Privacy Policy

Effective date: October 1, 2026
Last updated: October 1, 2026

Volunteesy helps organizations track volunteer hours with as little friction as possible. That same principle applies to this policy: we collect only what we need to run the service, we never sell your information, and we've tried to write this in plain language.

This policy explains what we collect, why, who can see it, how long we keep it, and the choices you have. It applies to volunteesy.com, the Volunteesy web app (including when installed to your home screen), and any related services (together, the "Service").

Who we are. The Service is operated under the trade name Volunteesy ("Volunteesy," "we," "us"). You can reach us at privacy@volunteesy.com.

1. The two ways people use Volunteesy

Understanding your role helps you understand which parts of this policy apply to you.

Organizers are staff, board members, or coordinators at an organization (a nonprofit, theater group, school program, or similar) who create a Volunteesy account, set up programs, sheets, and jobs, and review volunteer hours. Organizers agree to our Terms of Service on behalf of their organization. You can also create personal sheets without joining an organization; you own those sheets and the hours or sign-ups recorded on them.

Volunteers are people who log hours for an organization or a personal sheet, typically by scanning a QR code or opening a unique link. Volunteers do not need a Volunteesy account to log hours, though they may optionally create one.

Who is responsible for volunteer data. When an organization uses Volunteesy to collect information about its volunteers, the organization decides what information to ask for and what to do with it. On a personal sheet, the sheet owner makes those decisions. In privacy-law terms, the organization or sheet owner is the "controller" (or "business") and Volunteesy is a "processor" (or "service provider") acting on its instructions. If you are a volunteer and have questions about how a specific organization or sheet owner uses your information, please contact them directly. We describe how we help in Section 9.

For organizer account data, our own website, and our own marketing, Volunteesy is the controller.

2. Information we collect

We follow a collect-only-what-we-need approach. Here is what that means in practice.

2.1 Information organizers provide

Account details: name, email address, password (stored as a one-way hash), and organization name.
Organization setup: programs, sheets, jobs and other slots, groups, locations, and the fields your organization chooses to ask volunteers for. Personal sheets store the same kinds of details without an organization.
Billing details: if you buy a premium sheet or subscribe to a paid plan, payment is handled by our payment processor, Stripe. Stripe collects your payment card and billing information directly; we do not store card details on our servers. We keep only a record of what you purchased (the plan or premium sheet, the date, and a Stripe reference) for support and accounting. Receipts are emailed by us or by Stripe on our behalf. Stripe's handling of your payment information is governed by its own privacy policy.
Imported data: if you upload a CSV of volunteer hours, we store the names, email addresses, dates, hours, and any other columns in that file. You are responsible for having the right to share that data with us.
Support communications: anything you send us by email or through in-app support.

2.2 Information volunteers provide

When you log hours via QR code or link, the form may ask for:

Identity: your name and email address (so the organization can match your hours to you across sessions).
Session details: the job or shift, date, time in, time out, or total hours, and any optional notes.
Program preferences: if you create an optional volunteer account, we may store per-program preferences you set (for example, your default group for that program).

Organizations can add their own optional fields. We do not review or restrict what an organization asks for, so if a form requests something that seems unnecessary, you may decline to provide it; the organization decides whether a field is required.

2.3 Information collected automatically

When you use the Service we automatically collect limited technical data:

Device and browser information: browser type, operating system, screen size, language, and whether the app is running as an installed home-screen app.
Log data: IP address, pages or screens viewed, timestamps, referring page, and error reports.
Check-in links and QR codes: each volunteer check-in link contains a signed token that identifies the program, sheet, or job the code was printed for. A personal hours sheet is identified by that sheet, with no organization. The token does not contain your personal information and cannot be used to identify you on its own.
Cookies and similar technologies: see Section 8.

2.4 Information we do not collect

We do not request precise geolocation. Scanning a QR code with your phone's camera happens on your device; we do not receive camera access or images.
We do not collect government IDs, Social Security numbers, background-check results, health information, or biometric data. If an organization needs that information for its own purposes, it must collect it outside Volunteesy.
We do not collect information from third-party data brokers.

3. How we use information

We use the information above to:

Provide the Service — record check-ins, calculate hours, generate reports and CSV exports, and display the organizer dashboard.
Match hours to the right person — for example, matching an imported CSV row to an existing volunteer by email address, then by name. Rows we can't match are stored as unassigned sessions so the organization can review them.
Run your account — authenticate logins, send transactional email (verification, password resets, security notices), and process payments through Stripe.
Support you — respond to questions and troubleshoot problems.
Keep the Service secure and reliable — detect abuse, prevent fraud, enforce our Terms, debug errors, and monitor performance.
Improve the product — understand which features are used, in aggregate, so we can make Volunteesy simpler.
Tell you about Volunteesy — send organizers product updates and, where permitted, occasional marketing. You can opt out at any time (Section 7). We do not send marketing email to volunteers.
Comply with law — respond to lawful requests and meet our legal obligations.

Legal bases (for people in the EEA, UK, and Switzerland). We rely on: performance of a contract (items 1–4); legitimate interests in running a secure, useful product (items 5–6, and item 7 for existing organizer customers); consent where we ask for it (for example, optional cookies or marketing to prospects); and legal obligation (item 8). When we process volunteer data on an organization's behalf, the organization determines its own legal basis.

We do not sell personal information, and we never have. We do not share personal information with third parties for their own advertising. We share information only in these situations:

With your organization or sheet owner. If you are a volunteer, the organization or personal-sheet owner you log hours for can see everything you submit through their forms, plus the date and time of each session.

With service providers who help us run Volunteesy. These companies process data only on our instructions and under contracts that require them to protect it. Our current categories of providers and named subprocessors:

Purpose	Provider
Cloud hosting and database	Laravel Cloud (US East)
Transactional email	Resend
Error monitoring	Laravel Nightwatch
Privacy-friendly analytics	Plausible
Customer support	Email only (no help desk tool)
Payment processing	Stripe

We will update this table when our providers change and, for organizations with a data processing agreement, give notice as that agreement requires.

When required by law or to protect people. We may disclose information if we believe in good faith it's necessary to comply with a law, regulation, subpoena, or court order; to enforce our Terms; or to protect the rights, property, or safety of Volunteesy, our users, or the public.

In a business transfer. If Volunteesy is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify affected organizers before their information becomes subject to a different privacy policy.

Aggregated or de-identified data. We may share statistics that cannot reasonably identify anyone (for example, "organizations on Volunteesy logged X volunteer hours last year").

5. How long we keep information

Data	Retention
Organizer account and organization data	For as long as the account is active, plus 30 days after deletion is requested, to allow recovery from accidental deletion
Volunteer sessions and volunteer records	Controlled by the organization. Deleted when the organization deletes them or closes its account (subject to the 30-day window above)
Purchase records	7 years, as required for tax and accounting
Imported CSV files	The raw file is deleted immediately after processing; the resulting session records are retained as above
Server and access logs	90 days
Support correspondence	2 years
Encrypted backups	Rolling 30-day cycle; deleted data ages out of backups within that window

Free and inactive accounts. If an organization on a free plan has not logged in for 24 months, we may email the organizer and then delete the account and its data after a further 60 days' notice.

6. Security

We take reasonable technical and organizational measures appropriate to the sensitivity of the data we hold, including:

Encryption in transit (TLS 1.2 or higher) for all connections.
Encryption at rest for databases and backups.
Passwords stored only as salted one-way hashes; we cannot read your password.
Signed, tamper-evident check-in tokens verified server-side, so a link cannot be altered to point at a different program, sheet, or job.
Role-based access: organizers see only their own organization's data.
Daily encrypted backups stored separately from production.
Least-privilege access for our own staff, with access to production data limited to what's needed for support and operations.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify affected organizations and, where required, individuals and regulators, without undue delay and in any event within the timeframes required by applicable law.

You can help by using a strong, unique password, enabling any additional login protections we offer, and keeping check-in QR codes and links limited to the people who should be using them.

7. Your choices

Email. Every marketing email includes an unsubscribe link. You cannot opt out of essential service emails (for example, password resets or billing receipts) while you hold an account.
Account information. Organizers can update account details in Settings at any time.
Volunteer information. If you are a volunteer, ask your organization to correct or delete your records. If you have a volunteer account, you can update your own preferences directly.
Cookies. See Section 8.
Installed app. If you install Volunteesy to your home screen, you can remove it like any other app. Removing it does not delete your account.

8. Cookies and similar technologies

Volunteesy uses a small number of cookies and browser storage entries:

Type	Purpose	Can you disable it?
Strictly necessary	Keeping you signed in, protecting forms against cross-site request forgery, remembering your session	No — the Service won't function without them
Functional	Remembering a volunteer's name on the device they last checked in from, storing the offline app shell so the app loads quickly	Yes, via browser settings, though check-in will require re-entering details
Analytics	Aggregate, cookie-less page statistics that do not track individuals across sites	Not applicable (no cookies are set)

We do not use advertising cookies, and we do not allow third parties to place tracking cookies through the Service. Because we don't track users across other websites, we don't currently respond to browser "Do Not Track" signals beyond what's described here; we do honor Global Privacy Control signals as an opt-out under applicable law (Section 10).

9. Children and young volunteers

Many organizations that use Volunteesy work with young people — school programs, youth theater, scout troops, and similar. We've designed the Service with that in mind.

Organizer accounts may only be created by people 18 or older.
Volunteers under 18 may log hours where the organization permits it and has the appropriate authority from a parent or guardian to collect that information. The organization is responsible for obtaining any consent required by law (such as parental consent under the U.S. Children's Online Privacy Protection Act for volunteers under 13, or under GDPR Article 8 in the EEA/UK).
Volunteesy does not knowingly collect personal information directly from children under 13 for our own purposes. We do not market to minors and do not create volunteer accounts for them without organizational involvement.
Parents and guardians: if you believe a child's information was collected without proper authorization, contact us at privacy@volunteesy.com and we will work with the organization to delete it promptly.

Because school programs may be subject to laws such as FERPA, we act only as a "school official" or processor at the school's direction and do not use student information for any other purpose.

10. Your privacy rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you and receive a copy.
Correct inaccurate information.
Delete your information.
Port your information in a machine-readable format (organizers can export CSV at any time).
Object to or restrict certain processing, including direct marketing.
Withdraw consent where processing is based on consent.
Not be discriminated against for exercising your rights.

How to exercise these rights. Email privacy@volunteesy.com with the subject line "Privacy Request." We may need to verify your identity, typically by confirming the email address on file. We respond within 30 days (or 45 days for California requests), and will tell you if we need more time. You may authorize an agent to act on your behalf; we will ask for proof of that authorization.

If you are a volunteer, we will usually refer your request to the organization or personal-sheet owner that collected your information, since they control that data, and help them respond. If that account has been closed, we will handle your request directly.

California residents. In the last 12 months we have collected the categories of information described in Section 2 for the purposes in Section 3. We do not sell or "share" (for cross-context behavioral advertising) personal information, and have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the Service. We honor Global Privacy Control browser signals as a valid opt-out.

Other U.S. states. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws may exercise the rights above. If we deny a request, you may appeal by replying to our response with "Appeal" in the subject line.

EEA, UK, and Switzerland. You also have the right to lodge a complaint with your local data protection authority.

11. International transfers

Volunteesy is operated from the United States and our servers are located in the United States. If you access the Service from elsewhere, your information will be transferred to and processed in the U.S. Where we transfer personal information from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or other lawful transfer mechanisms. Organizations that need a signed data processing agreement, including these clauses, can request one at dpa@volunteesy.com.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify organizers by email or a prominent in-app notice at least 14 days before the change takes effect, and we will update the "Last updated" date above. Previous versions are available on request. Continued use of the Service after the effective date means you accept the updated policy.

13. Contact us

Email: privacy@volunteesy.com

If you're a volunteer with a question about a specific organization's use of your information, please start with that organization; we're happy to help if you can't reach them.

Summary

What we collect	Names, emails, and volunteer session times — plus whatever optional fields an organization chooses to add. Basic technical logs.
Why	To record and report volunteer hours, run organizer accounts, and keep the Service secure.
Who sees it	Your organization, and the service providers who host, email, and process payments for us. Nobody else, unless the law requires it.
Selling data	Never.
Advertising	None. No ad cookies, no cross-site tracking.
Minors	Supported with the organization's responsibility for parental consent; we never market to them.
Your rights	Access, correct, delete, export, object — email privacy@volunteesy.com.
Retention	Volunteer data lives as long as the organization keeps it; logs 90 days; purchase records 7 years.

Person with password, email, and lock icons