Privacy Policy
Last updated October 4, 2026
Elpys ("we," "us") runs elpys.vercel.app — a directory of verified volunteer opportunities for teens in the Bellevue, WA area. This page explains what we collect, why we collect it, who else ends up seeing it, how long we keep it, and what you can ask us to do about it. It's written in plain language on purpose. If anything here is unclear, email us (see "Contact" at the bottom) and ask.
Elpys is built for teens age 13 and older. It isn't directed to children under 13, and we don't knowingly collect personal information from them — see section 11.
The short version
- You can browse the entire site without an account and without telling us anything about yourself.
- An account needs one thing: an email address. Everything else is optional.
- We don't sell your information, we don't share it for advertising, and Elpys doesn't run ads.
- Our analytics is anonymous — no cookies, no session recording, no profile of you.
- You can delete your account, and everything attached to it, yourself, at any time.
The rest of this page is the detail behind those five points.
1. What we collect
What we collect depends entirely on how you use the site:
| If you... | We collect | Why |
|---|---|---|
| Just browse listings | Nothing that identifies you to us. Some technical information is handled automatically to deliver the page — see "Automatically, on any page" below. | Showing you the site. |
| Create an account | Your email address, and the password you choose. The password is handled entirely by our authentication provider, Supabase, and stored only as a cryptographic hash — we never see it and can't recover it. Because it's an Elpys-only password, don't reuse one from another site. | Logging you in and sending you the weekly digest. |
| Set interests and availability | The categories and the days/times you pick, stored with your account. Both are optional and you can edit or clear them any time from your account page. | Deciding which new listings go in your weekly digest. |
| Use the "starting place" box on the map | Nothing, on our side — we don't store it. But the address or place name you type is sent to OpenStreetMap's Nominatim geocoder and the OSRM routing service so they can draw the route, and those services receive it. If you'd rather not hand a third party your exact home address, use a cross-street, a school, or a nearby landmark instead. | Drawing driving directions to an opportunity. |
| Submit an opportunity for listing | Everything you type into the form — the organization's details and contact information, and anything you put in "Notes for the reviewer." Please don't put confidential or personal information in that box: it isn't displayed anywhere on the site, but it is stored on the listing record, and once a listing is published that record is served by our database's public read interface. Treat it as "not displayed," not as "private." | Reviewing the submission and, if it qualifies, publishing the listing. |
| Send feedback about a listing | Your message, the page it's about, and your email address if you choose to give one — that field is optional, and feedback works fine without it. | Fixing or removing listings, and replying to you if you asked us to. |
| Automatically, on any page | Our web host (Vercel) records standard server-log information, including your IP address, the page requested, and your browser type. When you submit a form, the IP address is also held briefly in our server's memory to rate-limit spam, and Cloudflare Turnstile runs its bot check. One anonymous analytics event is recorded — see section 5. | Serving the site, keeping it online, and blocking spam and abuse. |
We never ask for your name, your exact age or date of birth, your phone number, your address, your school, or your location. Elpys doesn't request access to your device's location, camera, or microphone, and the site is configured to block those requests outright.
2. How we use it
- Account and login: to let you log in and manage your account.
- Weekly digest email: to send you new opportunities matching the interests and availability you've set — only if you have an account with an email on file and haven't unsubscribed. Every digest includes a one-click unsubscribe link.
- Submissions and feedback: to review and, where accurate, publish new listings, and to fix or flag problems with existing ones. A real person reviews every submission before it goes live — nothing is published automatically. When a submission or feedback arrives, a short notification is emailed to our own inbox (hello.elpys@gmail.com) so it doesn't sit unread; see Google in section 6.
- Replying to you: if you email us, or give us an email address with your feedback, we use it to answer.
- Keeping the site working and honest: spam prevention, rate limiting, security, and the anonymous usage counts described in section 5.
3. What we never do
- We do not sell your personal information, and we never have.
- We do not share it for advertising of any kind, including cross-context behavioral or targeted advertising. Elpys doesn't run ads.
- We do not share it with data brokers, and we do not use it to train AI models.
- We do not build advertising or behavioral profiles, and we do not make automated decisions about you.
- We do not record your screen, your typing, or your mouse movements.
- We do not add people who submit an opportunity or send feedback to any mailing list.
4. Cookies and local storage
Elpys sets no advertising or tracking cookies. Three things do use your browser's storage:
- Staying logged in: if you have an account, your login session is kept in your browser's local storage. This is what makes accounts work; it isn't used for tracking, and it goes away when you log out.
- The notice banner: once you dismiss it, that fact is stored for the rest of your browsing session so it doesn't reappear on every page.
- Spam prevention: Cloudflare Turnstile sets its own short-lived verification cookie when you submit one of our forms.
Our analytics is configured to use no cookies and no persistent identifiers at all.
5. Analytics
We use a small amount of anonymous, aggregate analytics — through PostHog — to understand which parts of the site are actually useful, so we can improve them. What's recorded:
- Page views (which page, when).
- Two specific actions: clicking a listing's sign-up button, and successfully submitting the opportunity form or the feedback form. The event records only that the action happened — never what you typed.
- Basic page-performance measurements (how fast pages load), and technical details your browser sends with any web request, such as the browser and device type.
- No location, not even an approximate one. Because our analytics runs in a cookieless mode, your IP address is discarded before any step that could turn it into a location, so the country and city fields are permanently empty. We could not tell you what city our visitors are in even if we wanted to.
It is deliberately configured for privacy: no cookies or persistent identifiers, no session or screen recording, no blanket click tracking, and no identified user profiles — so nothing here can be tied to your account, your email, or a previous visit. Using the filters, the age box, or the map is not tracked. We can see that a page was viewed 40 times; we cannot see that you viewed it.
If your browser sends a Global Privacy Control or Do Not Track signal, we honor it. We don't sell or share personal information in any case, so there's nothing for it to switch off — but we won't override it either.
6. Who else is involved
We don't sell or rent your information. A small number of companies process data on our behalf, or receive some technical information simply because parts of the site load from them. All of them are listed here — there are no others:
| Who | What they do for Elpys | What they receive |
|---|---|---|
| Supabase | Hosts our database and handles account login. | Your email address, password hash, interests and availability; submissions and feedback. |
| Vercel | Hosts the website and runs its server functions. | Standard server-log data, including your IP address and browser type. |
| Cloudflare | Turnstile, the "are you a real person" check on our forms. | Your IP address, browser information, and a temporary verification token, when you submit a form. |
| Sends the weekly digest through Gmail, delivers short notifications to our own Gmail inbox when a submission or feedback arrives, and serves the site's web font. | Your email address, for the digest. For the notifications: only that feedback arrived (never what it says or your email address), and a submitted listing's name, categories, date or schedule type and number of photos (never the submitter's contact details). For the font, your IP address and browser, on any page. | |
| PostHog | The anonymous analytics in section 5. | Anonymous page views and events. Your IP address reaches them with the request, as it must for any web request, but it is discarded before processing and no location is derived from it. |
| OpenStreetMap | Supplies the map tiles, and the Nominatim geocoder behind the map's "starting place" box. | Your IP address when the map loads, and the starting place you type, if you use that box. |
| Project OSRM | Calculates the driving route drawn on the map. | Your IP address and the start and end coordinates of the route. |
| jsDelivr and unpkg | Content-delivery networks that serve two open-source code libraries the site uses. | Your IP address and browser, on the pages that load them. |
Each of these has its own privacy policy governing what it does with what it receives. We may also disclose information if we're legally required to — for example, in response to a valid subpoena or court order — or where it's necessary to protect someone's safety. That has never happened, and if it ever does we'll tell you unless we're legally prohibited from doing so.
7. How long we keep things
We don't keep personal information indefinitely. Specifically:
| What | How long |
|---|---|
| Your account and profile (email, interests, availability) | Until you delete your account. Deleting it removes both the account and its profile record immediately and permanently. |
| Feedback you send us | Up to 12 months, and deleted sooner once the problem it reports is fixed. Feedback isn't linked to your account, so deleting your account doesn't remove it — email us if you'd like it removed earlier. |
| Opportunity submissions | Published listings are kept as long as the listing is on the site. Submissions we decline are deleted within 12 months. |
| Server logs (IP address, request details) | Kept by Vercel under its standard log retention — a short period, measured in days — then discarded. We don't copy them anywhere else. |
| Spam rate-limiting records | IP addresses are held in server memory for at most one hour and are never written to our database. |
| Anonymous analytics | Retained in aggregate by PostHog. Because it was never linked to you in the first place, it can't be traced back to you or individually deleted. |
8. Your choices and your rights
You can do all of this yourself, any time:
- Unsubscribe from the weekly digest — every email has a one-click unsubscribe link, and you can also turn it off from your account page.
- Edit or clear your interests and availability from your account page.
- Delete your account from your account page. This permanently removes your account and its profile record — email address, interests, availability — and stops all digest emails.
And you can always ask us to:
- Tell you what we hold about you and give you a copy of it.
- Correct anything that's wrong.
- Delete something specific — including feedback or a submission you sent us.
Email hello.elpys@gmail.com and we'll take care of it. We'll reply within 45 days and usually much sooner. We may need to confirm that you control the email address in question first, so that we're not handing your information to someone else. Asking never costs anything and we won't treat you differently for asking.
Elpys is small enough that it isn't currently covered by laws like the CCPA or the GDPR. We offer these rights anyway, to everyone, because they're the right thing to offer.
9. Security
What we do: the whole site is served over HTTPS and is protected by a strict content-security policy and related browser security headers. Passwords are hashed by Supabase; we never see them. Database access is locked down with row-level security, so one account can only ever read its own profile, and the tables holding feedback and internal review notes aren't publicly readable at all. The admin panel is password-protected and rate-limits guessing. Only the person who runs Elpys has administrative access.
What we can't promise: no website is perfectly secure, and Elpys is a one-person project, not a company with a security team. If a breach ever affects your information, we'll email you and tell you what happened, what to do about it, and what we're doing about it — within 30 days at the outside, as Washington law requires, and realistically much faster than that.
10. Where your information is handled
Elpys is run from the United States and every provider listed in section 6 processes data in the United States or in the region where it operates its own infrastructure. Elpys is built for people in the Bellevue, Washington area and isn't offered to people in the EU or UK. If you use it from outside the United States, your information will be handled in the United States.
11. If you're under 13 — and a note for parents and guardians
Elpys is intended for teens age 13 and older. It isn't directed to children under 13, and we do not knowingly collect personal information from them. Creating an account requires confirming you're 13 or older. We don't ask anyone for an exact age or a date of birth, on this site or anywhere else.
Anyone can read the listings without giving us anything at all, and we'd rather a younger kid browse with a parent than be turned away — but please don't create an account, submit an opportunity, or send us feedback if you're under 13.
Parents and guardians: if you believe a child under 13 has given us personal information, email hello.elpys@gmail.com and we will delete it and any associated account promptly, without requiring you to prove anything beyond enough detail to find the record. You can also ask us at any time to tell you what we hold about your child, or to stop collecting anything further.
12. Changes to this policy
If this policy changes in a meaningful way, we'll update the date at the top of this page and note the change on the site. Elpys is small and actively developed, so it's worth checking back occasionally. We'll never apply a materially different use of information we already hold without telling you first.
13. Contact
Questions about this policy, about what we hold, or about anything on this page? Email hello.elpys@gmail.com. A real person reads it.