Privacy Policy & Data Sovereignty Charter

1. Overview & Purpose

This Privacy Policy explains how Sky Waters (“Sky Waters,” “we,” “us”) collects, processes, protects, and stores information when you visit our website, submit an application for donated technical consulting or hosting, or use our digital infrastructure in Minneapolis, Saint Paul, and the surrounding Twin Cities.

2. What We Collect & Why

A. Application & Intake Information

When an organizer submits our intake form, we collect the following details provided directly by you:

• Organization / Collective Name: To identify your group and understand your community scope.
• Contact Email Address: To reply to your application, discuss your technical bottlenecks, and coordinate onboarding.
• Mission & Community Focus: To ensure alignment with grassroots mutual aid, tenant advocacy, food justice, or non-profit missions across the Twin Cities.
• Selected Support Categories: Information about tools you need (e.g., websites, email, encrypted storage, MariaDB databases).
• Specific Bottlenecks (Optional): Freeform technical context describing your current pain points.

Purpose: This information is reviewed exclusively by our volunteer team to evaluate capacity and coordinate assistance. It is never made public or shared with external parties.

B. Technical Anti-Abuse & Security Data (IP Addresses)

When an application is submitted, our backend server automatically records the client’s IP address in our database alongside the submission record.

Purpose: We use IP logging strictly for multi-tier rate limiting and defense against automated spam bots:

• IP Burst Protection: Enforcing a 30-second cooldown between consecutive submissions to prevent automated form spamming.
• Hourly Volume Caps: Limiting submissions to a maximum of 5 per hour per IP network to prevent distributed denial-of-service or database flooding.
• Duplicate Suppression: Preventing duplicate submissions from the same network within a 15-minute window.

C. Session Cookies

We use a single, temporary, strictly necessary session cookie (PHPSESSID) created by PHP when you visit the intake page. This cookie is used exclusively to enforce a 30-second submission cooldown between requests in your browser. It contains an ephemeral random string, carries no personally identifiable information, and expires when you close your browser. We do not use tracking cookies, cross-site cookies, or marketing cookies.

3. Third-Party Infrastructure & Edge Processors

To defend our volunteer-run servers against distributed denial-of-service (DDoS) attacks and ensure high-speed delivery, our web traffic passes through reputable infrastructure partners:

• Cloudflare: Provides global edge caching, DNS routing, DDoS mitigation, SSL/TLS encryption, and automated email address obfuscation (protecting volunteer email addresses from scraper bots). Cloudflare may process transient connection metadata (such as IP addresses and browser headers) in accordance with its privacy standards to detect and block malicious traffic before it reaches our origin server.
• OpenBSD VPS Hosting: Our origin server operates on an independent virtual private server running OpenBSD with Full Disk Encryption (FDE) enabled. All application data and MariaDB database records are stored in encrypted partitions.

4. Hosted Client Databases & Tenant Isolation

For partner organizations that receive donated hosting (e.g., custom MariaDB database rosters, supply inventories, or intake portals):

• Data Ownership: Your organization retains 100% ownership and sovereignty over all data stored within your provisioned instance.
• Least-Privilege Database Access: Each organization is provisioned with an isolated database user restricted strictly to necessary transactional privileges (SELECT, INSERT, UPDATE, DELETE), preventing accidental or unauthorized administrative operations.
• No Administrative Peeking: Sky Waters volunteers will never inspect, browse, aggregate, or export your organization’s constituent records or database contents, except when explicitly requested by you in writing to assist with database troubleshooting or backup verification.

5. Data Retention & Deletion

Application Records: Intake submissions are retained in our secure database for up to 12 months to facilitate follow-ups, cohort planning, and volunteer workload scheduling. Inactive applications are periodically purged.

Your Right to Deletion: You have the right to request the complete deletion of your application or hosted data at any time. To request removal, simply email privacy@skywaters.org from the address used during your application, and our maintainers will permanently delete your records from active databases within 5 business days.

6. Children’s Online Privacy (COPPA)

Our website and volunteer services are designed for adult community organizers, mutual aid coordinators, and non-profit representatives. We do not knowingly solicit or collect personal information from children under the age of 13. If you believe a child has submitted personal details through our intake form, please notify us immediately at privacy@skywaters.org so we can remove the record.

7. Changes to this Policy

If we make material changes to how we handle community data or update our infrastructure, we will post the revised policy here with an updated effective date. We encourage organizers to review this page periodically.

8. Contact & Privacy Inquiries

For any questions regarding this Privacy Policy, data sovereignty practices, or to request data deletion, please contact our volunteer coordination team: