Privacy Policy

1. Who We Are

ServeConnect is a volunteer-matching platform that connects students seeking community service opportunities with organizations that need volunteers. The platform is operated independently and is not affiliated with any school district, school, or honor society chapter.

For privacy questions or data requests, contact us at: reyaansh.tomar11@gmail.com

2. Information We Collect

Student accounts

• Name, email address, and password (stored as a one-way hash — we cannot read it)
• ZIP code, city, and state (used to calculate distance to volunteer opportunities)
• Grade, school name, and program affiliation (e.g., NHS chapter)
• Availability schedule and travel distance preferences
• Skills, personal statement, and letter of recommendation URL (if provided)
• Phone number (optional)
• Service history: matched organizations, hours completed, activity descriptions, and supervisor ratings
• Confirmation that you are 13 years of age or older

Organization accounts

• Organization name, category, and description
• Contact name, title, email address, and phone number
• ZIP code, city, state, and website URL
• Posted volunteer opportunities including schedule, skills needed, and commitment level

Automatically collected

• Session tokens (stored as secure, one-way hashed values in our database — used to keep you logged in)
• IP address (used only for rate-limiting login and registration attempts to prevent abuse)

We do not use advertising trackers, analytics cookies, or fingerprinting tools. We do not collect precise device location.

3. How We Use Your Information

• To create and manage your account
• To match students with volunteer opportunities based on location, availability, and skills
• To facilitate communication between students and organizations after a match is accepted
• To generate and verify service hour records for NHS and similar programs
• To send transactional emails (match requests, acceptances, and service confirmations)
• To detect and prevent abuse of the platform

We do not sell, rent, or trade your personal information to any third party for marketing purposes, ever.

4. Information Shared Between Users

Student and organization contact details (email address, phone number) are only shared with the other party after both sides have accepted a match request. Before that point, only public profile information (name, skills, program affiliation, availability) is visible to organizations during the matching process.

Supervisor ratings submitted by organizations are visible only to the student being reviewed. They are not displayed publicly or shared with other organizations.

Service hour records, once generated, are accessible to the matched student and organization, and may be shared by the student with their school or program advisor for verification purposes.

5. Third-Party Service Providers

We use the following infrastructure providers to operate the platform. Each processes data only as necessary to deliver their service and is not permitted to use your data for their own purposes:

• Vercel — application hosting and content delivery (vercel.com)
• Neon — PostgreSQL database hosting (neon.tech)
• Resend — transactional email delivery (resend.com)
• Zippopotam.us — free ZIP code geolocation lookup used to calculate distances (zippopotam.us). Only your ZIP code is sent — no name or other identifying information.

6. Data Retention

We retain your account data for as long as your account is active. If you request deletion of your account, we will remove your personal information within a reasonable time. Some records — such as completed service logs associated with verified hours — may be retained in anonymized form for platform integrity purposes even after account deletion.

7. Children's Privacy (COPPA)

ServeConnect requires all users to be 13 years of age or older to register. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has registered, please contact us immediately at reyaansh.tomar11@gmail.com and we will promptly remove the account and associated data.

Students in grades 6–8 are welcome to use the platform if they have already turned 13. We rely on the age confirmation provided at registration. Parents or guardians who have questions about their child's account may contact us using the email above.

8. Your Rights

You may request access to, correction of, or deletion of your personal information at any time by emailing us at reyaansh.tomar11@gmail.com.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of sale (we do not sell data). To exercise these rights, contact us at the email above.

You may also unsubscribe from non-essential email notifications using the unsubscribe link included in those emails.

9. Security

Passwords are stored using bcrypt hashing and are never recoverable in plain text. Session tokens are stored as one-way hashes. All connections use HTTPS. We apply rate limiting to login and registration endpoints to prevent brute-force attacks.

No system is perfectly secure. We encourage you to use a strong, unique password and to contact us immediately if you believe your account has been compromised.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of ServeConnect after changes are posted constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions, data requests, or concerns, please email: reyaansh.tomar11@gmail.com