Privacy Policy

What we collect

Information you give us

• Hero application: name, date of birth, address, emergency contacts, brief medical and communication notes, demographic information used for grant reporting, image-release decision, and an electronic signature on the participation waiver.
• Volunteer application: name, address, date of birth, government-issued ID number (for the required background check), demographic information, and your acknowledgment of our code of conduct, image release, and liability waiver.
• Account credentials: email address and a password (stored hashed — we never see the plaintext) for the Hero/family/volunteer portal.
• Newsletter signup: name, email address, and your topic, frequency, and audience preferences.
• Contact form: name, email address, and the message you send.
• Donations and memberships: the amount, frequency, and your name and email address. Card details are entered on Stripe’s checkout page and stored by Stripe — they never reach our servers.
• Tribute gifts: if you make a gift in memory or honor of someone, the name you provide and the related dedication.

Information collected automatically

• Standard server log information from our hosting provider (Amazon CloudFront and Amazon S3) — IP address, browser type, the pages you requested, and timestamps — used to keep the site running and secure.
• For the staff portal: an internal audit log of administrative actions (who viewed or changed what, with timestamp and IP) to protect the data we hold.
• Analytics and advertising information collected by the Google services described in the “Cookies, analytics & advertising” section below.

How we protect it & how long we keep it

• All traffic to this site is served over HTTPS.
• Passwords are stored hashed using bcrypt — even our administrators cannot read them.
• Government-ID numbers and other sensitive PII are restricted to administrators with a documented need to view them, and access is recorded in our audit log.
• We keep Hero, family, and volunteer records while the relationship is active and for a reasonable period afterward (typically up to seven years) to support grant reporting and historical recordkeeping. Donation records are kept for the period required by tax law.
• If you ask us to delete your information, we will, unless we are required to keep it (for example, donation records for tax purposes).

Photos, image releases & media consent

• Every Hero application and volunteer application includes an explicit image release that the participant (or their guardian, where applicable) chooses to grant or decline.
• The image release covers photos and video taken at our activities, used on our website, social media, and printed materials to share what we do.
• We maintain a “do not photograph” list. If you decline the image release, or change your mind later, our staff and activity leaders are notified.
• If you spot a photo of yourself or a Hero you’re a guardian for that you’d like removed, email info@xceptionalheroes.org and we will remove it.

Cookies, analytics & advertising

Cookies set by XH

• The accessibility toolbar (text size, contrast, dyslexia font, reduced motion) saves your preferences locally in your browser so they’re applied the next time you visit. Nothing is sent to us.
• The Hero/family/volunteer portal uses a session cookie or token to keep you signed in.

Google Analytics

We use Google Analytics 4 to understand how visitors find and use the site. Google sets cookies in your browser and collects, on our behalf, information such as the pages you view, the time you spend, the site or search term you came from, your general location (approximate city, derived from your IP address), and basic device and browser information. We do not provide Google with your name, email address, donation amount, or anything you submit on a form.

You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on, or by using your browser’s privacy controls to block third-party cookies.

Google Ads

We may run paid ads on Google to invite people to learn about Xceptional Heroes, sign up a Hero, volunteer, or donate. When you arrive at the site from one of those ads, Google Ads conversion tracking sets a cookie so we can measure which ads brought people to actions like visiting our sign-up pages or completing a donation. We see the aggregate result (for example, “100 visitors from this ad signed up to volunteer”), not anything that personally identifies you. You can manage ad personalization in your Google Ad Settings.

More about Google’s practices

For more on how Google uses information from sites and apps that use its services, see Google’s page on how it uses information from sites or apps that use its services.

Third-party links

Our website may link to outside organizations (for example, on the Helpful Links page). We are not responsible for those sites’ privacy practices.