Privacy Policy

Who we are and what this policy covers

This policy applies to the Safe Space for Creation web application, published at safespace4c.org and identified as "Safe Space for Creation" on Google's consent screen. It is operated by Safe Space for Creation — Nonprofit in formation — not yet a registered 501(c)(3).

It explains what information we collect, why we collect it, who we share it with, how long we keep it, and how you can see or delete it. Our Terms of Service are a separate document, linked at the bottom of this page.

Information you give us

We collect only what the platform needs in order to work:

• Account details: your email address, name, title, and a securely hashed password. We never store your password itself.
• Your public space: the biography, motivations, photo, and page design you choose to publish. Anything you put here is intended to be seen by others once you publish it.
• Project activity: the projects you create or join, participation requests, tasks, and updates you contribute.
• Giving details: if you choose to sponsor or donate, the contact name, organisation, email, phone, and mailing address you enter. Card numbers are entered on Stripe's page and never reach our servers. Giving is always optional and never required for membership.
• Messages you send: ideas, intake submissions, and requests you submit through the portal.

Information we collect automatically

We set one essential cookie to keep you signed in. It holds a signed session token, cannot be read by JavaScript in your browser, and is sent only to this site. We do not use advertising or analytics cookies, and we do not track you across other websites.

Our hosting provider records standard server logs, such as IP address and requested URL, for security and reliability.

How we use your information

We use your information to:

• Create and secure your account, and verify your email address.
• Publish the parts of your profile you have chosen to make public.
• Connect you with projects, coordinators, and community programs.
• Send transactional email you have asked for, such as email verification and password resets.
• Record and acknowledge optional sponsorships and donations.
• Keep the platform safe, prevent abuse, and fix problems.

How we access, use, store and share Google user data

Connecting a Google account is optional. The platform works without it; you would simply schedule meetings without them appearing on your Google Calendar. The table below lists every Google permission we request, who grants it, exactly what it gives us access to, and why we need it.

Our commitments regarding Google user data

Safe Space for Creation's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, and without exception:

• We do not sell Google user data, and we never will.
• We do not use Google user data for advertising, ad targeting, ad personalisation, or to build advertising profiles.
• We do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. Google user data is never sent to OpenAI, to Tavily, or to any other AI or machine learning service.
• We do not transfer Google user data to third parties, except as strictly necessary to provide or improve the specific feature you requested, to comply with applicable law, or as part of a merger or acquisition where the receiving party is bound by this same policy and affected users are notified in advance.
• We do not allow humans to read your Google user data, unless we have your explicit consent for a specific request, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified for internal operations.
• We request the narrowest permissions that make the feature work. We do not request access to read your Gmail messages, your contacts, your files, or your calendar history.

You can read the policy we are committing to here: Google API Services User Data Policy.

How Google data is stored and how to revoke access

When you connect Google Calendar, we store the authorisation token Google issues, together with the email address of the connected account, in our database. Tokens are held in a managed secret store or an access-controlled database, encrypted in transit and at rest by our cloud provider, and are used only to make the calendar requests described above. We do not store your Google password, and Google never shares it with us.

You can disconnect Google access at any time from the Integrations page in your member space. Disconnecting deletes the stored token immediately, and any calendar events already created remain on your own calendar under your control.

You can also revoke our access directly from your Google Account permissions page, which takes effect immediately regardless of anything stored on our side.

Revoke access directly at Google Account permissions.

Service providers we rely on

We share information with a small number of processors who act on our instructions and only to the extent needed to run the platform. None of them receive Google user data:

• Google Cloud, for application hosting and infrastructure.
• MongoDB Atlas, where member, profile, and project records are stored.
• Google (Gmail API), used only to deliver transactional email from our own mailbox.
• OpenAI, which processes the text you type when you use assistant features to draft or refine your own content. We do not send your Google data, your password, or other members' private content to OpenAI.
• Tavily, which performs public-web searches when you explicitly ask the assistant to research a topic.
• Stripe, which processes optional card gifts. Stripe receives the amount, a receipt email if you provide one, and the card details you enter on its page. We receive a payment confirmation, not your full card number.

What we never do

We do not sell your personal information. We do not rent or trade your contact details. We do not use your information for behavioural advertising, and we do not share your private profile content with other members.

What is public and what is private

Your public space becomes visible to others only after it is published and approved. Until then it is visible only to you, and you can preview it as a draft.

Project internals — task lists, daily digests, participant rosters, and coordinator contact details — are visible only to people on that project. Program registration details are visible only to you and the project coordinator.

How long we keep information, and deletion

We keep your account and the content you create for as long as your membership is active. Email verification tokens expire after 24 hours and password reset tokens after one hour; both are then discarded. Google authorisation tokens are deleted as soon as you disconnect the integration. Records of financial giving are retained for as long as the organisation's accounting and reporting obligations require.

You may ask us to delete your account and personal information at any time by emailing privacy@safespace4c.org. We will confirm the request, delete your account and associated personal data within 30 days, and remove any Google authorisation tokens immediately. Content you contributed to shared projects may remain where deleting it would misrepresent a project's history, but it will no longer be associated with your name or contact details.

Your choices and rights

You can review and edit your profile at any time from your member space, unpublish it, disconnect Google access, or ask us to delete your account. Depending on where you live, you may also have the right to request a copy of the information we hold about you, to correct it, to restrict or object to certain processing, and to complain to your local data protection authority.

To make any of these requests, email privacy@safespace4c.org. We may need to verify your identity before we act, and we will respond within 30 days.

Security

Passwords are hashed with bcrypt and never stored in readable form. Sessions use signed tokens sent over HTTPS. Credentials for third-party services are held in a managed secret store rather than in our source code. Member-authored page designs are sanitised on our servers before publication so they cannot run scripts in another member's browser. Access to production data is limited to administrators who need it.

No system is perfect. If you believe your account has been compromised, or you have found a security issue, please contact us promptly at the address below.

Where your information is processed

We operate from the United States, and our providers may process and store information in the United States and other countries where they run infrastructure. Where information is transferred out of your country, we rely on our providers' standard contractual protections for that transfer.

Children

The portal is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will remove it. Where young people take part in community programs, participation is arranged through their school or guardian rather than through an individual account.

Changes to this policy

If we make a material change — including any change to the Google permissions we request or how we use Google user data — we will update the effective date at the top of this page and notify members before the change takes effect. Continuing to use the platform after that point means you accept the updated policy.