Privacy Policy

Effective 2026-09-07. The Von Terra Project, Inc. is a 501(c)(3) nonprofit corporation registered in Maryland (EIN 33-2041628).

This policy is written to be read, not to be survived. Where we are certain of something, we say it plainly. Where a thing is another company's to answer, we link you to their answer rather than paraphrasing it. Where we do not know, we say that too.

The short version

• We run no analytics, no advertising, and no tracking of our own.
• We never see your card number.
• Our programs are for adults. We do not knowingly collect information from anyone under 18.
• We do not sell, rent, or trade your information. Ever.
• Some pages load content from other companies, and those companies do set cookies. We say exactly which pages, below.

Who to contact

Email contact@vonterraproject.org with "Privacy" in the subject line. Privacy requests are handled by our Executive Director. Post: 17533 Redland Rd. #5582, Derwood, MD 20855.

Cookies, and the honest version of the cookie question

We do not set any cookies of our own, and we run no analytics, advertising, or tracking. But that is not the same as saying no cookies happen when you use this site, and we would rather tell you exactly where they do.

On our donation pages (Donate and CyberHERo), the Donorbox donation form loads Stripe and PayPal so you can actually pay. Doing that places two Stripe cookies (__stripe_mid, __stripe_sid) and PayPal storage entries on vonterraproject.org itself. They are set by those payment companies, for fraud prevention and to make checkout work, not by us and not for our benefit. We do not read them.

On our Documents page and our 2025 Report page, we embed a document preview from Google Drive. Loading either page causes Google to set at least one long-lived cookie on Google's own domain, before you click anything. If you would rather not, every one of those documents can be opened directly in Google Drive from the link on the page.

The donor wall on our donation pages is a frame served by Donorbox, and Donorbox runs its own analytics and monitoring inside it for its own purposes. We do not operate it, we receive none of its data, and we cannot see it.

We do not show a cookie banner. We would rather name the three specific places this happens, in advance, than put a click-through box in front of every page. If you want to avoid it entirely: donate on Donorbox's own page instead of ours, and open documents directly in Drive rather than viewing the previews.

Hosting, and what a web server sees

This website is a set of plain static files hosted on GitHub Pages. Our domain is managed through Cloudflare's DNS service, which only answers the question "where does vonterraproject.org live?" Your visit itself goes straight to GitHub.

GitHub's documentation states that when a GitHub Pages site is visited, the visitor's IP address is logged and stored for security purposes, whether or not the visitor has a GitHub account. As with any web server, other ordinary request information may also be handled along the way. GitHub delivers the site through its content delivery provider, Fastly. Both companies are in the United States, so visiting this site means your IP address reaches a US company. We have no access to those logs and never see them. GitHub does not publish how long it keeps them, so we cannot tell you a number rather than guess at one.

Their disclosures, not ours: GitHub's Privacy Statement.

Donating

Our donation form and donor wall are provided by Donorbox. The form appears inside our page, but it is Donorbox's software running on Donorbox's servers, not ours. Donorbox's policy is at donorbox.org/privacy. We link to it rather than summarise it, and we will be straight with you about one limit: that policy describes Donorbox's own website and does not separately describe how its embedded forms behave on other organisations' sites. What we say above about the donation pages is what we observed ourselves.

Your card

Card details are typed into fields hosted by Stripe and go to Stripe directly. Donorbox states that card numbers are converted into tokens before any charge is made, and that it keeps no record of the card number in its database or logs. The Von Terra Project never sees, receives, or stores your card number. Donorbox states that it is PCI-DSS compliant; that is Donorbox's compliance posture, and we link to their description of it rather than vouch for it ourselves.

What we actually receive when you donate

• Your first and last name
• Your email address
• The amount, and whether it repeats
• Any comment you choose to leave
• The country the donation came from, which Donorbox works out from your IP address and shows us as a fraud check

Our form does not ask for your mailing address or your phone number. Donorbox also runs its own anti-fraud checks, which can involve collecting technical information about your browser or device. That is Donorbox's process, not ours; we do not see the results and we do not use them.

The donor wall is opt-in. If you tick the boxes on the form, your first name, your donation, and your comment can be shown publicly. If you leave them unticked, they are not.

Applying to a program

Certification Program applications. Our Certification Program uses a Google Form. Applications are ranked on financial and social need, so the form asks things you would reasonably consider sensitive. Here is exactly what it collects, so you can decide before you start:

• Identity and contact: first name, last name, email address, and the time you submitted.
• Housing: whether you are experiencing homelessness, staying with others, unstable, or stable.
• Money: how you would cover an unexpected $400 expense; employment status; hours worked per week; whether you have used a payday loan, cash advance, or pawn shop in the last 12 months; whether you are struggling to repay student loans, medical debt, or credit card debt; whether your employer reimburses certifications.
• Public benefits: whether you are enrolled in SNAP, Medicaid, TANF, WIC, or LIHEAP.
• Health: whether you have health insurance, whether it is private, and whether you have postponed or gone without medical, dental, or prescription care because of cost.
• Household and history: whether you are a primary caregiver; hours per week committed to work or caregiving; whether you have been out of the workforce a year or more as a caregiver; whether you were ever in the foster care system.
• Background: education level; whether you are the first in your family to attend college; how often you have changed jobs in five years; whether you have reliable computer and internet access; whether you personally know anyone working in technology.

We score these answers automatically against a fixed rubric to produce a single ranking number. There is no minimum score and no cutoff: the ranking decides order of selection, not eligibility. Applicants not selected in one round roll forward to the next automatically, which means we keep your application rather than making you reapply.

Who sees it. Our Certification Program Manager and Executive Director. Your mentor is not shown your application. If you are selected and paired, your mentor receives what they need to coach you: the certification track you are working toward, your relevant background, and your availability. Not your housing, financial, health, or benefits answers.

Mentor applications. Our Mentorship Program uses a separate Google Form for people volunteering as mentors. It collects your name, contact details, professional background, certifications you hold, availability, and how many candidates you can take on. It does not ask the financial or personal-circumstance questions the candidate form asks.

Both forms are Google Forms, so your answers go to Google first and then to us.

Email and general correspondence

If you email us, we get your email address, your name if you signed it, and whatever you wrote. We keep it as long as we need it to help you and to keep an ordinary record of our correspondence. Our email runs on Google Workspace, so Google processes it as our email provider.

What we do not do

• We do not sell, rent, or trade your personal information.
• We do not use program application information for fundraising.
• We do not run advertising, retargeting, or behavioural profiling.
• We do not send marketing email to people who have not asked for it.

Children

VTP's programs are for adults. Every program we run, including the Certification Program and the Mentorship Program, is open to participants 18 and over. We do not run youth or K-12 programming, and we do not knowingly collect personal information from anyone under 18. The Children's Online Privacy Protection Act (COPPA) applies to online collection of personal information from children under 13; our website does not do that. If you believe a child has given us personal information, email us and we will delete it.

Your rights

These apply to everyone, wherever you live. You can ask us to show you what we hold about you, correct it, delete it, stop emailing you, or give you a copy. Email contact@vonterraproject.org with "Privacy" in the subject line. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

If you are in the EU or UK: for donation information we are the data controller and Donorbox acts as our processor. For information GitHub and Google collect through hosting and embedded content, those companies act for their own purposes rather than on our instructions, and their own policies govern what they do.

How long we keep things

Donation records are kept as long as tax and charitable-registration rules require, which is a matter of years, not months. Program applications are kept while you are in the pipeline and for a reasonable period after. Correspondence is kept as long as it is useful.

VTP's formal Document Retention and Destruction Policy is drafted but has not yet been adopted by the board. Until it is, the schedule above describes our operating practice rather than a ratified policy, and we would rather say so than imply a formality that does not yet exist.

Changes

If we change this policy we will change the effective date at the top. If we ever change it in a way that materially affects what we do with information we already hold, we will say so plainly rather than quietly reposting it.

This policy describes our practices honestly as of the effective date. It is not legal advice, and it has not yet been reviewed by counsel. Where it describes another company's behaviour, we have linked to that company's own statement so you can check it rather than take our word for it.