The short version
- We collect the bare minimum to run a neighborhood website: your name, your email, your address, and whatever else you choose to add to your profile (photo, phone, bio, pets).
- We don't sell, rent, or share your information with advertisers or data brokers. Ever.
- You can see, edit, or delete everything we have about you from your dashboard.
- The website runs on Amazon's hosting service, with credit-card payments processed by Stripe and the neighborhood email list run by Simplelists. None of those companies use your data for anything beyond what we asked them to do.
What we ask you for
When you sign up for an account, we ask for your name and email address. We use the email to sign you in and to send you things you've asked for (a password reset, a dues receipt, a notification about a neighborhood post). Other members can contact you through the directory if you've opted in — the directory is off by default.
On your profile, you can add a phone number, photo, a short bio, and a list of your pets. All of that is optional and visible only to other signed-in members.
When you pay dues with a credit card, the card details go directly to Stripe — we don't see them. We only see the amount, the year the payment is for, and an email address for the receipt.
When you subscribe to the neighborhood email list, your email address is added to a list hosted by Simplelists. You can unsubscribe at any time from your dashboard, or by clicking the unsubscribe link in any list email.
What we keep in the background
A few things happen automatically that you should know about:
- Every time you sign in, change a setting, or do something that affects neighborhood records, we keep a note of who did what when. This helps us answer "who edited the dues record?" or "when did that account get approved?" if a question comes up.
- Standard web-server logs record which pages got visited and when. They help us figure out what's broken when something goes wrong.
- If you sign in with two-factor authentication, we store the secret your authenticator app uses so we can recognize the codes it generates. We never see the codes themselves — only that they match.
- When you post or upload something (a pet listing, a profile photo, a contact-form message), an automated screen checks for hate speech, nudity, weapons, and similar abuse. If it flags something, you'll get an inline message to revise and try again. The screen runs at submit time and only the verdict is kept; the text or image itself is not stored by the screening service.
- If another member reports something you posted as inappropriate, that post is hidden from public view until an administrator reviews it. The administrator can either keep it hidden or restore it.
Who else sees your information
Running a website at hobby scale means we use a handful of outside services. Each one only sees the slice they need. None of them use your data for anything else, and none of them get to sell or share it.
- Amazon Web Services — runs the website itself (the server, the database, the storage for photos) and sends transactional email from the noreply address.
- Cloudflare — sits in front of the website to handle the basics (HTTPS, blocking abuse, caching images). Every web request passes through them.
- Stripe — processes credit-card payments for HOA dues. Your card number never touches our servers.
- PayPal — the alternate dues-payment option. If you use it, you're handing your details directly to PayPal; we never see them.
- Simplelists — runs the neighborhood email list. Only people who subscribe are on it.
- Fastmail — holds the board's inbound mailbox. If you email the board, your message is stored there.
- Stadia Maps — provides the map tiles you see on the neighborhood map page.
- Common web libraries — we load standard fonts and code libraries from public CDNs (Google Fonts, Font Awesome, jQuery, Bootstrap) the same way most websites do. Those services see your browser type and IP address when you visit the site.
If you enable the "Ask the AI" feature on the HOA Rules page, your question is sent to Hugging Face for the AI to answer. We don't send any information that identifies you.
How long we keep things
- Your account stays until you delete it (you can do that from your dashboard at any time). Deletion is immediate and we can't get the account back.
- Dues payment records stay indefinitely — the treasurer needs them for accounting and tax reporting.
- The "who did what when" log stays indefinitely too, with your name attached even if you've deleted the account, because the historical record is what makes it useful. The log only records actions on the site, not your private life.
- Web-server access logs roll off after about two weeks.
- Backups of the database age out on a rolling schedule (a week of point-in-time recovery plus named snapshots up to about six months). A deleted account disappears from backups as those age out.
What you can do
- See what we have about you: most of it shows up on your dashboard and in your profile editor. Email the board if you want anything else.
- Fix what we have about you: edit your profile, or email the board for things you can't change yourself (like your registered email).
- Delete your account: from your dashboard. The historical record of actions you took stays in the log, but the name on those rows changes to "deleted user."
- Stop getting emails: click the unsubscribe link in any email, or change your notification settings from your dashboard. The unsubscribe link is one click — no login required.
- Pause two-factor authentication: from your dashboard. (We strongly recommend leaving it on.)
Keeping things safe
We follow standard security practices: encrypted connections everywhere, encrypted passwords (we cannot read your password), two-factor authentication available to anyone who wants it, protection against the usual web attacks, weekly automated security scans. The board reviews security posture quarterly.
No system is perfect. If we ever find out your information was exposed, we'll email you within three days, describe what happened, and tell you what we're doing about it.
Children
This website is for adults who live in the neighborhood. We don't knowingly collect information from anyone under 13. If you think a child has signed up, please tell the board and we'll remove the account.
When this changes
We update this whole page (the "Last updated" date at the top reflects the most recent change) whenever what we actually do changes — not when small wording is tweaked. We don't email everyone for minor edits; if a change is significant (like adding a new outside service that sees your data), we'll send a notice.
Questions
Email the board through the contact form,
or [email protected]. We aim to reply
within a few days.