Privacy Policy

GoodChange (“GoodChange,” “we,” “us”) operates a platform that lets political organizations, committees, and nonprofit organizations (“Organizations”) accept and manage donations from supporters (“Contributors”). This policy explains what information we collect, how we use it, and the choices you have. It applies to contributors, organization staff, and anyone else who uses goodchange.app or a Organization’s donation page hosted on it.

When you make a donation, create an account, or interact with an Organization’s page, we may collect:

• Contact information: name, email address, mailing address, and phone number.
• Employer and occupation, when required for a political contribution. Federal and many state organization finance laws require organizations to collect and report this information for contributions over certain thresholds — we collect it on the Organization’s behalf, not for our own purposes.
• Payment details. Card numbers are sent directly to our payment processor, Stripe; we store only the last 4 digits, card brand, and similar non-sensitive metadata Stripe returns to us.
• Bank-linking information, only if you enroll in a spare-change round-up program, via Stripe Financial Connections. We receive enough information to process the round-up, not your online banking credentials.
• Account credentials, if you create a contributor or staff account (email and a securely hashed password, managed by our authentication provider, Supabase).
• Basic visit information for the page you land on (referring channel, approximate location, device type). This is tied to a one-time token generated fresh for that page load — we do not set a persistent tracking cookie, and we cannot connect a visit in one browsing session to a donation made in a later, separate session.

• To process one-time and recurring donations, memberships, and ticket purchases.
• To generate receipts, confirmations, and account notifications you’ve opted into.
• To help Organizations meet their legal recordkeeping and reporting obligations under organization finance law (for example, itemizing contributions that exceed a reporting threshold).
• To screen for prohibited or fraudulent contributions and to enforce contribution limits.
• To respond to support requests and to improve the reliability of the platform.

• The Organization you donate to. A donation is inherently a relationship between you and that Organization — your contact, employer/occupation, and giving history are visible to the Organization’s authorized staff so they can issue receipts, respond to you, and file accurate compliance reports.
• Service providers who process data on our behalf: Stripe (payments), Supabase (hosting and authentication), Postmark (email delivery), and Stripe Financial Connections (bank-linked round-ups). Each only receives what it needs to perform its function.
• Government agencies, when an Organization is legally required to report contribution data.
• Anyone else, only if required by law or with your consent.

We do not sell your personal information.

We retain donation and contribution records for as long as the applicable Organization has a legal obligation to keep them, which for federal political contributions can extend several years past the contribution date. Account information is retained while your account is active. You can ask us to delete information that isn’t subject to a legal retention requirement at any time (see “Your choices” below).

• Every marketing or update email includes a working unsubscribe link.
• You can review and update your contact and payment details from your contributor dashboard at any time.
• You can ask us to access, correct, or delete your personal information by emailing support@goodchange.app. We’ll honor these requests except where we’re legally required to retain the information.

We use industry-standard safeguards — encryption in transit, access controls, and processors that are themselves PCI-compliant for payment data — to protect your information. No online service can guarantee perfect security, so we can’t promise it either.

GoodChange is not directed at children under 13, and we do not knowingly collect information from them.

We may update this policy from time to time. If we make a material change, we’ll update the date at the top of this page and, where appropriate, notify account holders directly.