Privacy Policy

Effective: April 29, 2026

MassMovement is run by Amy Eckles. This policy explains what data we collect, why we collect it, and what we do (and don't do) with it. We've kept this policy short and in plain language because the platform itself is built on the idea that user trust is the product. If anything is unclear, email [email protected].

What we collect

• Your email address, when you sign in. We use it to send you a magic sign-in link, to notify you when a campaign you've pledged to crosses its threshold, and to contact you about important changes to the service.
• Campaigns you create and pledges you make. Campaigns are public by their nature — they have to be, for the coordination mechanic to work. Pledges are stored against your account but are displayed only as aggregate counts on each campaign page; we do not display individual pledger identities publicly.
• Server logs: standard request metadata (IP address, user agent, timestamps) retained for up to 30 days for security and abuse prevention. We do not use this data for tracking, profiling, or advertising.

What we don't collect

• No analytics scripts (Google Analytics, Plausible, etc.) — none.
• No advertising or marketing trackers.
• No social-media pixels.
• No passwords (we use magic links).
• No payment information — the platform is free and takes no money.

Cookies

We set one cookie: a session cookie that keeps you signed in. It contains only an encrypted reference to your user record, expires when you sign out or after a period of inactivity, and is never sold or shared.

Who we share data with

We use a small number of service providers to run the platform. None of them receive more data than they need, and none are used for advertising or analytics:

• Mailgun delivers transactional email (sign-in links and threshold-hit notifications). Mailgun sees your email address and the content of those emails. Their privacy policy is at mailgun.com/privacy-policy.
• Cloudflare handles DNS and may proxy requests for security and performance. They see request metadata (IP, user agent, timestamps) but not application content beyond what's required to route the request. Their privacy policy is at cloudflare.com/privacypolicy.

We will never sell your data. We will never share your data with advertisers, data brokers, or political campaigns. If we ever materially change who we share data with, we will notify you by email before the change takes effect.

How long we keep your data

We keep your account and pledge history as long as your account exists. If you delete your account, we delete your email address and pledges within 30 days. Aggregate, anonymized statistics about campaigns may persist indefinitely (e.g., "campaign X reached 12,000 pledges").

Your rights

You can:

• Access your data — email us and we'll send you everything we have on file.
• Correct your email address by signing in with the new one.
• Delete your account, which removes your email and pledges within 30 days.
• Withdraw a pledge anytime before a campaign's threshold hits.

To exercise any of these, email [email protected]. If you're in the EU/EEA or California, you have additional rights under the GDPR and CCPA; the rights described above already cover the common ones.

Children

MassMovement is not directed to children under 13 (or 16 in jurisdictions where that's the threshold). We do not knowingly collect data from anyone in that age range. If you believe a child has signed up, email us and we'll delete the account.

Security

We follow standard practices: encrypted connections (HTTPS), encrypted sessions, magic-link tokens that expire after 30 minutes, and minimal data collection so there's less to lose. No system is perfectly secure; if we learn of a breach affecting your data, we'll notify you within 72 hours.

Changes to this policy

If we change this policy in a way that materially affects your data, we'll email you and update the "Effective" date above. Continued use after the change means you accept the new version.

Contact

Amy Eckles — [email protected]