts.
• Purpose Partner messages: up to 12 months, then deleted or reduced to topic summaries.
• Sign-in attempt records (used to block password guessing): 15 minutes.
• Server logs held by our hosting provider: about 30 days.
• Listing reports and correspondence: as long as needed to resolve them and for our records, generally up to 3 years.

7. How we protect information

• All traffic to the Site is encrypted in transit (HTTPS/TLS), and our database is encrypted at rest.
• Passwords are stored only as salted bcrypt hashes. Sign-in is rate-limited and accounts lock temporarily after repeated failed attempts.
• Session cookies are HTTP-only, Secure, and SameSite, and expire automatically.
• Only a small number of authorized Created for Purpose administrators can access account data, and administrator access requires a password-protected account with a separate role.
• We collect as little as we can and de-identify analytics data wherever possible.

No system is perfectly secure. If we learn of a breach of security that affects unencrypted personal information of Georgia residents, we will notify affected people without unreasonable delay as required by the Georgia Personal Identity Protection Act (O.C.G.A. § 10-1-910 et seq.), and we will follow the notification laws of any other state whose residents are affected.

8. Your choices and rights

Whatever state you live in, you can ask us to do any of the following, and we will respond within 45 days:

• See the personal information we hold about you and get a copy in a portable format.
• Correct information that is wrong.
• Delete your account and personal information. (We may keep de-identified statistics and records we are legally required to keep.)
• Unsubscribe from email updates — use the link in any email or contact us. We will process opt-outs within 10 business days as required by the CAN-SPAM Act.
• Opt out of Google Analytics using the browser add-on linked in section 4.

To make a request, email info@createdforpurpose.org from the address on your account. We will verify it is you before acting, and we will never discriminate against you for exercising these rights. Residents of states with comprehensive privacy laws (such as California, Virginia, Colorado, Connecticut, or Texas) may also appeal a decision by replying to our response; we will answer appeals within 45 days.

9. Children's privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13, consistent with the Children's Online Privacy Protection Act (COPPA). You must be at least 13 to create an account, and we ask for your age when you sign up for that reason. If you believe a child under 13 has given us personal information, contact us and we will delete it promptly.

10. Safety and the Quick Exit button

The Quick Exit button at the top of every page immediately leaves the Site and opens a neutral page, and signs you out. It does not erase your browsing history; if you are concerned that someone may check your device, use your browser's private or incognito mode and clear your history afterward.

11. Third-party listings and links

The directory describes organizations that are not part of Created for Purpose. We verify what we can, but we do not control those organizations, their websites, or how they handle your information. A listing is not an endorsement. Please review the privacy policy of any organization before sharing personal information with it.

12. Changes to this policy

When we change this policy we will update the effective date at the top. For material changes that affect account holders — for example, collecting a new kind of information — we will also show a notice on the Site or email you if you have opted in, and we may ask you to agree again when you next sign in. Your continued use after the effective date means you accept the updated policy.

13. Contact us

Questions, requests, or concerns about privacy: