Privacy Policy
CooperationEngine Last updated: 24 September 2026
CooperationEngine ("CE", "we", "us") helps people find each other when someone needs a hand. Communities use it to run gatherings, sign up volunteers, and match people who need help with people who can give it.
To do that, we hold information about real people: names, phone numbers, the shifts you signed up for, sometimes where you live. This page explains, in plain words, what we keep, why, who can see it, and what you can ask us to do about it.
This page describes what the system does today. If something here stops being true, we'll change the system or change this page, and tell you before the change matters.
The short version
- We don't sell your information, and we don't show ads. No advertising or tracking companies are built into CE.
- Your preferred name is what other people see. Your phone number, email, and home address are not shown to other members.
- We only send automatic messages to people who have signed in. If an organiser adds you from their own list, CE's automatic messages stay silent until you sign in yourself — unless that organiser deliberately sends you a welcome, which they write and send themselves. (See "If an organiser added you from their list".)
- Texting STOP turns off text messages only. You'll still see updates in the app and by email, so you aren't cut off from your community. Text START to turn texts back on.
- We never store your sign-in codes. We keep only a scrambled fingerprint (a "hash") that can check a code but can't be turned back into one.
- You must be 13 or older to hold an account. Younger children can still take part in a gathering — an organiser manages their place, and a guardian holds any account.
- Organisers can see what they need to run their gathering, and nothing from other communities.
Who we are
CooperationEngine is run by PD KC, LLC, 5900 Balcones Drive, Suite 100, Austin, TX 78731.
To reach us about privacy, email privacy@cooperationengine.com.
Two kinds of people use CE
- Members. People who sign up, volunteer, ask for help, or offer it.
- Organisers. People who run a community or a gathering on CE: nonprofits, schools, faith groups, neighbourhood groups.
When an organiser brings information into CE (a volunteer sheet, a form they wrote, a note they keep), that community decides what to collect and why. We run the system that holds it, and we build limits into that system (described below). If you have a question about why a community asked you something, ask that community too.
Age
You must be at least 13 years old to hold a CooperationEngine account. We don't knowingly create accounts for children under 13, and we don't ask for a date of birth to sign up.
A child under 13 can still be part of a gathering. An organiser can include them on a roster so they're counted, named, and checked in on the day. That entry is managed by the organiser, the child has no login, and CE sends them nothing. A parent or guardian can hold an account and act for them.
If you believe a child under 13 has created an account, write to privacy@cooperationengine.com and we'll remove it.
Members between 13 and 18 get the additional protections described in "Young people and guardians" below.
What we collect, and why
Your account
| What | Why |
|---|---|
| Phone number and/or email | To sign you in with a one-time code and to reach you about things you signed up for. |
| First name, last name | So organisers you join know who you are. |
| Preferred name | The name other members see. You choose it. If you don't, we use your first name. |
| Display name, and a "name for documents" if you set one | Used where you ask for them, like a volunteer-hours certificate. We never make one up for you. |
| Legal name, if you give it | Only for specific help arrangements (see "What other people can see"). |
| Preferred language, time zone | To show CE in your language and times in your time zone. |
| Your answer to "Are you 18 or older?" and when you answered | To apply the protections for young people described below. We don't ask for your birth date to sign up. |
| Skills and interests you choose to list | So organisers can invite you to shifts that fit. An invitation is only ever an invitation. |
| Whether you're available, and privacy choices you set | To respect them. |
| A photo, if you add one | To show on your profile. |
Some older accounts have a date-of-birth field from an earlier version of CE. We no longer collect or use it, and we are removing those stored values.
When you sign in
| What | Why |
|---|---|
| One-time sign-in codes | Stored only as a hash, never as the code itself. A code expires after 10 minutes. |
| Session records: when you signed in, the device/browser type, and the internet (IP) address | To keep you signed in (up to 30 days), let you sign out, and spot misuse. The session key itself is stored only as a hash. |
| A sign-in cookie | Needed for CE to work. We don't use advertising or tracking cookies. |
| Small settings saved in your browser (like language, or a section you folded shut) | Convenience. They stay on your device. Some layout preferences are also saved to your account so they follow you to other devices. |
If you lose access to your phone number, account recovery may ask for your name, date of birth, and one fact about your account. We record the IP address and device used for the request. A person on the CE team reviews these requests by hand. We never hand over an account on those facts alone. This is the only place CE asks for a date of birth.
Gatherings and shifts
| What | Why |
|---|---|
| Which gatherings and shifts you signed up for, interest you showed, and teams you joined | So the organiser knows who is coming and you know where you're expected. |
| Check-in and check-out times, and how you checked in (app, a check-in link, text, or an organiser marking you present) | So the organiser knows who is here, and so your volunteer hours can be counted and confirmed. |
| If you step back from a shift: when, and how much notice you gave | So the spot can be offered to someone else. We never ask why, and "didn't come" can only be recorded by a person, never by the system. |
| If an organiser moves you between shifts or takes you off one: what happened, and who did it | So the record is accurate and nobody is recorded as absent when they weren't. Being taken off a shift by an organiser is never recorded as not showing up. |
| Hours an organiser confirms, and certificates issued to you | Your record of what you gave. A certificate can't be quietly rewritten after it's issued. |
| Whether you want to be thanked publicly | Off unless you turn it on. Many people volunteer and have good reasons not to appear on a page about it. |
| Ratings or thank-you notes about a gathering or a volunteer | To say thank you and improve future gatherings. |
Check-in links. An organiser may send you a link that checks you in with one tap, without signing in. That link can only mark you present at that one gathering. It can't open the app, show your details, or show who else is coming. It expires, and the organiser can cancel it. Anyone holding the link could mark you present, so treat it like a ticket.
If an organiser added you from their list
Many communities already have a list of their volunteers or participants in a spreadsheet. An organiser can bring that list into CE for their own gathering. From it we may receive your name, preferred name, email, phone, team or pod, track or role, the position you're signed up for, which location or day, whether the organiser says you're an adult, and answers to their own registration questions.
When this happens:
- CE creates a quiet account for you so you can be checked in on the day without signing in to anything. The organiser is telling us you agreed to come. CE never claims you agreed.
- CE's automatic messages stay silent while the account is quiet. No in-app notices, no emails, no texts from CE's own notification system, until you sign in yourself.
- The organiser may send you a welcome. After importing a list, an organiser can choose to send the people on it a message confirming they're registered, with a link to the gathering. The organiser writes it, reviews it, and sends it — it comes in the name of their gathering, not ours, and it always carries a way to opt out. Nothing is sent automatically.
- The organiser can also reach you with practical notes about their gathering (a venue change, weather, what to bring) through CE. These are never promotional messages.
- If an organiser adds someone who is already on CE, that person's details are never overwritten. We match on a verified phone number or an exact email address, never on a name.
- An organiser saying you're an adult is recorded as the organiser's statement. It is not recorded as your own answer. If you ever sign in, we'll ask you ourselves.
- When you sign in, the account becomes fully yours, like any other.
- If you never sign in, we don't keep the account forever. See "How long we keep things".
If you're on an organiser's list and don't want to be, ask the organiser, or write to us at the privacy address above.
Forms and agreements
Communities can ask their own questions: registration forms, sign-up questions, surveys, forms about a person or household.
- What a form asks is written by that community. CE blocks certain kinds of question outright — categories we consider unsafe or unnecessary for organising care. We'll tell you whether a specific question is blocked if you ask.
- Your answers are tied to the version of the form you actually saw. They can't be edited afterwards by anyone, including the organiser.
- If an answer was brought in from the organiser's spreadsheet instead of typed by you, it is marked as imported. It never appears as something you said.
- Some forms are set to show organisers totals only, never individual answers.
- Some forms can be filled in by anyone with a link, without an account. Those answers are marked as coming from a link.
- A form may send you a copy of your answers by email, if the organiser turned that on.
When you accept a gathering's agreement (for example, a volunteer agreement), we record which version you accepted and when. If the wording changes later, what you agreed to stays exactly as you saw it.
Asking for and offering help
If a community uses CE for requests for help (asks), rides, or offers:
| What | Why |
|---|---|
| What you're asking for, when it would help, and any note you choose to share | So neighbours can step in. |
| An address or meeting point, if one is needed | So the helper can get there. Other people see only a general area until you accept a helper. Then the helper sees what they need. You can also say you have no address to give, and we never ask why. |
| For rides: pickup and destination, and what the ride needs (for example wheelchair access or a child seat) | So a driver can say yes knowing what's involved. |
| Patterns from your own past asks | So we can offer "Same as usual?" You still press the button. |
| After help is complete: ratings, thank-yous, photos you add, and private concerns | Thank-yous may be shared if you allow it. Concerns stay private and are seen only by the people who handle safety in that community. |
We never charge individuals. Asking for help, giving it, and joining a gathering are free.
Places you save
You can save places like "Home" or "Work" to make asks quicker. Only you can see them. They never appear on your profile, and neighbours see only a general area until you accept help.
When you type an address, it is sent to Google's address service to suggest matches and find it on a map (see "Service providers").
If you tap "near me" in the directory, your browser asks you first. If you allow it, your device's location is sent to CE only to sort that list by distance. It isn't saved to your account.
Messages
When you message someone in CE, in a request, a gathering, or a community, the people in that conversation can read it. If someone asks for a coordinator's help, a coordinator joins the conversation. Your words are kept as you wrote them. If someone reads CE in another language, they see a translation marked "Translated", with a link to your original.
What organisers write about members
Organisers can keep short notes about members so they can care for people well. For example: "prefers morning shifts" or "was going through a lot, check in gently".
- Only that community's organisers can read them. Another community can never see them.
- They are never shown publicly, and they are not shown to the member in the app.
- Once saved, a note can't be edited or deleted. Each note records who wrote it and when, so nobody can quietly rewrite a record about a person.
If you ask us for a copy of the information we hold about you, we will include notes written about you, except where releasing a note would put another person at risk. If we hold something back, we'll tell you that we have.
Organisers can also keep a contact book of people who aren't on CE (someone met at an event, a possible sponsor). Adding someone to it sends them nothing and signs them up for nothing. Only that community can see it.
Verification a community may ask for
Some communities check who someone is before welcoming them in. A community may ask you to upload a document (for example, an ID or a referral letter). If you do:
- It's stored privately. Only that community's organisers can open it.
- Every time someone opens it, we record who and when.
- Your legal name is shown to a community only after that community has verified it.
Young people and guardians
We ask everyone once: "Are you 18 or older?" We don't ask for a birth date.
If you're under 18:
- You can still take part: see gatherings, join a team, hold a shift.
- You are never included in promotional messages. You still get practical updates about the gatherings you join.
- Your photo in a gathering's gallery can't be published unless an organiser confirms a guardian has consented. "Unknown" is an answer that keeps it unpublished.
- If a gathering or community needs a guardian's consent, we ask for your guardian's name, relationship to you, and an email or phone number, and we send the guardian a link. Consent is recorded only when the guardian presses yes themselves. You can't give it for them, and an organiser can't either. If nobody answers, nothing is recorded as consent.
- Where a community already has a signed paper form from your guardian, the organiser can record that. It is marked as coming from the organiser's form, with the date your guardian signed it.
- Consent is per gathering. A guardian's yes to one event never carries over to the next.
- A guardian's contact details are visible only to that community's organisers. They're never on a profile.
Notifications
| What | Why |
|---|---|
| Your notification choices (which messages, by email or text, quiet hours) | To respect them. |
| The in-app notifications you've received and whether you've read them | So your bell works. |
| A delivery record for each email or text: what kind of message, when, a masked version of the address, the provider's result, and a short preview | So we can tell whether a message reached you, and prove we didn't send what we shouldn't have. |
| A list of numbers and addresses that asked us to stop | So we keep honouring it. |
Records we keep to stay accountable
Some records are built so they can't be quietly changed. We keep them because trust depends on them:
- an audit log of important actions (who did what, when, and from which IP address). For example: an organiser adding someone to a shift, a role being granted, or a message being sent to a group;
- a log of each time a private file is opened;
- a record of joining and leaving communities (leaving never erases what you gave);
- a log of group emails an organiser sends (the words and how many people received it, not the names);
- a record of moderation decisions.
What other people can see
- Other members see your preferred name, and a general area if you post an ask. They don't see your phone, email, exact address, or legal name. You can choose to show your full name instead.
- A helper you've accepted sees what they need to help: the address or meeting point, and your legal name if the arrangement needs it.
- Organisers of a community you've joined, or a gathering you signed up for, can see your contact details, your sign-ups and check-ins, your answers to their forms, and (after their own verification) your legal name. They can't see anything from other communities.
- A small number of people at CE can reach the database to keep the service running, look into a safety concern, review an account-recovery request, or respond to something you've asked us for. These accounts are named rather than shared, and what they do is recorded in the audit log.
- The public sees only what you or a community choose to publish: a thank-you you allowed, a team's showcase after a gathering, a published photo. Being named publicly is always off until someone chooses it.
How we contact you
- In the app (the bell): updates about what you've joined or asked for.
- Email: sign-in codes, updates about what you signed up for, and messages organisers send to people registered for their gathering.
- Text messages: see below.
- Promotional messages (for example, "here's our next gathering") go only to adults who said yes to them, and every one has a working unsubscribe link that needs no sign-in.
We don't contact people just because their name is on a list. See "If an organiser added you from their list" above.
Text messages (SMS)
When you add your phone number, you see this:
"By adding your number, you agree to texts from CooperationEngine about your sign-in and what you've signed up for. Msg frequency varies. Msg & data rates may apply. Reply STOP to stop, HELP for help."
- What we text: sign-in codes, and messages about things you signed up for or asked for (a shift reminder, a change to a gathering, someone stepping in to help). We don't send promotional or marketing texts.
- How often: it depends on what you've joined. Message frequency varies.
- STOP (also STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) stops text messages to that number straight away. In-app and email updates continue, because you asked for quiet on your phone, not to be cut off from your community.
- START (also UNSTOP, RESUME) turns texts back on.
- HELP gets a reply with how to reach us.
- Message and data rates from your carrier may apply.
We do not share your mobile number or your text-message consent with anyone for their own marketing or promotional purposes. Phone numbers and SMS opt-in information are never sold, rented, or shared with third parties or affiliates for marketing. We share your number only with the text-message provider that delivers our messages to you.
Automated checks and AI
We use some automated checks to keep people safe. None of them decide anything about you by themselves.
- New requests for help are checked automatically for signs that someone may be in crisis, or for hateful or abusive language. If it looks like someone may be in crisis, their post is never hidden. They're shown support right away, and a coordinator is told. Posts that look hateful or abusive are held until a person reviews them. Swearing on its own is never treated as a problem.
- Preferred names are checked when set or changed, to keep out harassment and explicit names. The check is written so that people's own identity words, including reclaimed language, aren't flagged. A person reviews anything flagged.
- Photos uploaded to a gathering's gallery may get an automated note to help a reviewer. The note can't publish a photo. A person has to confirm consent before any photo is published.
- Translation: posts, messages, and thank-yous can be machine-translated so people who speak different languages can help each other. Translations are always labelled, and the original is always kept.
- Organisers can use AI to draft a form from a description, draft a welcome message for people they've just added, or suggest brand colours from screenshots of their own designs. They review and edit the result before anything is published or sent.
Some of these checks send the relevant text or image to Anthropic, the AI provider we use, for processing.
Who we share information with
We don't sell personal information, and we don't share it for advertising.
We share information only:
- Within CE, as described above. With the communities you join, the organisers of gatherings you sign up for, and people you arrange help with.
- With service providers who run parts of CE for us. They process information only to provide their service to us:
| Provider | What they do | What they receive |
|---|---|---|
| Vercel | Hosts the CE app | Everything passing through the app |
| Neon | Our database | Everything we store |
| Cloudflare (R2) | Stores uploaded files (photos, logos, documents) | Uploaded files |
| Resend | Sends email | Email address, message content |
| Telnyx or Twilio | Sends text messages | Phone number, message content |
| Anthropic | AI checks, translation, and drafting (see above) | The text or image being checked or translated |
| Google (Maps, Places, Fonts) | Address suggestions and maps; typefaces | Addresses you type; your IP address when the page loads maps or fonts |
| Stripe | Payment processing, not currently in use for real payments | Nothing today |
- When the law requires it, or to protect someone from serious harm. If we are legally required to hand over information, we'll tell the person affected, unless we're legally prohibited from doing so or it would put someone in danger.
- If CE changes hands. If CE is merged, sold, or reorganised, this policy continues to apply to information collected under it.
How long we keep things
While your account is open, we keep what's described above so CE works for you. Some things are kept for a set time and then removed:
| What | How long |
|---|---|
| Sign-in codes | 10 minutes, then expired; removed after 30 days |
| Sessions | 30 days, or as soon as you sign out; removed after 30 days |
| Check-in links | Until they expire or the organiser cancels them |
| Message delivery records | 12 months |
| Account-recovery requests | 12 months after the request is resolved |
| Quiet accounts nobody ever signed in to | 12 months after the gathering they were created for |
| Audit log and other accountability records | For the life of the company |
About that quiet-account line. If an organiser added you from a list and you never signed in, we don't keep your details indefinitely. Twelve months after that gathering, we remove your name, phone number and email. The gathering's own record that someone filled that place stays, without your details attached. If you're added again for another gathering, a new account is created then.
Records that are built to be permanent — agreements you accepted, form answers, certificates, organiser notes, the audit log — are kept as they are, because they exist to stop history being rewritten. See "Your choices and rights" for what happens when you ask us to delete your information.
We are building the automatic removal described above. Until each one is running, we remove on request — write to privacy@cooperationengine.com.
Your choices and rights
You can:
- See and change your profile, preferred name, language, skills, saved places, and notification choices in the app, at any time.
- Turn off texts by replying STOP, and stop promotional email with the link in any such email.
- Step back from a shift or leave a community at any time. Leaving is recorded as a date. It never erases the care you gave.
- Ask us for a copy of the information we hold about you.
- Ask us to correct something that's wrong.
- Ask us to delete your account. There isn't a delete button in the app yet, so email privacy@cooperationengine.com. We'll reply within 30 days.
What deleting your account does. We remove the things that identify you: your name, preferred name, phone number, email address, photo, saved places, and any documents you uploaded. Where you appear in a community's records — a shift you covered, an agreement you accepted, hours that were confirmed — you become "a former member", and the record of what happened stays without you in it.
We do it this way on purpose. Those records belong to a community as much as to you: an organisation needs to know that a shift was covered, and a certificate that was issued should still exist. Removing you from them entirely would mean punching holes in other people's history. If you need something removed beyond this, write to us and tell us what and why — we'll do what we can and tell you plainly what we can't.
We won't treat you differently for asking.
Depending on where you live, you may have more rights under your local law. Write to us and we'll help.
Security
Some of the ways we protect your information:
- Sign-in codes, session keys, and calendar-feed links are stored only as hashes.
- Uploaded documents and private photos live in a private store, and every time one is opened, we record who opened it.
- Home addresses and legal names never go into notification text. The only name a notification can use is a preferred name.
- Each community's information is separated from every other community's.
- Giving someone an administrator role requires a confirmed email address, so there's always a way to reach the person holding that power.
No system is perfect. If something goes wrong in a way that affects your information, we'll tell you without undue delay — and within 72 hours of becoming aware of it where the law requires that — and we'll tell you plainly what happened, what it affects, and what we're doing about it.
Changes to this policy
If we change this policy in a way that matters, we'll post the new version here with a new date, and tell members in the app before the change takes effect.
Contact
Privacy questions or requests: privacy@cooperationengine.com Everything else: support@cooperationengine.com
PD KC, LLC 5900 Balcones Drive, Suite 100 Austin, TX 78731