Privacy Policy
1. What We Collect
We collect only your email address, used solely for authentication (magic link sign-in). We do not collect names, phone numbers, payment information, or any other personal data unless you voluntarily provide it in a listing description or application form.
2. What We Do NOT Collect
We do not store photos — all uploaded images are analyzed by AI and immediately discarded. We do not store exact addresses in readable form — donor addresses are encrypted using AES-256-GCM and are only accessible to ReFound Impact admins via a secure server function.
3. How Addresses Are Handled
Donor addresses are encrypted before storage and are never displayed in our user interface. They are released only to verified recipients via direct email, following admin review and approval. The email is sent server-side and the address never appears in our app.
4. We Do Not Sell Data
ReFound Impact does not sell, rent, trade, or share your personal data with advertisers or third parties for commercial purposes.
5. Data Retention
Listings automatically expire after 7 days. Your account and email are retained until you request deletion. To delete your account and all associated data, email refoundimpact@gmail.com.
6. Third-Party Services
We use: Supabase (authentication and database — supabase.com/privacy), Mapbox (maps — mapbox.com/legal/privacy-policy), Anthropic Claude (AI description generation — anthropic.com/privacy — images are not retained), and Resend (transactional email — resend.com/privacy).
7. Security
We use industry-standard security practices including encrypted connections (HTTPS), encrypted address storage, and role-based access controls. No system is perfectly secure, but we take your privacy seriously.
8. Contact
For privacy questions or data deletion requests, email refoundimpact@gmail.com.