Privacy
VolunAura is volunteer scheduling software. Community organizations use it to publish shifts, and volunteers use it to sign up, get shift email, and keep track of what they have committed to.
The organization you volunteer with decides what it asks of its volunteers and what it does with that information. VolunAura stores and handles that information so the organization can run its shifts. This notice describes what the platform itself stores, who can see it, how long we keep it, and how to reach us.
What we store
Account and contact information. Your email address, an optional display name, a password hash if you choose to set a password, and the sign-in and signup links we email you, including when each was sent, used, or canceled.
Volunteering activity. Your shift signups, waitlist entries, withdrawals, cancellations, check-in and attendance records, and the participation history built from them.
Requirement and waiver evidence. When an organization requires a waiver, we store the notification email its waiver provider sends to VolunAura, the intake record created from it, and the manager approval that marks you as meeting the requirement for the dates it covers.
Security and anti-abuse records. For events such as sign-in attempts, signups, and link requests, we record the IP address, the browser user agent, the email address involved, whether the attempt succeeded, and the time. Rate limiting uses a keyed hash of the IP address held in a short-lived cache rather than the address itself.
Email delivery records. The messages we send you, the addresses they were sent to, and the delivery, bounce, and complaint results reported by our email provider. The provider's full copy of a message is deleted 30 days after it is recorded.
Why we use it
- Running signups, waitlists, rosters, and attendance for the organizations you volunteer with.
- Sending sign-in links, signup confirmations, reminders, cancellations, and messages from the organization.
- Letting managers see whether a volunteer has met a requirement the organization set.
- Protecting the service from automated signups, spam, and credential attacks.
- Diagnosing problems and supporting people who contact us.
Who can see it
Managers at the organization. Authorized managers see the name, email address, signup status, attendance, and requirement readiness of volunteers for their own organization's shifts.
Other volunteers and the public. Public shift pages show the opportunity, its schedule, location, and how many spots remain. They do not show who signed up. Rosters are not public.
VolunAura operators. Our administrators can reach stored records, logs, and delivery data in order to run and support the service.
Service providers. The companies listed below, to the extent their part of the service requires it.
We do not sell personal information, and we do not use it for advertising. We may disclose information if we are required to by law or if we believe it is necessary to protect someone's safety.
Service providers
- DigitalOcean — application hosting, database, and cache.
- S3-compatible object storage — uploaded images and files.
- Postmark — sending our email and receiving replies and provider notifications.
- Cloudflare Turnstile — checking that signups come from a person rather than a script.
- A waiver provider chosen by your organization — where an organization collects waivers through an outside service, that service sends VolunAura a notification email. Your relationship with that provider is governed by its own terms.
How long we keep it
Account, participation, attendance, and requirement records are kept while your organization uses VolunAura, and afterward as part of that organization's records.
Security and anti-abuse records, including IP addresses and browser user agents, are kept so that we can investigate abuse and account access problems. We do not currently delete them on a fixed schedule.
Rate-limiting data expires automatically. The email provider's copy of a message is deleted 30 days after it is recorded.
We do not offer automated data export or scheduled deletion today. Requests are handled by hand, as described below.
Corrections and deletion
Email privacy@volunaura.org to correct your information or to ask us to close your account and delete your personal information. We may confirm the request with you or with your organization before acting on it.
When we act on a deletion request, we remove or anonymize the records that identify you. We keep attendance, requirement and waiver evidence, and security records that the organization or VolunAura needs as a record of what happened, anonymized where we practically can. We cannot delete a message that has already been sent to someone's mailbox.
Children
VolunAura accounts are not intended for children under 13, and we do not knowingly create them. Organizations set their own minimum age for a shift and are responsible for any parental consent their volunteers need. If you believe a child has an account, email privacy@volunaura.org and we will remove it.
Changes and contact
We may update this notice as the service changes. The effective date at the top of this page shows when it last changed.
Privacy questions: privacy@volunaura.org. Everything else: support@volunaura.org.