Citoya connects students with community-service opportunities and is free forever for students. This policy explains what we collect, why, who can see it, and the choices you have. We collect the minimum needed to run the service, we do not use advertising or third-party analytics, and we never sell your data.

What we collect

• Account details. Students provide a name, email, password, and date of birth (used to enforce the minimum age and the guardian-consent and award rules; see below). Organizations provide an organization name and contact email; if an organization is on a paid plan, we also store a billing-processor account reference (a Stripe customer ID) so we know which subscription belongs to which organization.
• Guardian details (minors only). If you are a student under 18, we collect your parent or guardian’s name and email so we can request their consent. We also record the date/time, IP address, and browser of a guardian’s consent decision as proof of consent.
• Two-factor login. Optional for students and required for organizations and admins. If it is on, we store a random value used to check your codes, one-way hashes of your recovery codes, and the date you turned it on; the secret itself lives only in your authenticator app. We email you whenever it is turned on or off or your recovery codes are replaced.
• Activity. Opportunities you create or apply to, applications, verified volunteer hours, awards, reviews, endorsements, saved opportunities, the volunteering goals you set and the events you add to your own calendar (shown only to you and in your data export), in-app notifications, and messages you send through the platform. If you log volunteering you did outside Citoya, we store what you describe (the activity, date, hours, and an optional supervisor and note); it is shown only to you and in your data export, is always marked self-reported and unverified, and is deleted with your account.
• Aggregate usage counts. We count how many times each part of the site is used per day — for example “the opportunity page was opened 40 times today.” These counts are totals only: they record no account, no IP address, no device or session identifier, and no time more precise than the day, so they cannot show what any individual person looked at. We use them to see which features are worth keeping and where the service is breaking. An organization can also see totals for its own listings — how many times a listing was opened, how many people it approved, and hours it verified — on the same terms: totals only, with no record of who looked.
• What we do not collect. No advertising or tracking identifiers, no third-party analytics (the counts above are our own, and no data about your visit is sent to any analytics company), and no cookies of our own — Citoya itself sets none. The bot-check on the sign-up and password-reset forms, and on login after repeated failed attempts, is run by Cloudflare, whose script may set its own cookie in your browser to remember that the challenge was solved; that is Cloudflare’s, not ours, and we do not read it. Payment card details for organization subscriptions are handled by our payment processor (Stripe) and never touch our servers.

Sign-in mechanism (no cookies)

Citoya does not use cookies to sign you in or to track you (see the Cloudflare bot-check note above for the one cookie we do not control). When you log in, your browser stores a sign-in token in localStorage, which is sent with your requests to keep you logged in; a small number of interface preferences may also be stored there. Nothing in localStorage is used for tracking or advertising. You can clear it any time by logging out or clearing your browser’s site data.

Why we use it

• Run your account: authenticate you (sign-in token), and let you manage your profile.
• Match & apply: show relevant opportunities and let you apply; the date of birth drives age-based award tracking and the consent gate.
• Verify service: record hours and let organizations verify them, and recognize awards for verified hours.
• Communicate: send in-app notifications, guardian-consent requests, and transactional emails (see Email, below).
• Keep it safe: bot protection, rate limiting, and an append-only audit log of security-relevant actions (logins, consent decisions, deletions), kept for 12 months.

Who sees what

• Organizations you apply to see the details relevant to your application (including your name and email) only after you apply to one of their opportunities. This is scoped to that organization.
• Public surfaces minimize minor names. The public leaderboard, any public service portfolio, and reviews shown on an organization’s page all show a minor’s name as first name and last initial only — never a full last name.
• Your service portfolio is private by default and public only if you opt in; for a student under 18, making it public requires verified guardian consent. A private or unknown portfolio link returns a generic “not found” and never reveals whether an account exists.
• Your calendar link (optional). If you create a calendar link for Apple or Google Calendar, the calendar app you give it to (and anyone else who has the link) can see your signups and your own calendar events, including their times and addresses. It stops working as soon as you reset it, turn it off, delete your account, or, for a student under 18, when guardian consent is not in place.
• Service providers. We share data with vendors only as needed to run the service, for example, email delivery (Resend), payment processing for organization subscriptions (Stripe), error monitoring (Sentry, which receives technical error reports scrubbed of your personal information — no name, email, IP address, or form contents), and bot-defense on sign-up (Cloudflare Turnstile, which receives your IP address and a solved-challenge token, not your account details), under confidentiality obligations. We never sell or rent personal data.

Guardian rights

When a student under 18 signs up, we email the listed guardian a link to approve or decline the account. If no parent or guardian approves a student’s account within 7 days of the latest approval request, we delete the account automatically, along with the guardian name and email address the student gave us. If a parent or guardian declines, we delete the account right away, and the student can sign up again later. If approved, the guardian receives a separate long-lived link that lets them revoke consent at any time; revoking immediately re-blocks the student from applying, messaging, checking in, submitting or appealing hours, leaving a review, or making a portfolio public. Revoking also reaches back over what is already public, not just what happens next: any still-active application is withdrawn and its spot released to the next student waiting, and the student’s name and any reviews they wrote stop appearing on public pages — including the review count and average rating shown on an organization’s page, which are recalculated without them. An organization keeps its own record of hours it already verified, shown as a deactivated participant without saying why. Guardians who have questions or want a student’s data removed can contact us at support@citoya.com. A deletion made by a guardian takes effect immediately and cannot be undone by the student.

Your rights & choices

• Access & export. Download a JSON copy of your data (profile, applications, hours, messages, reviews, notifications, goals, and your own calendar events) from the Account section of your dashboard (“Download my data”). The export excludes internal security fields such as your password hash and consent-decision IP.
• Correct. Update your details any time in your account.
• Delete. Delete your account from the Account section of your dashboard (password required). Your account is deactivated immediately, and your personal data is permanently removed 48 hours later; logging in before then restores the account (any signups released when you deleted it are not restored). Honest caveat: so that an organization’s record of already-verified service survives, your applications and verified-hours history are kept in anonymized form with your name and identifying details removed — including any note, supervisor name, or appeal text attached to those hours — and entries in the append-only security audit log are retained for up to 12 months from the date of the event. Backups: deleting removes your data from our live database; copies already in our backups are deleted as those backups expire, within 90 days. If we ever had to restore a backup, data deleted after that backup was taken could reappear. Messages you sent are handled the same way: the entry stays in the conversation so the other person’s thread has no gaps, but the text you wrote is removed along with your name. Organizations must deactivate active listings before deleting. If an organization deletes its account, its name and listing titles stay on the volunteer records of students it served; its listing descriptions and locations are removed.

Email

We send transactional email only: things like application updates, hour verifications, guardian-consent requests, and password resets. A message notification email includes the sender’s name and a link to read the message on Citoya, and a guardian email includes the student’s name and the guardian’s approve or manage link. Our email provider (Resend) keeps its own logs of the emails we send under its own retention policy; deleting your Citoya account does not remove those copies. There is no marketing email. You can turn off non-essential notification emails with the email-notifications toggle on the Notifications page; security and consent-critical messages may still be sent.

Data retention & security

We keep your data while your account is active and remove personal data 48 hours after you delete your account (logging in before then restores it), subject to the anonymized-service-record caveat above. This includes a student account whose guardian declined or has not answered the consent request: its data is kept until the account is deleted. The security audit log — the record of logins, consent decisions, password resets and deletions — is kept for 12 months and then deleted by age; entries are never removed individually, because a log anyone can edit is not a record. Passwords are stored using a strong one-way hash (Argon2), never in plain text, and traffic is encrypted in transit (HTTPS). No system is perfectly secure, but we follow industry practices to protect your information.

Children’s privacy

Citoya is used by students who may be minors, and we build for that. Students under 13 are not permitted to register. Students aged 13–17 may create an account, but a parent or guardian must verify consent before the student takes any real-world-contact action: applying, messaging, checking in, submitting or appealing hours, leaving a review, or making a portfolio public. We collect only what’s needed for volunteer matching and hour tracking, and we minimize minors’ names on all public surfaces. If you believe a child under our minimum age has provided information, or a minor is using the service without appropriate guardian consent, contact us at support@citoya.com and we will address it.

Your regional rights (CCPA / GDPR)

Depending on where you live, you may have rights to access the personal data we hold about you, request its deletion, and obtain a portable copy. Citoya supports all three directly: access and portability through the data export, and deletion through account deletion, both in your dashboard’s Account section. We do not sell personal information or use it for targeted advertising. To exercise a right you can’t complete in-app, or to ask a question, contact us at support@citoya.com.

Changes & contact

We may update this policy; material changes will be reflected by the date at the top. Questions or requests: support@citoya.com. See also our Terms of Service.