Privacy Policy

Effective date: April 9, 2026 · Version: v1.0-2026 · Operated by EXADreams LLC

We do not sell your data. We do not run advertising. Your declaration is yours. This policy explains exactly what we collect, why, and what you can do about it.

1. Who This Applies To

This Privacy Policy applies to all users of DoTheNeeds (dotheneeds.com), a product of EXADreams LLC, Frisco, Texas, USA. It covers data collected when you visit the Platform, read declarations, or submit your own declaration.

2. What We Collect

2a. Data You Provide Directly

Field	Required?	Why we collect it	Stored how
First name	Yes (or post anonymously)	Displayed on the wall; your declaration's identity	Plain text
Age	Optional	Demographic context; minor age gate (under 13 blocked)	Integer
Nationality (origin)	Optional	Scope tracking; demographic context	Country name
Country of residence	Optional	Local matching; scope tracking	Country name
Declaration text	Yes	Your declaration — publicly displayed	Plain text (public)
"I will…" commitment	Optional	Part of your declaration; publicly displayed	Plain text (public)
Email address	No — optional	Match notifications and stage alerts only	Plain text (private)

2b. Data Collected Automatically

Data	What we collect	What we do NOT collect
IP Address	Two-letter country code only (e.g. "US", "GB")	Full IP address — never stored
Device / browser	Nothing	User agent, device type, screen size
Cookies	None set by us	Tracking cookies of any kind
Analytics	Cloudflare Web Analytics (privacy-preserving, no personal data)	Google Analytics, Facebook Pixel, or any behavioural tracking

3. How We Use Your Data

Display your declaration on the public wall (if not anonymous)
Compute stage and scope for your cause (aggregated, not personal)
Find matches between your declaration and others (text similarity)
Send notifications if you provided an email address and opted in
Moderate content to remove prohibited declarations
Aggregate reporting — anonymised data about what the world wants to change, shared with NGO or research partners with no personal identifiers
Legal compliance — complying with applicable law, court orders, or regulatory requests

We do not use your data for advertising, profiling, behavioural tracking, or sale to third parties.

4. Who We Share Data With

Service	Purpose	Data shared	Location
Supabase	Database hosting	All declaration data	USA (us-east-1)
Cloudflare	Hosting, CDN, edge compute	Request metadata (no personal data stored)	Global edge
Resend	Transactional email	Email address + declaration summary (if email provided)	USA
Anthropic	AI content moderation	Declaration text only (no name, no email)	USA

No other third parties receive your data. We do not use advertising networks, social media trackers, or data brokers.

5. Your Rights

Under GDPR (EU/UK) and CCPA (California), you have the following rights:

Right to access — request a copy of all personal data we hold about you
Right to erasure — request deletion of your personal information. On erasure: your name, age, nationality, residence, and email are permanently deleted. Your hash is retained (no personal data attached) as proof of existence.
Right to rectification — request correction of inaccurate data
Right to portability — request your declaration data in a machine-readable format
Right to object — object to any processing you haven't consented to
Right to opt out of data sale — we do not sell data. There is nothing to opt out of.

To exercise any of these rights, contact us at privacy@dotheneeds.com with your Declaration ID.

6. Data Retention

Active declarations — retained indefinitely as long as the Platform operates
Removed declarations — personal fields deleted within 30 days; hash retained permanently
Email addresses — retained until you unsubscribe or request deletion
Policy agreement records — retained for 7 years (legal compliance)
Moderation logs — retained for 2 years

7. Security

We use the following security measures:

All data in transit protected by TLS 1.3
Database hosted on Supabase with Row Level Security (RLS) enabled
Service role keys stored only in Cloudflare's encrypted secrets — never in code
Email addresses stored separately from public-facing declaration data
No full IP addresses stored at any point

8. Children's Privacy

We do not knowingly collect personal data from children under 13. If you are a parent and believe your child has submitted a declaration, contact us at privacy@dotheneeds.com and we will delete it immediately.

9. Changes to This Policy

We will update this policy as our practices change. The version number and effective date at the top of this page will always reflect the current version. We will notify registered users by email of material changes.

10. Contact

EXADreams LLC
Frisco, Texas, USA
Privacy enquiries: privacy@dotheneeds.com
General contact: hello@dotheneeds.com