Privacy Policy
Draft last updated August 2026
⚠️ Draft for legal review — not yet reviewed by an attorney
Fundraising, payment processing and prize promotions are regulated, and the rules differ by state and country. Text in [SQUARE BRACKETS] is a fact that has not been filled in. Have counsel review and complete this document before accepting real donations.
This policy explains what Unlock for Good collects, why, and what you can do about it. It is written to describe what the software actually stores — if you find a discrepancy, tell us at [CONTACT EMAIL] and we will correct the software or this document.
1.What we collect
Identity: your name and email address, and a phone number only if you provide one. If you create an organizer account we store a cryptographic hash of your password, never the password itself. Participation: which campaigns you join, when your unlock timer starts and expires, when and how you unlocked, your referral code, and who referred you. Donations: the amount, its status, and the identifier our payment processor gives the transaction. Referrals: the challenge links you send, which channel you chose, whether they were opened, and whether they resulted in a donation. Prize promotions: your entries, where each came from, and whether you were selected as a winner. Email confirmation: a single-use token sent to your address when a campaign you join runs a prize promotion, and the time you confirmed it. Confirmation is only used to enforce the one-entry-per-person limit. Technical: a session cookie that keeps you signed in, and ordinary server logs including IP address, which are used for security and debugging.
2.What we never collect
We never receive or store your card number, expiry date, CVC, or bank details. Payment details are entered directly with our payment processor. We only learn that a payment succeeded, its amount, and its transaction identifier. We do not track you across other websites, we do not sell personal information, and we do not run third-party advertising trackers.
3.Why we use it
To run your unlock timer and decide when you may unlock for free; to credit your donation to the correct campaign; to attribute referrals to the person who sent them; to determine prize promotion entries and select winners; to show a campaign organizer who is participating in their own campaign; to prevent fraud and abuse; and to meet legal and tax obligations. [If you offer the Platform in the UK/EU, counsel should map each purpose to a lawful basis under UK/EU GDPR — contract, legitimate interests, consent, or legal obligation.]
4.Cookies
We send email only for things you caused: confirming your address for a giveaway entry, a receipt for a donation you made, a reminder when your timer finishes, and a notice if you win. There is no marketing email and no mailing list. We use a single essential cookie to keep you signed in. It is not used for advertising or cross-site tracking. Some campaign settings you choose in your own browser — such as where you dragged the countdown badge, or whether you minimized it — are stored locally on your device and never sent to us.
5.Who can see your information
Campaign organizers can see the participants in their own campaign: name, email address, status, donation amount, unlock method, referral activity and entry count. They cannot see your activity in anyone else's campaign. Service providers process data on our behalf: our payment processor, our hosting provider and our database provider. They are bound to use it only to provide those services. We may disclose information where required by law, or to protect the rights and safety of users and the public.
6.Notifications
A campaign may offer browser notifications while you wait. These are only ever sent after you press the button and your browser grants permission, never on arrival, and are limited to at most three per wait. You can revoke the permission in your browser at any time; the countdown continues regardless.
7.How long we keep it
Participation and donation records are kept while the campaign is active and afterwards as long as needed for accounting, tax and dispute purposes — ordinarily [RETENTION PERIOD]. Session records expire automatically. You may ask us to delete your account sooner, subject to records we must retain by law.
8.Your choices and rights
You may ask us to give you a copy of your data, correct it, or delete it. Write to [CONTACT EMAIL] and we will respond within [RESPONSE WINDOW]. Depending on where you live you may have additional rights — for example under the California Consumer Privacy Act, or under UK/EU GDPR the rights to object, restrict processing, port your data, and complain to a supervisory authority. We do not sell or share personal information as those terms are defined by the CCPA.
9.Children
The Platform is not directed at children under 13 and we do not knowingly collect their information. Participants between 13 and 18 need a parent or guardian's consent and may not donate. If you believe a child has given us information, contact [CONTACT EMAIL] and we will delete it.
10.Security
Passwords are stored as salted hashes. Traffic is encrypted in transit. Access to the production database is restricted. No system is perfectly secure, and we cannot guarantee absolute security; if a breach affects you we will notify you as required by law.
11.International transfers
Our infrastructure is located in [DATA LOCATION]. If you use the Platform from elsewhere, your information will be transferred there. [Counsel to specify a transfer mechanism if the Platform is offered in the UK/EU.]
12.Changes and contact
We will post any change to this policy here and update the date above. For anything in this document: [SPONSOR LEGAL NAME] [MAILING ADDRESS] [CONTACT EMAIL]
Questions about this document: [CONTACT EMAIL] · [MAILING ADDRESS]