Privacy Policy

The Defend Foundation is designed around collecting as little personal information as reasonably necessary, retaining it only as long as needed for a legitimate purpose, and giving people meaningful control. You do not need an account to use our website. This Privacy Policy explains how information is handled when you visit our website, use Get Help, My Case, Take Action, our Guides, Stay Safe and the Privacy Center, apply to join the Defend Network, or contact us, including about supporting our work.

This policy applies to the Foundation's public website. Third-party websites reached through our links, including the organizations and official sites our pages point you to, have their own privacy practices.

We do not ask you to submit passwords, financial account credentials, government identifiers, or other highly sensitive information through our forms. Please avoid including unnecessary sensitive details in messages to us. If a message or application appears to contain a Social Security number, the form asks you to remove it before it is sent.

Accounts. The website never asks you to create an account or sign in. We receive your email address only if you choose to give it to us through Contact Us or a Network application.

Contact Us messages and Network applications. Each is delivered to the Foundation by email through our email delivery provider (Section 6). It is not saved in a database on our website. It is kept in the Foundation's email system, and our email delivery provider keeps a copy for a limited period (Section 9). Submitting a Network application does not create an account, membership, listing, or verification (see our Terms of Use).

My Case. You do not need an account to use My Case. What you enter into My Case stays in your browser's memory, in the session you are using. My Case does not send it to the Foundation or to anyone else, does not save it in your browser's storage (such as cookies or local storage), and the Foundation does not store it. Closing the tab or window, reloading the page, or choosing End Session & Delete clears the session. If My Case is left without activity for 10 minutes, it asks whether you are still there, and if no one answers within 2 minutes it clears the session (on a device that was asleep, as soon as it wakes). A Case File you create is yours: you print it or save it as a PDF, and the Foundation does not keep a copy. If you download your conversation, the file is made in your browser and the Foundation does not receive it. Once you have printed, saved or downloaded a copy, it is in your control, and the Foundation cannot delete it. Closing a browser window may not immediately erase every form of browser memory, cached file, download, security log, or system backup.

Take Action. Take Action's step-by-step guidance and document preparation also work in your browser and are not stored by the Foundation; closing the tab clears them. On this website, Take Action does not send anything to any organization for you.

Guides, Stay Safe and the Privacy Center. You do not need an account to use them. They are web pages: opening one, such as the page for a situation or a place, is a request for that page, handled like any other (Section 3, website delivery and security). Nothing else you do in them is sent to the Foundation or to anyone else. Your answers in a Guide stay in your browser tab; they are not saved in your browser's storage (such as cookies or local storage), and the Foundation does not store them. Closing the tab clears them. The Foundation does not contact any organization for you: when a step involves an outside organization, you go there and share your own information.

Our website operates without advertising, analytics or cross-site tracking. It uses one necessary technology:

• ALTCHA human verification: An open-source challenge used to protect our Contact Us form, on the Contact Us and Donate pages, and the Join the Defend Network application, from automated submissions. It runs on Foundation-controlled infrastructure and does not set cookies or browser storage.

Cookie Settings: Cookie Settings, at the bottom of every page, lists the technologies the website uses. The website has no optional technologies today. If you save a choice there, it is kept in your browser and is not sent to the Foundation, and you can change it at any time.

Global Privacy Control and Do Not Track: We do not sell personal information or share it for cross-context behavioral advertising. If your browser sends a Global Privacy Control signal, we treat it as your choice to decline optional technologies. Browser Do Not Track signals do not change how the website works, because it uses no cross-site tracking.

We disclose information to service providers that support hosting, infrastructure, security, email delivery, and other necessary operations, subject to applicable contractual and security controls. They are: Google (Firebase and Google Cloud for hosting and infrastructure, and Google Workspace for the Foundation's email); and Postmark, which delivers our copy of your Contact Us message or Network application to us. We may also disclose information when required by law, to protect rights or safety, or in connection with lawful organizational changes.

The Foundation's website and systems do not receive or store payment-card or bank-account numbers. Where the website offers online donations, they are made through an independent third-party donation provider identified at the point of donation. That provider collects your payment information and any other details it asks for directly, under its own terms and privacy policy. The provider may share with the Foundation information about your donation, such as your name, contact details, and the amount and date of your gift, which we use to process, acknowledge and keep records of donations and to meet legal and accounting requirements. The Donate page shows whether online donations are currently available.

The Foundation does not sell personal information or use advertising or cross-site tracking. We will not treat submission of a contact message, help request or Network application as consent to unrelated fundraising or promotional messages.

We keep information only as long as reasonably necessary for the purposes described, including responding to inquiries, maintaining security, meeting legal and accounting requirements, and resolving disputes. In particular:

• Contact Us messages and Network applications are kept in the Foundation's email system while we respond or consider the application, and are deleted when no longer needed, no later than 24 months after our last correspondence unless a longer period is required by law or to resolve a dispute. Deleted email may remain in the email system's trash or backups for a limited time. Our email delivery provider keeps its copy for up to 45 days.
• Server and security logs are kept for a limited period, generally about 30 days.
• Human verification records contain no personal information and are deleted after one day.
• My Case, Take Action and Guides: the Foundation does not store information you enter into My Case or Take Action, or your answers in a Guide.

Closing a browser tab does not delete information separately sent to us through Contact Us or a Network application.

We use administrative, technical, and organizational measures appropriate to the nature of the information we process. Forms on our website are submitted over an encrypted connection. No internet service or electronic storage method is completely secure. Please do not send sensitive credentials or highly confidential records through ordinary email or our forms. Security incidents will be evaluated and addressed in accordance with applicable law and organizational procedures.

You may choose whether to contact us and whether to give optional contact details. You may request access to, correction of, or deletion of information we maintain about you, subject to verification, applicable law, legitimate security needs, and retention obligations. Contact us through our Contact Us page. We will explain when we cannot fulfill a request or do not hold the requested information. Because we do not store what you enter into My Case or Take Action, or your answers in a Guide, we cannot retrieve or delete them for you.

The Foundation is organized as a nonprofit. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, generally applies to qualifying for-profit businesses rather than nonprofits; particular relationships or processing arrangements may warrant further legal review. We nevertheless seek to provide transparent disclosures and reasonable access, correction, and deletion request mechanisms. We will comply with California's applicable online privacy, data security, and breach-notification requirements.

Our public educational resources may be accessible to people of different ages. The Foundation does not intend to collect personal information from children through general public tools without appropriate legal safeguards. The Join the Defend Network application is intended for adults applying for an organization or as a professional. If you believe a child provided personal information inappropriately, contact us through our Contact Us page.

The Foundation is based in California and focuses on the United States. Visitors outside the United States should be aware that information they submit may be processed in the United States or other locations used by our service providers, subject to applicable law.

We may update this policy when services, technologies, vendors, or legal obligations change. We will post the updated policy on this page with its effective date, and if we make a material change, we will also post a notice on the website when it takes effect. We will provide any additional notice required by law.

For privacy questions or requests: Contact Us.