Privacy policy

This policy explains what information CharityIndex("we") collects when you use the service, why we collect it, how long we keep it, and the choices you have. The short version: we collect the minimum needed to run a free research tool — an email address if you create an account, a session cookie, and aggregate usage statistics — and we never sell personal data.

1. Information we collect

• Account data. If you create an account: your email address and, optionally, your name. Sign-in uses one-time email codes, so we never store a password.
• Your activity in the product. Organizations you save to your watchlist, your comparison selections, and your email-alert preferences — kept so the product works for you.
• A session cookie. A single first-party cookie keeps you signed in. We set no third-party advertising cookies and do no cross-site tracking.
• Usage analytics. Aggregated page-view and feature-usage statistics (via a privacy-respecting analytics tool) to understand what to improve. We do not build advertising profiles.
• Server logs. Standard technical logs (IP address, user agent, request path) retained briefly for security and abuse prevention.

2. What we never do

• Sell or rent your personal data to anyone.
• Share your email or watchlist with the organizations you research.
• Ask for payment details — the service is free.
• Send marketing email you didn't opt into.

3. How we use your information

We use account data to sign you in, power your watchlist and send the digests you enabled (new filings and status changes on organizations you follow, after each monthly data refresh). We use analytics and logs to keep the service fast, secure and improving. We do not use your personal data to train advertising or profiling models.

4. Service providers

We rely on a small number of processors to run the service: cloud hosting and database infrastructure, and a transactional email provider for sign-in codes and digests. They process data only on our instructions. We disclose data beyond that only if required by law.

5. Data about organizations and officers

Names, titles and compensation of nonprofit officers, directors and key employees shown on the site come from public IRS Form 990 filings, which U.S. law makes publicly available (26 U.S.C. § 6104). We display them as filed, as part of the public record. If a filing was amended, the public dataset — and therefore the site — reflects the version released by the IRS.

6. Retention

Account data is kept while your account exists and deleted when you ask us to delete it. Expired sessions and one-time sign-in codes are purged automatically. Server logs are retained for a short operational window. Aggregate statistics contain no personal data and may be kept indefinitely.

7. Your rights and choices

• Email digests can be turned off any time in your account.
• Access, correction, deletion.Email us from your account address and we'll export, correct or permanently delete your account data. Depending on where you live (e.g. the EU/EEA under GDPR or California under the CCPA) these may also be statutory rights — we honor them for everyone regardless of location.
• Do-not-sell:we don't sell personal information, so there is nothing to opt out of.

8. Security

All traffic is encrypted in transit (HTTPS/HSTS), sign-in is passwordless, access to production data is restricted, and we store no payment information. No system is perfectly secure; if a breach affecting your data ever occurs, we will notify you.

9. Children

The service is not directed to children under 13 and we do not knowingly collect their data. If you believe a child provided us an email address, contact us and we will delete it.

10. Changes

We'll update this page if our practices change; the date above reflects the latest revision. Material changes will be announced on the site or by email.

11. Contact

Privacy questions or requests: [email protected].