Privacy Policy

1. Who controls your data

Changemappers is controlled by Incze Gaspar, an individual based in Hungary. Changemappers is not presently a company, foundation, association, or other incorporated organization. For privacy questions, requests, or concerns, contact [email protected]. If email delivery is unavailable, use the in-app Feedback button and start the message with "privacy request" or "suspected incident" so the operator can triage it as a privacy-rights request.

2. Our privacy approach

Changemappers is designed as a privacy-first community platform. We collect only the data needed to provide accounts, community features, safety controls, and service reliability. We do not sell personal data, run advertising profiles, or use third-party marketing trackers.

3. Data we collect

• Account data: email address, display name, authentication details, and basic profile information.
• Profile and community data: location, location precision tier, map visibility, pronouns, bio, skills, values, interests, intentions, availability, causes, RDG focus, and community participation you choose to provide.
• Matching activation data: roles, offers, needs or learning edges, availability mode, and intent or boundary flags used only when matching or recommendations are enabled.
• Potentially sensitive self-disclosed data: optional profile fields or content may reveal special-category data under GDPR. We do not require this data and rely on explicit consent where special-category processing applies.
• User content: posts, comments, messages, events, maps, canvas entries, feedback, coaching or session content, reports, and other content you create or submit.
• Preference data: privacy settings, consent choices, communication preferences, and feature-specific controls.
• Technical data: IP addresses, browser type, device information, security logs, error telemetry, and usage events needed to keep the service stable and safe.

4. Cookies and local storage

We use essential cookies, local storage, and session storage for login sessions, registration continuation, language/theme preferences, cookie consent, draft recovery, undo history, and one-per-session analytics deduplication. Temporary registration continuation cookies are HttpOnly, do not contain your password or profile answers, and are removed when registration completes or expires. Optional analytics only runs after consent and its browser deduplication key is cleared when analytics consent is withdrawn. We do not use marketing cookies or cross-site tracking cookies.

5. Why we use your data

We use personal data to create and manage accounts, provide community and collaboration features, generate explainable recommendations, apply privacy and safety settings, prevent abuse, respond to support requests, and improve reliability. Legal bases may include consent, performance of contract, legitimate interests in security and platform operation, and legal obligations.

6. Hosting and processors

We use Hetzner for hosting, Upstash Redis for rate-limit storage, Sentry for optional error reporting and monitoring, Brevo for transactional email delivery, Cloudflare for DNS, caching, security, and network protection, and Mailgun only if adopted later for transactional email. For non-EEA transfers, we rely on provider DPAs and Standard Contractual Clauses where required.

7. Sharing and disclosure

We do not sell personal data. We share data only when required to provide the service, comply with law, protect users or the platform, or honor visibility choices. Public content and public profile fields may be visible according to the settings you choose.

8. Public contributions and open data

Some Changemappers areas are designed for public-interest learning and mapping. If you make a contribution public, it may be displayed publicly and may be included in aggregated or open datasets for social-impact purposes.

9. Retention

We keep personal data while your account is active or while it is needed for the purposes in this policy. Authenticated website use updates account activity. After 180 days without activity, we mark the profile inactive and keep the account for a 30-day export grace period. If no activity happens during that grace period, the account and personal data are erased 210 days after the last activity. Security and technical logs are deleted or anonymized after 90 days unless a longer period is needed for abuse, security, or legal reasons.

10. Account deletion

You can request account deletion at any time. Deletion removes or anonymizes personal data from active systems, subject to limited retention for security, legal compliance, backups, or records that must be preserved in non-identifying form to maintain community integrity.

11. Your GDPR rights

You can access your data, correct inaccurate data, request deletion, restrict or object to processing, withdraw consent, and receive a portable copy of your data. If GDPR applies to you, you can also lodge a complaint with your local data protection authority.

Use in-app controls first for profile edits, privacy and visibility settings, matching opt-out, data export, and account deletion. Email [email protected] only for non-self-service privacy rights requests. If email delivery is unavailable, use the in-app Feedback button and start the message with "privacy request". We acknowledge requests within 3 business days and respond within 30 days unless an authority allows an extension.

12. Lawful basis and processing map

13. Retention by data category

14. Security

We use TLS encryption, access controls, secure authentication practices, monitoring, and other technical and organizational measures to protect personal data. No online service can guarantee perfect security, but we work to reduce risk and respond quickly when issues are found.

15. Data breaches

If a personal-data breach creates a high risk to your rights or freedoms, we will notify affected users and relevant authorities as required by law, including the 72-hour GDPR notification window where required. Suspected incidents should be emailed to [email protected], or sent through the in-app Feedback button if email delivery is unavailable.

16. Children

Changemappers is not intended for children under 16. Registration requires users to confirm they are at least 16 before account creation. If you believe a child has provided personal data to us, contact [email protected] or use the in-app Feedback button if email delivery is unavailable.

17. Changes to this policy

We may update this policy as Changemappers changes. When changes are material, we will notify users by email, in-product notice, or a clear notice on the website.

Location controls: users can choose profile location precision and whether they appear on the map. Exact coordinates are optional and map display is off by default.