Handful of Angels, Inc. ("HOA," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website at handfulofangels.com, our mobile application, and all related services (collectively, the "Platform"). By using the Platform, you agree to the collection and use of your information as described in this Privacy Policy.
1. Information We Collect
Information You Provide Directly
- Account Information: Full name, email address, password (stored as a one-way cryptographic hash — we never store your actual password), phone number (optional), date of birth (optional), and profile photo (optional).
- Campaign Content: Survivor's name and email, cancer type, campaign title, description, media (photos, videos), and fundraising goal.
- Donations: Donation amount, tip amount, and whether the donation is anonymous. Payment card details are collected directly by our payment processor (Moov Financial) and are not stored on our servers.
- Beneficiary / KYC Verification: Full legal name, date of birth, residential address, last four digits of Social Security Number (or full SSN if required by the payment processor), and bank account information.
- User Content: Posts, comments, well-wishes, photos, videos, voice recordings, reactions, and email addresses of people you invite to campaigns.
- Social Login: If you sign in with Google, we receive your name, email, and profile photo. If you sign in with Apple, we receive your name and email (which may be Apple's private relay email).
Information Collected Automatically
- Device & Browser Information: Device type (mobile or desktop), browser type and version, operating system, screen resolution, language preferences.
- Usage Information: Pages and features accessed, timestamps of activity, referring URLs.
- Network Information: IP address and approximate geographic location derived from IP address (city/region level, not precise GPS).
- Security Data: Device fingerprint (a hashed combination of device characteristics, used solely for fraud prevention — not for advertising), trusted device records, session information, and failed login attempt counts.
Information We Do NOT Collect or Store
- Full credit/debit card numbers, CVV codes, or expiration dates — these are processed exclusively by Moov Financial.
- Precise GPS location — we do not request GPS coordinates from your device.
- Contacts or address book — we do not access your device contact list.
- Health records or medical data — campaign descriptions referencing cancer diagnoses are user-generated content, not medical records.
- Advertising identifiers (IDFA/AAID) — we do not collect Apple's or Google's advertising IDs.
2. How We Use Your Information
- Creating and managing your account, processing donations and fund disbursements, and verifying your identity for payment purposes.
- Displaying campaign content, posts, and supporter information, and delivering campaign invitations and notifications.
- Sending transactional emails (verification, password resets, donation confirmations), campaign notifications, and security alerts.
- Detecting and preventing fraudulent campaigns, transactions, and accounts, including donation velocity limits and device verification.
- Enhancing content using AI-assisted tools (such as photo captions for memorial campaigns).
- Analyzing aggregated, de-identified usage patterns to improve the Platform and diagnosing technical issues (via Sentry in the mobile app, with IP addresses stripped).
- Complying with applicable laws, responding to legal processes, and maintaining required financial records.
3. How We Share Your Information
We do not sell your personal information.
With Other Users
Campaign pages display the Angel's name, Survivor's first name, campaign description, and supporter names. Posts and comments display the author's name and profile photo. Donations display the donor's name and amount unless the donor chooses to be anonymous. Anonymous donations hide your name from public view but your identity is retained in our records.
With Service Providers
- Moov Financial — Payment processing, KYC verification (name, DOB, address, SSN, bank details, transaction data)
- Google Cloud Platform — Cloud hosting, file storage (all platform data, encrypted at rest and in transit)
- SendGrid / Twilio — Transactional emails (email address, name, email content) and SMS verification (phone number, codes)
- Sentry (mobile app only) — Error and crash reporting (error data, device info, user ID; IP addresses stripped)
- Google Analytics (website only) — Aggregated usage analytics (page views, anonymized patterns)
- Tremendous — Gift card delivery (recipient email, gift card details)
For Legal Reasons
We may disclose your information if required by law, subpoena, court order, or government request, or to protect our rights, prevent fraud, protect personal safety, or defend against legal liability.
Business Transfers
If HOA is involved in a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
4. Cookies and Tracking Technologies
We use cookies and similar technologies to maintain your session and keep you securely signed in:
- Essential Cookies: Authentication tokens (httpOnly, Secure), active campaign selection, and device type detection. These cannot be disabled without losing Platform functionality.
- Analytics Cookies: Google Analytics (GA4) cookies that help us understand usage patterns in aggregate. These do not collect personally identifiable information.
For detailed information about every cookie we use, see our Cookie Policy.
5. Push Notifications
With your consent, we may send push notifications to your browser or mobile device about campaign updates, new messages, and other activity. You can manage or disable push notifications at any time through your device settings or your notification preferences within the Platform.
6. Data Security
We implement industry-standard security measures to protect your information:
- All data transmitted over HTTPS/TLS and encrypted at rest on Google Cloud Platform.
- Passwords hashed using Argon2, a memory-hard algorithm resistant to brute-force attacks.
- Multi-factor authentication available for all users and required for administrative accounts.
- Rate limiting on login attempts, API calls, and donation transactions.
- Strict Content Security Policy (CSP), HSTS, X-Frame-Options, and other security headers.
- Incoming webhooks verified using HMAC-SHA512 signatures with timestamp validation.
- Append-only financial audit trail for all fund movements.
- Sessions automatically expire after 15 minutes of inactivity.
Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide our services. Transaction records and financial ledger entries are retained for a minimum of 7 years for legal and tax compliance. Deleted content (posts, comments) is soft-deleted and hidden from public view but retained in our database for audit purposes.
If you close your account, we will delete or anonymize your personal information within a reasonable timeframe, except where we are required to retain it for legal, regulatory, or fraud prevention purposes. Campaign content may be anonymized rather than deleted to preserve the community history for other participants.
8. Your Rights and Choices
- Access & Update: View and update your profile information through your account settings.
- Notification Preferences: Control which notifications you receive (security, campaign, social, marketing) through your notification settings.
- Trusted Devices: View and revoke trusted devices through your security settings.
- Marketing Opt-Out: Unsubscribe from marketing emails via the "Unsubscribe" link in any marketing email or through your notification preferences.
- Account Deletion: Request deletion by emailing support@handfulofangels.com. We will delete or anonymize your information within 30 days, except for legally required retention (financial records, audit logs).
9. State Privacy Rights
California Residents (CCPA/CPRA)
Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have the right to:
- Know what personal information we collect, use, and disclose about you.
- Request deletion of your personal information, subject to exceptions.
- Request correction of inaccurate personal information.
- Opt out of the sale or sharing of personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising.
- Non-discrimination for exercising your privacy rights.
- Limit the use and disclosure of sensitive personal information. We collect sensitive information (SSN for KYC) only as needed for payment processing and identity verification.
Categories of information we collect: Identifiers (name, email, phone, IP), financial information (donation amounts, bank details via Moov), internet/network activity (pages viewed, device info), geolocation (approximate, from IP), sensory data (voice recordings, photos, videos), and sensitive personal information (SSN for KYC only). None of these categories are sold or shared for advertising.
Other State Residents
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Oregon (OCPA), Texas (TDPSA), Montana, and other states with consumer privacy laws may have similar rights. Since we do not sell personal information or use it for targeted advertising or profiling, many opt-out rights are not applicable.
To exercise any privacy rights, contact privacy@handfulofangels.com with the subject line "Privacy Rights Request." We will verify your identity before processing your request and respond within the timeframe required by applicable law.
10. Children's Privacy
The Platform is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a child under 18, we will delete it promptly. Campaigns may be created on behalf of minors with cancer, but these campaigns are managed by adults (18+) and the minor is not required to create an account.
11. Email Tracking
Our email service provider (SendGrid) may use tracking technologies in emails, including open tracking (a small tracking pixel) and click tracking (links route through links.handfulofangels.com before redirecting). This helps us understand email engagement and improve communications. You can disable image loading in your email client to prevent open tracking.
12. Do Not Track
Some browsers transmit "Do Not Track" signals. There is no industry standard for how websites should respond to these signals. Currently, the Platform does not alter its data collection practices in response to DNT signals. We do not engage in cross-site tracking or targeted advertising.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy with a new effective date and sending a notification to your email for material changes. Your continued use of the Platform constitutes acceptance of the changes.