Privacy policy.

Account information. When you sign in with Google or Microsoft, we receive your email address and any name or profile photo the provider makes available. Your email is used to identify your account and is never shown on your public page, embedded in your contact QR, or shared publicly in any way.

Content you add. Your page, story, tags, organizations, volunteering, and Bio content remain private while they are drafts and become visible when you publish your Bio. Individual Pages use the audience you choose. Your Card is different: account creation makes a public Card with your name, provider photo, contact link, and QR, and fields you save in the Card editor update that live Card. Name, photo, headline, and social links are shared Card identity fields; changing them in the Bio editor also updates the live Card before the Bio is published.

Contact card details. If you add socials or contact details to your QR contact card, they are included in the card you share. Anything you mark private stays behind the password you set.

Page activity. We keep aggregate counts of page visits and link clicks, along with coarse location (country or city level) and device type, so page owners can see how their page is doing. We do not store raw IP addresses.

Messages and notes. A sender chooses from the visibility options available on the Page. A public message may appear on that Page. Non-public messages are limited to the sender and people authorized for that Page, such as its owner, organizers, administrators, or invited participants, depending on the option chosen. We may access messages as needed to operate or moderate the service.

Requests you sent us. If you asked us to draft a page for you through our earlier request form, we keep what you submitted (your name, email, and links) so we can build it and follow up.

We don’t sell your information. We don’t run ads or share your data with advertisers. We don’t put tracking cookies on your visitors. We don’t make a Bio or individual Page public without your publish or audience choice. The public Card created with an account is described above and during creation.

We use first-party cookies to keep you signed in, complete sign-in, claim, and invitation flows, and preserve access to Pages shared with a link. We also use browser storage for limited product state, such as unfinished message drafts and anonymous analytics session identifiers. There are no advertising or cross-site tracking cookies.

Your data is processed by a small set of service providers, solely to run WeStandFor: Google and Microsoft (sign-in), Supabase (database, sign-in sessions, and file storage), Vercel (hosting), and Resend (transactional email). Each receives only what it needs to do its job.

You can edit your Card and Bio at any time. A published Bio does not currently have a self-serve unpublish control; individual Pages can be made private. You can sign out whenever you like. If you want your account, public Card, Bio, Pages, and data deleted, email us and we’ll remove them.

We keep your account and page content while your account is active. If you ask us to delete your account, we remove your profile, drafts, and personal information from our systems.

WeStandFor is not directed to children under 13, and we do not knowingly collect their information.

If this policy changes in a meaningful way, we’ll update this page and the date at the top.

Questions or deletion requests: email hello@westandfor.org.