Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address and/or phone number (at least one is required)
• Password (stored as an irreversible cryptographic hash; we never store your password in plain text)
• Username (chosen by you)
• Region and chapter (optional, chosen by you)
• Locale/language preference

1.2 Social Login Information

If you choose to sign in using a third-party service (Google, Facebook, Apple, or Microsoft), we receive your name, email address, and a unique identifier from that provider. We do not receive or store your password from any social login provider.

1.3 Event and Program Application Data

When you submit an application to participate in events, programs, or activities, we may collect personal details, contact information, travel and identity documents, family and emergency contacts, health and medical information, organizational background, athletic and physical information, logistical preferences, social media profiles, and any other information relevant to the event or program.

The specific data collected varies by event and is clearly indicated on each application form. Not all categories apply to every event.

1.4 Information from Children

Our programs serve youth and minors. When a minor's information is submitted:

• A parent or legal guardian must provide their contact information as part of the application
• Sensitive information (medical, identity documents) is collected with parental awareness through the application process
• We comply with the Children's Online Privacy Protection Act (COPPA) for users under 13 in the United States

1.5 Automatically Collected Information

When you use our Services, we automatically collect:

• Device information — device type, operating system, browser type, user agent string
• Network information — IP address, approximate geographic location (country level, derived from IP address)
• Usage information — pages visited, time spent, referring URL
• Device fingerprint — a hash generated from your device characteristics for security purposes
• Cookies and similar technologies — see Section 5

1.6 Mobile App Information

When you use our mobile application, we additionally collect a push notification token (a unique identifier for delivering push notifications), your device platform (iOS or Android), and app version.

We do not collect your device's precise geographic location. The app does not request or use GPS, Bluetooth, or Wi-Fi-based location permissions.

1.7 Photos, Videos, and Media at Events

When you attend or participate in any event, program, or activity organized by Homenetmen, we (or our designated photographers, videographers, staff, and volunteers) may capture photographs, videos, audio recordings, and other media ("Event Media") that include your name, likeness, image, voice, and/or appearance.

For minors: Event Media may include images and recordings of participants under 18. By submitting an event application for a minor, the parent or legal guardian consents to the collection and use of Event Media as described in this policy and in our Terms of Service (Section 4.5).

2. How We Use Your Information

We do not sell your personal information to third parties.
We do not use your personal information for automated decision-making or profiling.

3. How We Share Your Information

3.1 Event Organizers and Staff

When you submit an event application, your application data (including medical information) may be shared with authorized event organizers, medical staff, and leadership personnel who need it to safely coordinate the event.

3.2 Event Media

Event Media in which you appear may be published, shared, and distributed through:

• Our websites, social media accounts, and digital platforms (including third-party platforms)
• Printed publications, newsletters, reports, and marketing materials
• Press releases provided to media outlets
• Partner organizations and sponsors involved in the event
• Third-party media outlets covering the event

Once Event Media is published — particularly on third-party platforms or in printed materials — we cannot fully control its further distribution, reproduction, or use by third parties.

3.3 Service Providers

3.4 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or governmental request, or if we believe disclosure is necessary to comply with applicable law, protect the safety of any person, prevent fraud, or protect our legal rights.

3.5 Organizational Transfers

If our organization merges with, is acquired by, or transfers its assets to another nonprofit entity, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4. Data Storage and Security

4.1 Where We Store Data

Your personal information is stored on servers located in the United States. If you are accessing our Services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions: the transfer of your data to the United States is conducted under the EU-U.S. Data Privacy Framework or, where applicable, Standard Contractual Clauses approved by the European Commission.

4.2 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption in transit — all data is encrypted using TLS (HTTPS)
• Password security — passwords are hashed using Argon2ID; we never store plaintext passwords
• Token security — authentication tokens are signed and keys are encrypted at rest
• Session security — server-side validation; sessions can be remotely invalidated
• Access controls — database access is restricted per-service; sensitive columns are not accessible to public-facing services
• Rate limiting — login, registration, and API endpoints are rate-limited
• Account lockout — accounts are temporarily locked after repeated failed login attempts
• Audit logging — security-relevant events are logged for incident investigation
• Cookie security — authentication cookies are HttpOnly, Secure, and SameSite-protected

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

4.3 Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected individuals within 72 hours of becoming aware of the breach (as required by GDPR for EEA users)
• Notify relevant supervisory authorities as required by applicable law
• Provide details about the nature of the breach and steps being taken

5. Cookies and Tracking Technologies

5.1 Cookies We Use

5.2 Cookie Choices

When you first visit our website, a cookie consent popup allows you to:

• Accept all cookies — enables all cookie categories
• Essential only — enables only cookies required for the site to function
• Customize — choose which optional cookie categories to enable or disable

You can change your cookie preferences at any time by clicking the cookie settings link in the website footer. You can also control cookies through your browser settings. Note that disabling essential cookies may prevent you from logging in or using core features.

5.3 Do Not Track

Our Services do not currently respond to "Do Not Track" (DNT) browser signals. However, you can control tracking through our cookie consent tool and your browser settings.

6. Your Rights and Choices

6.1 All Users

Regardless of where you are located, you have the right to:

• Access your personal information by logging into your account
• Update your profile information through your account settings
• Delete your account by contacting us at security@homenetmen.org
• Opt out of push notifications through your device settings
• Opt out of marketing emails by using the unsubscribe link
• Control cookies through our cookie consent tool and your browser settings

6.2 EEA, UK, and Swiss Users (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you additionally have the right to:

• Right of access (Article 15) — request a copy of the personal data we hold about you
• Right to rectification (Article 16) — request correction of inaccurate personal data
• Right to erasure (Article 17) — request deletion of your personal data
• Right to restrict processing (Article 18) — request that we limit how we use your data
• Right to data portability (Article 20) — request your data in a machine-readable format
• Right to object (Article 21) — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time
• Right to lodge a complaint — file a complaint with your local data protection authority

To exercise these rights, contact us at privacy@homenetmen.org. We will respond within 30 days.

6.3 California Users (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Opt out of the "sale" or "sharing" of personal information (we do not sell personal information; pixels and analytics may constitute "sharing" under CPRA)
• Non-discrimination — we will not discriminate against you for exercising your rights

To opt out of third-party tracking, use our cookie consent tool and select "Essential only."

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

When you delete your account, we anonymize your personal data. Some information may be retained in backups for a limited period or as required by law.

8. International Data Transfers

Our servers are located in the United States. If you access our Services from outside the US, your information is transferred internationally. We ensure appropriate safeguards are in place:

• EU-U.S. Data Privacy Framework — our hosting infrastructure participates in the DPF
• Standard Contractual Clauses — where the DPF does not apply, we rely on SCCs approved by the European Commission
• Consent — by using our Services, you consent to the transfer of your information to the United States

9. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you visit.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will notify you via email or through a notice on our Services
• For material changes affecting how we process sensitive data, we will seek renewed consent where required

Your continued use of our Services after changes become effective constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights:

12. Supplemental Notice for Mobile App Users

The MyHomenetmen mobile application is a companion to our website. In addition to the information described above:

• The app displays our website content within a native wrapper
• The app registers your device for push notifications via Firebase Cloud Messaging
• The app stores your authentication token securely on your device (iOS Keychain / Android Keystore)
• The app does not access your contacts, camera, microphone, calendar, or location
• Push notification permissions can be revoked at any time through your device's settings