Privacy
What we collect, and what we do with it
Short version: we only ask for what we need to send cards, credit your hours, and reply to you. We don't sell anything to anyone, ever.
The short version
- We collect what you type into our three forms, and nothing else about you.
- Only our volunteer editors can see it. We never sell or share it for marketing.
- We delete things on a schedule, automatically — the details are below.
- Email hello@hearts4hands.org any time to see, correct, or delete what we hold about you.
- The terms of use cover accounts, hours, and what happens to a story you send.
What we collect, and why
Three forms on this site collect information. Nothing else on the site asks you for anything.
Volunteering and logging hours
Your name, email, country, and optionally your state, city, school, age range, what you'd like to help with, the hours you logged, how many cards you made, when you made them, any notes you add, and a photo of your cards if you upload one.
We need this to confirm your hours are yours, to certify them if you're working toward a service award, and to email you the current hospital mailing address. Your school and age range are optional and only help us group volunteers sensibly.
Sending us a story
Your name, email, optionally where you live, and the story itself.
An editor reads every submission. We'll email you before anything is published, and nothing goes up without your say-so. You can ask to be published under a first name only, or to withdraw your story at any point — before or after it's live.
Contacting us
Your name, email, the topic you pick, and your message.
Only so we can reply. We don't add you to any mailing list — we don't have one.
Your account
Logging hours and sending stories need an account, so we know whose work is whose and can put the right name on a certificate. An account holds the volunteer's name, an email address, an age range, and a country. Your password is stored by Supabase, our database provider, scrambled in a way that means nobody at Hearts4Hands can read it — including us.
You can sign in with a password or ask for a one-time link by email, whichever you prefer. Reading the site — stories, the card guide, the donate page — never needs an account, and neither does sending us a message.
Clubs
If you join a school club, whoever runs it can see your name and the hours and cards we've approved for you. That's all. They cannot see your email address, where you live, your photos, your stories, or anything still waiting to be checked.
You can leave a club whenever you like. Hours you already logged stay counted in its total and on your own record.
Photos of cards
If you upload a photo to prove the cards you made, it goes into private storage that the public cannot reach. Only a signed-in editor can open it, through a link that expires after two hours.
Please photograph the cards themselves — not people. If a photo you send includes someone's face, or a name and address on an envelope, tell us and we'll delete it.
How long we keep things
| What | How long |
|---|---|
| Stories we decide not to publish | Deleted automatically 30 days after the decision |
| Messages you send us, once we've replied | Deleted automatically 7 days after being marked done |
| Volunteer hour records | Kept while you're volunteering with us, so awards can be verified. Ask us and we'll delete them. |
| Photos of cards | Deleted with the hour record they belong to |
| Your account | Until you ask us to close it. Then your hour records are anonymised, not deleted, so published totals stay accurate |
| Published stories | Stay up until you ask us to take yours down, then it comes down |
Who can see it
Only Hearts4Hands editors, who sign in to a private admin area. Accounts are created by hand — nobody can register themselves. Submissions are never public until an editor publishes a story you approved.
We use a few companies to run the site, and your information passes through them: Supabase stores the database and photo uploads, Vercel hosts the site, and if we've switched on confirmation emails, Resend sends them. They process it on our behalf and don't get to use it for anything else. We don't sell or rent your information to anyone, and we don't run advertising.
Cookies and site statistics
We don't use advertising or tracking cookies, and we don't follow you around other websites. The only cookie we set is the one that keeps an editor signed in to the admin area — if you're not an editor, you never get one.
We count page views to see which pages are useful — how many people opened the volunteer page, which stories get read. These are totals only. They aren't tied to you, no cookie is used, and we can't tell who read what.
Young volunteers
Under 13: the account is set up and held by a parent, guardian, or teacher — their email, their password, their inbox. It carries the child's name, because the child did the volunteering and the certificate names them, but we never ask for the child's own email address or their school. Every message goes to the adult. Choosing “Under 13” at sign-up switches all of this on automatically.
These accounts can log hours and cards but cannot submit stories. Publishing a child's writing under their name is a public disclosure that needs a stricter kind of parental permission than an account can carry, so we don't take it at all.
13 to 17: you can sign up yourself. Please check with a parent or guardian first — the form asks you to confirm you have.
A parent or guardian can email us at any time to see what we hold about their child, correct it, or have it deleted, and we'll do it without asking for a reason.
Asking us to delete something
Email hello@hearts4hands.org from the address you signed up with, or tell us enough to find your entry. You can ask us to:
- send you a copy of everything we hold about you
- correct anything that's wrong
- delete your hour records and any photos you sent
- take a published story down, or republish it under a different name
- close your account entirely
Closing an account anonymises your hour records rather than erasing them: the hours stay in the totals we publish, but stop being connected to you. If you'd rather they were deleted outright, say so and we'll do that instead. Published stories stay up unless you ask us to remove them.
We'll do it within 30 days, usually much sooner. We won't ask you to justify it, and it won't affect your ability to keep volunteering.
Changes
If we change how any of this works, we'll update this page and change the date below. This policy was last updated on August 11, 2026.
Questions about any of it? Email hello@hearts4hands.org. A real person reads it.
Still want to help?
Now you know exactly what we'd be asking for.