Privacy Policy

When you create an account, Supabase Auth stores your email address, a hashed password we never see, the display name you give at sign-up, and timestamps for when the account was created, when the email was confirmed, and when you last signed in.

Your profile holds what you choose to put in it: display name, username, bio, city, state, and your visibility setting. Every one of those except the display name can be left empty.

Patriot ancestor records hold what you enter: the ancestor’s name, and optionally rank, unit, colony or state, type of service, an SAR reference number, and your own notes. Only the name is required.

Journal entries hold what you write against a library document, with the document they belong to and the dates you wrote and last edited them. They are private permanently: no other member can read them, no signed-out visitor can, and there is no setting that opens them. The database has no column that could, and the policies name only their owner.

A lineage chain is your private record of the line of descent from you back to a patriot ancestor you have recorded. It holds a name, years where you know them, how each person relates to the one before, how well you think that link is established, your own research notes, and any sources you attach. A source is a reference, never a file: a citation, a link, and what you offer it as proving. We host no documents.

A chain is private permanently. Only you can read it. No other member can see it under any profile setting, nothing in it is shown to a signed-out visitor, and it is never used on any public page. The early links in a chain are living people, your parents and grandparents, who are not members here and have not agreed to anything, so we hold that record for your use alone. There is no setting that makes a chain visible, because we did not build one.

A connection records that one member asked to connect with another, when, whether it was accepted, and optionally which of the sender’s own patriot ancestor records prompted it. It carries no message. There is no message field anywhere in the feature, so there is nothing written between members for us or anyone else to read. A connection unlocks nothing and reveals no profile field that was not already visible.

A block records that one member has blocked another, and it is visible only to the member who made it. The member blocked by it is never told: their request simply fails, the way any unavailable action fails.

A highlight records a passage you marked in a library document: the document, the part if it has parts, where the passage sits in the text, the words of the passage, and when you marked it. A bookmark records where you asked to come back to: the document, the part if there is one, and when you last moved it. A bookmark is a place and nothing more; it records nothing about what you read.

When you press “I’ve read this” at the end of a document or a civic guide, we record that you marked it read. Whenever you say you have read something, we also record the date, and nothing more: not what you read and not the time of day. The date comes from your own device. Those dates are your reading days, and they are what the count of days running in your lobby is made from.

An honor is recorded when your own records meet its published criteria: which honor, and the date we recorded it. Nothing else decides one, and once recorded it stays until your account is deleted.

Highlights, bookmarks, marks, reading days and honors are private permanently. Only you can see them. No other member can, no signed-out visitor can, there is no setting that makes them visible, and nothing counts them across members. You can remove a highlight or a bookmark, undo a mark or remove a reading day yourself, and all of them are deleted with your account.

We do not collect avatars, phone numbers, postal addresses, dates of birth, or anything about living relatives. We do not ask for documentation of a lineage and we do not want it.

A chapter claim collects the name you give, your role in the chapter, and a contact email for us to reach you about the claim. None of those three is published.

The form also offers a separate public chapter contact. It is optional, and if you supply it, it appears on the chapter page for anyone to read. The two addresses are asked for separately on purpose: publishing an address should be something you chose, not something inferred from a field you filled in for another reason.

A correction report collects what you write and, if you choose to give one, an email address so we can answer. Neither is published. We also store a salted hash of your network address, rotated daily, purely to stop the form being flooded. It is not reversible and yesterday’s hashes are useless.

These are genealogical claims about your own family, entered by you. We do not verify them, we do not check them against any registry, and an SAR reference number in that field is a number you typed rather than a credential we confirmed.

They are treated as part of your profile and follow its visibility setting. Signed-out visitors never see them under any setting. Signed-in members see them if your profile is set to members or public. If your profile is private, only you can see them.

There is one setting that anticipates a change and does not make it. On each ancestor record you may tick a box marking that record as one you would be willing to see on a public page about that patriot. Ticking it changes nothing today. No such page exists, no route serves one, and a signed-out visitor still sees no ancestor record under any setting, including a record you have ticked. The box exists now so that you can answer the question when you enter a record rather than being asked to go back over old ones later. If we ever build those pages, this policy will say plainly what changes and what appears, before any of them are published.

An ancestor is a dead person, but a lineage says something about living people, including you. That is why the records sit behind your visibility setting rather than being public by default, and why you can delete any of them at any time from your profile.

Private. Only you can see your profile. It does not appear in the member directory.

Members. Signed-in members can see your full profile and your ancestor records, and you appear in the member directory. Signed-out visitors see nothing.

Public. The same as members, and in addition a signed-out visitor can see your display name, username and state on your profile page. Even then, a signed-out visitor cannot see your bio, your city, or any ancestor record. That limit is enforced in the database, not only in the pages.

The member directory itself is behind sign-in today, so public means a profile page a stranger could open, not a listing a stranger can browse.

Supabase hosts the database and the authentication system, and sends the confirmation and password reset emails. Your account and everything in your profile live there.

Vercel hosts and serves the site. As with any web server, Vercel receives the network information every request carries, including your IP address.

Resend delivers the notifications we send ourselves when someone claims a chapter or reports a correction. Those messages carry what you put in the form, including your name, your role and your contact address on a claim, or your message and address on a correction. They go to us and to nobody else, and Resend holds them for a short period as any mail provider does.

Stripe will handle payments when membership opens. Card details go directly to Stripe and never reach our servers. We do not see, store, or have any way to retrieve a card number. Nothing is charged today and no payment processing is switched on.

The representative lookup takes an address, sends it to the US Census Bureau geocoder to resolve a congressional district and a county, and then it is gone. We do not store it, we do not log it, and it is never put in a web address, which means it is not in your browser history, not in a referrer, and not in the pageview our analytics records. The form is a POST for that reason.

The Census Bureau receives the address, because it is the service resolving the district. What we are telling you is that Huzzah does not keep it. How that was checked rather than asserted is written up in the repository, in docs/civic-address-handling.md.

The lookup needs no account, and using it signed in records nothing against your profile.

We use Vercel Web Analytics to count pageviews. It is cookieless. It sets no cookies, writes nothing to your browser’s storage, and does not follow you to other sites. A pageview sends the page address, a timestamp, the version of the analytics script, and the referring address when you arrived from another site.

The script has no access to your session. A signed-in member’s pageview is identical to a stranger’s, and carries no user id, no email, and no identifier we could tie back to an account. It measures pages, not people. We use it to see which documents and chapters people find, not to build a picture of anyone.

There is no Google Analytics here, no tag manager, no advertising pixels, and no third party fonts. Every file the site loads comes from our own domain.

The only cookies we set are the ones that keep you signed in. They are set when you sign in and cleared when you sign out. If you never create an account, the site sets no cookies at all.

You can delete your own account, from your account page, without asking anyone. It happens immediately. You type your username to confirm, and the page shows you what will go before you confirm it: every ancestor record by name, how many journal entries will go with them, how many lineage chains go with them, how many connections you are party to, and how many blocks you have made. The entries and the chains are counted rather than listed, because what is written in them is yours. Deleting your account removes your side of every connection, which removes the connection, and every block you made.

If you would rather we did it, email hello@indianlakesmarketing.com from the address on the account and we will delete it within seven days.

Deletion removes the authentication record, the profile, and every patriot ancestor record attached to it. The ancestor records go automatically with the profile, by cascade in the database. It is permanent and we cannot undo it.

Two things survive, and you should know what they are. Server logs held by Vercel and Supabase age out on their schedules rather than ours. Aggregate analytics counts remain, because they were never tied to you in the first place.

We do not sell your data. We do not share it with advertisers. We do not use your ancestor records for anything other than showing them to whoever your visibility setting allows.

Email hello@indianlakesmarketing.com. Huzzah is published by Indian Lakes Marketing LLC, Wolcottville, Indiana.