Legal

Privacy Policy

Effective November 3, 2026 · Last updated November 3, 2026 · Previous version

Volunteer Ledger helps organizations run their volunteer programs: volunteer records, hours, requirements, scheduling, and reports. This policy explains what information passes through the service, why, and what happens to it. For an agency and the people whose records it keeps here, this version applies once the Terms of Service effective November 2, 2026 apply to the agency (section 11 of the Terms): from signup for a workspace created on or after that date, or when one of its admins accepts this version in Volunteer Ledger. Until then, the version that went with the Terms of Service the agency last agreed to keeps applying to it (the previous version is linked above). For everyone else, this version takes effect on November 2, 2026.

The short version

Your agency's data belongs to your agency. You can export your records anytime (see our Data Processing Addendum) and ask us to delete them.
Inside the service we collect only what it needs to run: the volunteer records your agency enters, staff account details, basic technical logs, and the make and model of a device that signs in to the Volunteer Ledger app. Our website also records how new trials found us and what you send through its contact form.
We never sell data, never run ads, and never use customer data to train AI models, except as our AI provider’s terms allow for content it flags for safety review (see Who else touches the data).
Essential cookies only in the web application; analytics on our public marketing pages only, never inside the web application or the Volunteer Ledger app.

Who we are

Volunteer Ledger is operated by MortonApps LLC and lives at volunteerledger.com.

What we collect

Volunteer records your agency enters. Agencies use Volunteer Ledger to keep records about their volunteers. Depending on what your agency chooses to enter, a volunteer record can include: name, date of birth, postal address, phone number, email address, emergency contact name and phone, areas of service, service notes, and volunteer hours and mileage. It can also include the training, screenings, and licenses your agency tracks and the documents attached as proof (which can include background check results and health records such as immunizations), exemptions and their reasons, training records, shift schedules and sign-ups, messages your agency sends volunteers, custom fields your agency defines, and sign-in accounts for volunteers your agency invites. This includes what volunteer applicants submit through an agency's application form. For an agency on this version of this policy, we may delete declined or untouched applications 12 months after their last activity; the agency can ask us to keep them longer. To prevent abuse of our forms, we also keep a hashed (scrambled) form of the IP address behind each attempt.

Texting. If an agency turns on texting, texts are sent by MortonApps LLC under the Volunteer Ledger name, from its toll-free number, at the agency’s direction, and a volunteer gets them only in one of two ways, as section 5 of our Terms of Service describes: an admin of the agency confirms in Volunteer Ledger that its active volunteers gave the agency their mobile numbers to be contacted about volunteering (this also covers volunteers the agency adds later or makes active again, unless its staff choose not to text them), or the volunteer opts in themselves. Unless the agency chooses not to, it first emails its volunteers a heads-up that names the number texts will come from. We keep each mobile number’s texting status, including when and how it opted in or out and which consent wording it saw; each agency confirmation (the admin who gave it, when, its exact wording, the count the admin typed, and the volunteers it covers); and a record of each text sent (who was texted, by which agency, when, and the result). We keep consent records (including agency confirmations), opt-out records, and whether a welcome text was sent, for 4 years after the agency’s account is deleted, only for compliance and to bring or defend legal claims. The rest is deleted with the account, with the exceptions described in section 6 of our Terms of Service and under How long we keep data below, including our sending service’s records of texts sent for the agency and the shared list of numbers that opted out. Every text sent for an agency begins “Volunteer Ledger - ” followed by the agency’s name, and our automatic replies to HELP, STOP, and START begin “Volunteer Ledger:”. Message frequency varies; message and data rates may apply. Reply STOP to any text to opt out, or HELP for our support contact, or email [email protected]. A STOP sent to any of our texting numbers stops texts from our Volunteer Ledger number; texting START to our Volunteer Ledger number lifts only a STOP sent to that number. An opt-out by an agency’s staff is undone only by the person’s own opt-in: in the volunteer portal, with the box on an application form, or on the page linked from the agency’s email invite. The agency’s confirmation never covers someone its staff opted out. Texting opt-in and consent information, including the mobile numbers it covers, is never sold, rented, or shared with any third party or affiliate, except the mobile carriers and messaging provider that deliver the texts, and when the law requires it. We may also use or disclose consent records (including agency confirmations) and opt-out records to establish, exercise, or defend legal claims, and show them to the agency, carriers, and our messaging providers as needed for compliance; we keep them for 4 years after an account is deleted for that purpose.

Staff accounts. When an agency staff member is invited to the service, or synced from the agency’s Microsoft 365 directory, we store their name, email address, and a hashed password (we never store the password itself), and for a synced account its directory id and the groups used to set its role. For anyone, staff or volunteer, who turns on two-step sign-in, we also keep an encrypted authenticator key, hashed one-time recovery codes, and a record of changes to their two-step sign-in (when it was turned on, turned off, replaced, reset, or locked, and when recovery codes were used or renewed); these are deleted with that person’s account.

The Volunteer Ledger app. When someone signs in to the Volunteer Ledger app on a phone or tablet, we record that sign-in with the device’s make and model (such as “Google Pixel 8”). Changing your password signs out every other device. Signing in with Microsoft happens on Microsoft’s own page in the device’s browser. Signing out of the app does not sign the person out of Microsoft in that browser; on a shared device, sign out of Microsoft there too. The app keeps its sign-in in the device’s secure storage. For offline use, it also keeps an encrypted copy on the device of what its screens show that person: for a volunteer, their own hours (with their notes), shifts and requirement status; for agency staff, the dashboard and the volunteers (including their phone numbers and email addresses), hours and requirement lists they can see. That copy does not include requirement notes, results, numbers or documents, and we never receive it. It is erased when the person signs out, when the app next connects after their sign-in is ended (for example, their access is turned off or their password is changed) or more than a day after it expired, when the app is reinstalled, or when a different person or agency signs in. Until one of those things happens, the copy stays on the device and can be opened from the sign-in screen, including after a sign-in simply expires or on a device that never connects again, so sign out on any device you give up or share. If the device is offline when someone signs out, the app forgets the sign-in and erases its copy at once, but the sign-in ends on our side only when it expires. Each agency is responsible for the devices its people use with the app, including keeping them locked and secure. Our servers tell the app and the device not to store our answers anywhere else. The app uses the camera only when someone taps to attach a photo to a requirement. It removes location data from photos it takes, sends each photo or file to our document storage, and deletes its own temporary copy; a file picked from the device stays where it was, and some camera apps also save their own copy to the device’s photo gallery. For JPEG, PNG and WebP images we remove location and other hidden data before storing them. The app shows no ads and has no analytics or tracking tools. Today it sends no push notifications and includes no crash-reporting tool; we will update this policy before either changes, and give any notice section 5 of our Data Processing Addendum requires.

Usage and log data. We keep basic technical logs (such as IP address, browser type, and request timestamps) for security and troubleshooting. Each hour entry keeps an audit trail of who created, changed, or deleted it and what it said before and after the change, including for entries later deleted, and the service records who saved which settings, but not the values.

How you found us. Our public website keeps a small note in your browser about how you first arrived in the last 30 days: the first page you visited (or the referral link you followed, if you used one), the website that sent you (if any), and any campaign tags in the link you followed. When you start a free trial, that note is sent to us with your signup, along with the page you signed up on. We keep it with your new account and include it in the internal email that tells us about each new signup. We use it to learn which pages, websites, and campaigns bring us customers and where to focus our marketing, to follow up with you about your trial, to credit anyone who referred you to us, and to spot fake or abusive signups. We never sell it or share it with advertisers. It is not shown in Volunteer Ledger; to see it or have it removed, email [email protected]. Accounts created before October 4, 2026 have no such record.

Messages you send us. When you email us, we receive your message and anything you include. When you use the contact form on our website, we receive what you enter (your name, organization, email address, and message), the page you sent it from, a similar note of how you arrived, your approximate location (country and state), your browser type, and a scrambled form of your IP address that helps us block spam. We use these to reply to you, follow up, and learn which pages bring us inquiries. The form also runs Cloudflare Turnstile, a bot check that receives your IP address and technical details about your browser under Cloudflare's own privacy terms.

Bug reports. Bug reports and feature requests you file in Volunteer Ledger, and any attached screenshot, go to our internal feedback service. How long we keep data describes how long we keep them and how to have them deleted.

Our role: your agency controls its data

For the volunteer information described above, your agency is the data controller and MortonApps LLC is the data processor. The lawful basis for our processing is the agency's instructions under our agreement with them; agencies are responsible for having an appropriate basis (such as volunteer consent or legitimate interest) for the records they keep. Our processor commitments (including breach notice, subprocessor-change notice, and deletion on termination) are set out in our Data Processing Addendum.

The note of how a new account found us, and messages people send us through our website, are different: we collect them for our own business, not on your agency’s behalf. For those, MortonApps LLC is the controller, and they are not part of the Data Processing Addendum.

If your agency turns on the monthly OIG exclusion check, the service compares the names of your agency’s volunteers, and their dates of birth where your agency has entered them, with OIG’s public exclusion list, which we download from OIG without sending OIG any volunteer information. A match is only a possible match for your agency to check on OIG’s site, and no match does not rule out an exclusion. When a new list is ready, the service emails your agency’s administrators; that email names no volunteers.

No patient information, by design

Volunteer Ledger is a companion to your EMR, not a replacement for it; patient-care documentation stays in your EMR. Free-text fields carry a visible reminder not to enter sensitive information (for health care agencies, patient information), and our Terms of Service prohibit entering PHI.

How we use data

Apart from the note of how a new account found us (described above), we use the data in your account to provide, support, and improve the service for your agency (storing records, generating reports, sending the report emails you schedule, keeping your account secure, sending account, billing, and trial messages to your administrators, and finding and fixing problems) and, where needed, to comply with the law, enforce our terms, or bring or defend legal claims. Specifically:

We never sell personal information.
We never show ads and never share data with advertisers.
We never use customer data to train AI models, except as our AI provider’s terms allow for content it flags for safety review (see Who else touches the data).
We do not mine or profile the records your agency enters; the optional exclusion check described above runs only when your agency turns it on. We use information about how the service is used to run, secure, support, and improve Volunteer Ledger and to set and enforce fair use. We also create data that we aggregate or de-identify so that it identifies no agency or person, and we may use that data for any purpose, including improving our other products and publishing statistics, as section 12 of our Terms of Service describes.

Who else touches the data (subprocessors)

We use a small number of providers to run and support the service:

Cloudflare: hosting and data storage (data stored in the United States; requests are handled at Cloudflare locations worldwide). Our systems of record for your agency’s records are the providers listed here and our encrypted database backups. We also make short-lived working copies to operate, support, or fix the service, which we delete when we are done.
Amazon Web Services (AWS): email delivery via Amazon SES (for messages the service sends, such as invitations and notifications), encrypted, off-site database backups via Amazon S3 for disaster recovery, and, if your agency turns on texting, text-message delivery via AWS End User Messaging (United States). AWS may also provide encrypted primary storage, in the United States (Amazon DynamoDB and Amazon S3), of records we class as sensitive: government ID numbers, health and screening results, background check results, sensitive notes, and uploaded documents. Backups of that store may persist for up to 35 days after deletion.
Microsoft: our business email (Microsoft 365), which holds the emails you send us and our replies, our internal alerts about your account (such as the one about each new signup, which names your agency and the person who signed up), and messages from our website’s contact form (United States).
Google LLC: from December 4, 2026, Firebase Cloud Messaging, under Google’s own Firebase terms, delivers Volunteer Ledger app notifications, such as shift reminders, to Android phones and tablets (United States and other countries). Google’s Firebase Data Processing and Security Terms apply to this service.
Apple Inc.: from December 4, 2026, the Apple Push Notification service, under Apple’s own developer terms, delivers Volunteer Ledger app notifications to iPhones and iPads (United States and other countries). We have no separate data processing agreement with Apple for this service. For both, a notification carries the device’s notification token, your agency’s name and the shift’s name or area, date, time, place and ID, never patient or other sensitive information.
Anthropic, PBC: AI tools we use to operate, support, and maintain the service, including reviewing problem reports and support emails and helping us fix problems (United States and other countries). While helping us, they may process data in the service, such as volunteer records, hours, requirements, and applications, and account and usage information. We use them on Anthropic’s consumer Claude Max plan, through an account held for us by our manager, under Anthropic’s consumer terms, not a business agreement, and we have no data processing agreement with Anthropic. The setting that lets Anthropic train its models on our sessions (“Help improve Claude”) is turned off. Its consumer terms still let it use what we send for its own purposes, including improving its services, safety review, and legal compliance, and let it use content its systems flag for safety review, including for model training even when the training setting is off. For flagged content, Anthropic’s published policy is to keep inputs and outputs for up to 2 years and safety classification scores for up to 7 years. It keeps feedback we submit, together with the data attached to it, for up to 5 years. Otherwise, with training off, it states that deleted conversations are removed from its systems within 30 days. These periods are Anthropic’s and may change. We never send Anthropic feedback (such as a rating or a feedback report) on work that includes an agency’s data. For an agency still on a version of this policy from before October 9, 2026, we do not use these AI tools on its data until one of its admins accepts this version. We never give these AI tools texting opt-in, consent, or opt-out records.

Apart from Anthropic’s own uses described above, these providers process data only as needed to provide their service to us. We will update this list before we add or replace a subprocessor, as our Data Processing Addendum describes.

Cal.com: Volunteer Ledger offers trial administrators and staff an optional form to book a 30-minute walkthrough call with us (“Book a 30-minute walkthrough”). The form is Cal.com’s, our scheduling provider, and is shown in a frame only after the person chooses to open it. It runs on Cal.com’s own site inside that frame and cannot read Volunteer Ledger’s pages, your agency’s records, or your sign-in. Cal.com receives what the person enters (such as name, email address, and any note) and their IP address and browser details, handles them under its own privacy and cookie terms, and sends the booking to us; the call is a Microsoft Teams meeting in our Microsoft 365. We send Cal.com nothing that identifies your agency. We don’t record or transcribe walkthrough calls. We keep bookings as our own business records (see Our role), so Cal.com is not on our list of subprocessors. When the form confirms a booking, Volunteer Ledger also notes in your agency’s account that a walkthrough was booked, when, and the email address of the signed-in user who booked it.

App stores. People get the Volunteer Ledger app from an app store, such as Google Play or Apple’s App Store. We send the stores none of your agency’s data, so they are not subprocessors. The store and the device’s maker may collect information about how the app is downloaded and runs under their own terms. Google Play shares some of it with us, such as install counts and crash reports that do not name the person.

Payments

Paid plans are sold and processed by Lemon Squeezy, our merchant of record. They are listed separately because they never receive your volunteer records (no volunteers, hours, or requirements). They receive the billing contact's name and email address and the subscription itself, and hold the card details, which we never see or store. As merchant of record, Lemon Squeezy handles that information under its own privacy terms, for its own tax and fraud-prevention obligations, not on our instructions.

How we protect it

Passwords are hashed with PBKDF2; we cannot see or recover them.
Optional two-step sign-in with an authenticator app, which an agency can require; authenticator keys are stored encrypted.
Session tokens are stored hashed.
If your agency configures custom SMTP credentials, they are encrypted at rest.
Role-based access controls (admin, staff, read-only viewer, and volunteer) limit who in your agency can see and change what.
Each agency's data is isolated to its own workspace (tenant isolation).
All traffic to the service is encrypted in transit over HTTPS.

No internet service can promise perfect security, but we will notify affected agencies promptly if we ever discover a breach involving their data. Our Security page covers these safeguards in more detail.

How long we keep data

Active subscriptions and trials: data is retained for as long as your account is active.
Lapsed accounts: if a trial or subscription lapses, the account becomes read-only. The data stays intact, viewable, and exportable. For an account bound by our Terms of Service effective October 9, 2026 or later, after 12 months read-only, counted as section 3 of those terms describes, and after at least 30 days’ email notice to the agency’s admins and any billing contact, we delete the account and its data, subject to the exceptions under Deletion on request and Backups.
Deletion on request: an agency admin can request deletion of the agency’s data anytime by emailing [email protected]; we confirm the request with the agency’s admins and wait 7 days before deleting. If any admin objects before we delete, we do not delete the account on that request unless every admin who objected withdraws the objection in writing; the account is otherwise handled as our Terms of Service describe, including the rule for lapsed accounts above. Section 6 of our Terms of Service has the details, including billing. We delete all of it from the live service, except: the business records described in the last bullet below; our audit trail (who created, changed, or deleted each hour entry and who saved which settings), which we keep as the Audit trail bullet below describes; a record of any email address that bounced, complained, or unsubscribed, or phone number that opted out of texts (the address or number, when, why, and for a phone number, which of our sending numbers it opted out of), kept on a list shared by our products only so that none of them emails that address again or texts that number again; texting records, which we keep as the Texting records bullet below describes; copies the Volunteer Ledger app saved on devices, which we do not hold and which the app erases when it next connects, as described under The Volunteer Ledger app; copies our subprocessors keep under their own terms, as described above; short-lived working copies we make to operate, support, or fix the service, which we delete when we are done; and anything the law, a legal hold, or a claim or investigation (including one we reasonably expect) requires us to keep. Backups are covered below.
Texting records: each mobile number’s consent and opt-out records (when and how it opted in or out, and the consent wording it saw) and whether its welcome text was sent, and each agency’s texting confirmations are kept with the agency’s account and for 4 years after it is deleted, only for compliance and to bring or defend legal claims, and then deleted. When an agency permanently deletes a volunteer or an application, the opt-in and confirmation coverage recorded for them are marked no longer valid, so the number is not texted on them again, but they are not deleted: they are kept, with any opt-out, for the same period and only for the same purposes.
Audit trail: we keep the audit trail of who created, changed, or deleted each hour entry, and of who saved which settings, for 7 years after each change, then delete it. Deleting an account does not delete its audit trail: we keep it only for legal and compliance purposes, and never more than 7 years after the account ends. Deleting a volunteer record does not delete the audit trail of hour entries made for that volunteer.
Backups: for disaster recovery we keep encrypted, access-controlled backups of the database and of uploaded documents in Amazon Web Services (Amazon S3) and Cloudflare: daily for 90 days and monthly for up to 12 months, some locked against change or deletion, even by us, for 90 days (longer under a legal hold). Deleted data can remain in backups until they expire. We use backups only to recover from a failure, to undo a deletion we made by mistake or without the notice our terms require (never one your agency confirmed), and where needed to comply with the law or a legal hold or to bring or defend legal claims. If we restore a backup, we take reasonable steps to re-apply deletions made since it was taken.
Abandoned signups: trial workspaces where nobody has ever signed in and no records were added are purged after about 7 days.
Sign-ins: the record of each sign-in, on the web or in the Volunteer Ledger app (where it includes the device’s make and model), is deleted within about a day after the sign-in ends or expires.
How you found us, messages you send us, and bug reports: the signup note is kept with your account and deleted with it, apart from the copy in our internal signup alert, which we keep as a business record. Emails and contact-form messages you send us and our replies, our internal alerts about your account, records of the messages our sending service sent for your agency (the content of each message for up to 30 days after sending), and the text of bug reports are kept as business records. Screenshots attached to a bug report are kept as business records and deleted on request. If you ask, we will delete or anonymize any of these sooner, unless we need to keep them for a legal, tax, or security reason; copies in backups expire on their normal schedule.

Your rights and choices

Agencies can access and export their records as our Data Processing Addendum describes, correct any record, and request deletion of their account and data by emailing us.

Individual volunteers and staff who want to access, correct, export, or delete information about themselves should contact their agency first; the agency controls its records and can handle most requests directly in Volunteer Ledger. You can also email [email protected] and we will help route the request to the right place. We respond to all requests and never penalize anyone for making one.

Cookies

Inside the signed-in web application we set essential cookies only: the session cookie that keeps you signed in, a short-lived one during two-step sign-in, and a short-lived one during Microsoft sign-in, which we also set in the device’s browser when someone signs in to the Volunteer Ledger app with Microsoft. There are no tracking cookies, no advertising cookies, and no analytics. On our public marketing pages we use Cloudflare Web Analytics, which Cloudflare says counts visits without cookies and without identifying or following individual visitors, so we can see which pages people use and improve them. Our own small script on those pages keeps the note of how you found us in your browser (in local storage, not a cookie) and ignores it after 30 days. The note leaves your browser only if you start a trial, send us anything through a form on our site, or tap a phone number or email link on our site; for a tap, we record the page, the note, and your approximate location (country and state), without your name or contact details. Our site does not respond to browser Do Not Track signals, and we do not track you across other websites. Cloudflare, and Cal.com if you open the booking form, may also receive your IP address and browser details on other sites, under their own privacy terms.

Children

Volunteer Ledger is a business tool for organizations and is not directed at children. Agencies may keep records about volunteers under 18; the agency is responsible for any consent the law requires. Our application form does not accept an application whose date of birth shows the applicant is under 13, and agency staff accounts are intended for adults.

Changes to this policy

If we change this policy, we will update the date at the top of this page and tell agency admins in Volunteer Ledger or by email. For an agency, a new version applies only once one of its admins accepts it, as section 11 of our Terms of Service describes; until then, the version it accepted keeps applying to it. Changes to our list of subprocessors are different: for each agency they follow section 5 of the Data Processing Addendum that agency has accepted, which gives notice and a chance to object, and they need no acceptance.

Contact

Questions, requests, or concerns: [email protected]. We reply during business hours.

Please don’t email us confidential or sensitive information, such as volunteer health or background-check results, or ID or license numbers. If you send it anyway, we’ll keep it confidential and delete it when we no longer need it.