Privacy Policy

We collect the minimum data needed to run the platform. We never sell your data. We use cookies to keep you signed in and to understand how the site is used. You can request a copy of your data or ask us to delete it at any time.

Account information: When you register, we collect your name, email address, and a hashed password. Passwords are hashed with scrypt and are never stored in plain text.

Organization data: When you join or create an organization, we store your membership and role. Organization owners and administrators can see your name, email, and role within their organization.

Usage data: We log requests to the Service — including IP address, user agent, and timestamps — for security and auditing purposes.

Anonymous visitor data: Before you register, we set a cookie to remember your visit. This cookie is used to link your pre-registration activity to your account after sign-up.

• To operate the Service and keep your account secure
• To send transactional emails (password resets, verification)
• To detect and prevent fraud, abuse, and unauthorized access
• To comply with legal obligations
• To understand how the Service is used and improve it

We do not use your information for advertising, and we do not sell it to third parties.

We use a small number of cookies, all essential to the Service:

• Session cookie: keeps you signed in. Required for authentication. HttpOnly and Secure.
• Anonymous visitor cookie: remembers your visit before registration. Optional but enabled by default.

We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across other sites.

We do not share your personal information with third parties except:

• With your explicit consent
• To comply with legal requests or court orders
• To protect the rights, property, or safety of the Service or its users
• With service providers under strict confidentiality agreements (hosting, email delivery)

Organization owners and administrators can see member details within their organization. This is a core feature of the Service and is disclosed when you accept an invitation.

We retain your account data for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except where we are legally required to retain it.

Audit logs, which record actions taken on the platform, are retained for up to 24 months. Anonymous visitor records are retained for up to 13 months.

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these rights, email privacy@theyouthfoundationpak.com. We will respond within 30 days.

We use industry-standard security measures including:

• HTTPS encryption for all traffic
• Scrypt password hashing
• Session cookies with HttpOnly, Secure, and SameSite attributes
• Regular dependency updates and security audits
• Audit logging of privileged actions

No system is perfectly secure. If you discover a vulnerability, please disclose it responsibly to security@theyouthfoundationpak.com.

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

Your information may be stored and processed in countries other than your own, including where our hosting providers operate. We take steps to ensure appropriate safeguards are in place for any such transfers.

We may update this policy from time to time. Material changes will be announced on this page and, where appropriate, by email. The “Last updated” date at the top reflects the most recent change.

Questions or concerns about this policy? Contact us at privacy@theyouthfoundationpak.com.