Support Serve

Privacy

Last updated October 12, 2026

What we collect

  • Your sign-in identity: if you use Google, GitHub or Microsoft, an account ID, display name and email address from that provider; if you use an email link, your email address. We never see or store a password.
  • A sign-in cookie that keeps you signed in for up to 30 days, and a theme preference stored in your browser. We don't use advertising or analytics cookies.
  • The profile you provide: name, contact email, optional phone number, location, bio, skills, availability and causes.
  • Whether you are 18 or older. If you tell us you are under 18, we keep only that answer, never your date of birth.
  • What you do on the site: applications (including a parent or guardian's agreement for under-18 volunteers), messages with nonprofits, project postings, volunteer hours, saved projects and searches, reviews, reports and feedback.
  • Your email choices: which kinds of email you want and whether you unsubscribed.
  • If you join the early-access list: your email, the role you pick, and your name and a city or ZIP code if you give them. Every update email includes an unsubscribe link.
  • Technical logs. Our hosting provider keeps server and request logs that include network (IP) addresses and the web address of each request, such as the place you searched for or the coordinates your browser shared when you used "Use my location". We use network addresses to limit abuse and to see when something breaks, and they are passed to the bot check described below. These logs are not used for advertising.
  • Form drafts. Text you have typed into a form but not sent stays in your browser on your own device, and is cleared when you sign out.
  • An audit log of actions our staff take on accounts, nonprofits and content (for example approving a nonprofit or suspending an account). It records who acted, what they did and when, so we can review our own decisions.

Who sees it

  • Project postings, organization pages and total impact numbers are public.
  • Your volunteer profile, contact email and phone number are visible to nonprofits you apply to.
  • If you choose "Let approved nonprofits find me", approved nonprofits can also see your name, bio, skills, causes, location, availability, languages, whether you prefer remote or in-person help, how far you will travel, how many hours a month you can give, and a background check only if you say you have had one recently. Your email and phone number are never shown. This option is not available to volunteers under 18.
  • A nonprofit's contact email and phone number are visible to volunteers it accepts. We never call or text anyone from the platform.
  • Shared hours links. If you create a link to share your confirmed hours (for example with a school or employer), anyone who has the link can open it without signing in. It shows your name, your confirmed hours with their dates and projects, the nonprofits, and the name of the nonprofit staff member who confirmed each entry. Volunteers under 18 appear as first name and last initial. Links can expire and you can turn one off at any time.
  • Reviews of nonprofits are public and show the volunteer's first name and last initial. Reviews by volunteers under 18 show "A volunteer" instead.
  • Reports are seen only by Support Serve staff. We never tell anyone who reported them.
  • When a nonprofit gives a US EIN, we look it up in public IRS data (through ProPublica's Nonprofit Explorer) to help us review it. Only the EIN is sent.
  • We do not sell your data or share it for advertising.

Company volunteer programs

Some employers run a volunteer program on Support Serve. Joining one is always your choice: if your sign-in email is on your employer's domain, we show you an invitation, but nothing is shared unless you join.

  • Your employer only sees hours confirmed by the nonprofit, dated on or after the day you joined. Pending hours, your applications, messages and profile are never shared.
  • With "Totals only" (the default), your employer sees combined numbers for everyone in the program, never your name or your own hours. Company totals need at least 3 employees in the program before any number appears, and groups smaller than 3 people are combined or left out, so no one's hours can be singled out.
  • If you choose "Share my name and hours", your employer also sees your name and your confirmed hours, and nonprofits you apply to see "Volunteer from" your employer.
  • You can change your choice or leave at any time from your profile or dashboard. When you leave, your hours are no longer counted in any of your employer's numbers.
  • A company can choose to publish a page with its total hours and the nonprofits its employees supported. It never names employees.
  • Volunteers under 18 can't join company programs.
  • Team events: a company can reserve a group spot on a nonprofit's shift, and employees in its program choose whether to join. Joining does not change your sharing choice. The company sees how many people joined and, after the event, the hours confirmed by the nonprofit only once at least 3 people took part. It sees your name only if you chose "Share my name and hours". The nonprofit sees your name so it can confirm your hours.

Group sign-ups

A volunteer aged 18 or older can sign up a group for a shift and share a link so others can add themselves. The group leader and the nonprofit see the names of members who join with an account. Members without an account are counted as guests: the nonprofit records their hours as group guest hours, which are never tied to anyone's name.

Services that process data for us

  • Cloudflare hosts the site and database and sends our email, such as sign-in links and notifications.
  • Cloudflare Turnstile may be used on sign-in, early-access and feedback forms to tell people from bots. When it is on, it receives your network address and some browser details.
  • Cloudflare Web Analytics counts page visits so we can see which pages help people. It uses no cookies and doesn't track you across other websites. It records things like the page, the referring site, your browser type and country, never your name or account.
  • OpenStreetMap (its Nominatim service) turns place names into map coordinates so you can search by distance. We send only the place name typed into a search, a project, or your profile location (the last only if you set a travel distance), never who you are, and we keep the result so the same place is not looked up twice. To prevent abuse, we briefly count lookups using a scrambled code made from your account or network address. Map data © OpenStreetMap contributors, available under the Open Database License.
  • Google, GitHub and Microsoft provide sign-in if you choose them. Their own privacy policies apply to your account with them.

How long we keep it

We keep your information until you delete it. When you delete your account, your profile, applications, messages, logged hours, reviews and saved searches are removed from our live systems immediately. Our hosting provider keeps backups for up to 30 days and we use them only for disaster recovery.

Deleting an account also removes the account's email address from the early-access list. If you delete a nonprofit's account, the hours volunteers logged and had confirmed with that nonprofit are removed with it, and we tell those volunteers. Notifications we already delivered to other people (for example "Sam applied to your project") may keep your name until read notifications are removed, which happens after 90 days.

Some records are kept after an account is deleted, without your name or account attached:

  • Reports you made, and reports about you, so we can keep people safe. This matters most for reports about the safety of young volunteers.
  • Feedback you sent us.
  • Total impact numbers, which never identify anyone.

Our email delivery log records only the domain of an address (for example "gmail.com"), never the full address, and is cleared after 30 days.

Children

Support Serve is not for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has signed up, email us and we will delete the account. Volunteers aged 13 to 17 can only join projects from nonprofits that welcome them, with a parent or guardian's agreement each time they apply, and are never listed in nonprofit searches.

Your choices and rights

You can edit your profile, change which emails you get, download a copy of your data and delete your account from the profile page.

Depending on where you live (for example California under the CCPA, or the EU and UK under the GDPR), you may have the right to access your data, correct it, delete it, receive a copy, object to or limit certain uses, and not be treated worse for using these rights. We apply these rights to everyone. We do not sell personal information.

Data requests and contact

To ask for a correction or deletion you cannot do from your profile, email hello@supportserve.org from the address on your account. We aim to answer within 30 days. If you are in the EU or UK, you can also complain to your local data protection authority.