Volunteer Ledger app privacy notice

Effective October 22, 2026

This notice adds to our Privacy Policy for people who use the Volunteer Ledger app; the Privacy Policy still applies. It applies to everyone who uses the app, whatever version of our terms their agency is on. Our Privacy Policy effective October 22, 2026 includes the same paragraph.

The Volunteer Ledger app

When someone signs in to the Volunteer Ledger app on a phone or tablet, we record that sign-in with the device’s make and model (such as “Google Pixel 8”). Changing your password signs out every other device. Signing in with Microsoft happens on Microsoft’s own page in the device’s browser. Signing out of the app does not sign the person out of Microsoft in that browser; on a shared device, sign out of Microsoft there too. The app keeps its sign-in in the device’s secure storage. For offline use, it also keeps an encrypted copy on the device of what its screens show that person: for a volunteer, their own hours (with their notes), shifts and requirement status; for agency staff, the dashboard and the volunteers (including their phone numbers and email addresses), hours and requirement lists they can see. That copy does not include requirement notes, results, numbers or documents, and we never receive it. It is erased when the person signs out, when the app next connects after their sign-in is ended (for example, their access is turned off or their password is changed) or more than a day after it expired, when the app is reinstalled, or when a different person or agency signs in. Until one of those things happens, the copy stays on the device and can be opened from the sign-in screen, including after a sign-in simply expires or on a device that never connects again, so sign out on any device you give up or share. If the device is offline when someone signs out, the app forgets the sign-in and erases its copy at once, but the sign-in ends on our side only when it expires. Each agency is responsible for the devices its people use with the app, including keeping them locked and secure. Our servers tell the app and the device not to store our answers anywhere else. The app uses the camera only when someone taps to attach a photo to a requirement. It removes location data from photos it takes, sends each photo or file to our document storage, and deletes its own temporary copy; a file picked from the device stays where it was, and some camera apps also save their own copy to the device’s photo gallery. For JPEG, PNG and WebP images we remove location and other hidden data before storing them. The app shows no ads and has no analytics or tracking tools. Today it sends no push notifications and includes no crash-reporting tool; we will update this policy before either changes, and give any notice section 5 of our Data Processing Addendum requires.

We delete the record of each app sign-in within about a day after the sign-in ends or expires.

Contact

Questions, requests, or concerns: [email protected]. We reply during business hours.

See also our Privacy Policy and Terms of Service.