Privacy Policy

1. Who We Are

WeWillHelp is a child safety awareness platform privately built and operated by an individual based in Florida. We provide public sex offender registry awareness, missing-persons information, AMBER alerts, and safety education. The platform is intended for use within the United States.

This Privacy Policy explains what we collect, why, how long we keep it, who else processes it, and what rights you have. Questions: [email protected].

2. Information We Collect

2.1 Anonymous use (no account)

Location data. When you allow location access or type an address, the coordinates are sent to our server to query the offender registry, missing-persons database, and area features. The search itself uses your exact position, but we never write your exact position down: before anything is stored, coordinates are rounded to two decimal places — a grid square roughly 0.6 miles on a side. What lands in our search log is that rounded square, the radius, the timestamp, and your IP address, kept for 30 days for legal-request response, abuse prevention, and rate-limit enforcement. A subpoena for that log returns a neighbourhood, not an address.

Device lock (passkey). An account can be locked to one phone or computer with a passkey. The passkey is made by your device and confirmed with its own Face ID, fingerprint or PIN; that check happens on your device and nothing about it is sent to us. We store only the passkey's public key (which cannot be used to sign in), a short device label such as "iPhone · Safari", and which signed-in session last confirmed it. They are deleted when you move the lock to a new device or delete your account.

Verify / Check usage counts. When you press Check in Verify / Check we count it anonymously: which role and checklist you picked, whether you typed a name and whether you typed a place (yes or no only), the state, and whether there was a registry match. We never record the name you searched, the address, your IP address, or anything that identifies you or your device. These counts tell us which checklists families, schools and programs actually use.

IP address and user agent. Standard request metadata is logged in our search log and Vercel access logs (Vercel retains per their policy).

Browser fingerprint. A short hash derived from your browser characteristics (canvas rendering, screen size, timezone, user-agent) is computed and may be sent with API requests. Used solely to detect coordinated abuse across multiple IPs. Cannot be used to re-identify you outside our service.

Daily usage counters. A small counter per IP per day enforces our daily-call caps. Discarded after the day rolls over.

Local device storage. Your browser's localStorage holds preferences (Parent/Child mode, daily usage counters, optional dev-mode key). This data stays on your device.

2.2 Account use (when you sign up)

Account credentials. Email address (used as your login + for transactional email) and password. The password is hashed with bcrypt by our authentication provider (Supabase Auth) — we never see, store, or have any way to retrieve your plain-text password.

Profile preferences. Display name (optional), notification preferences (email/push), state of residence (optional), digest opt-in flag.

Watch zones. Any addresses you save for monitoring (label, address, lat/lng, radius). These are linked to your account.

Audit log of account events. Sign-in events, password changes, account-deletion requests are recorded with timestamp, IP, and user-agent. Retained 1 year.

Terms acceptance record. When you sign up, we record which version of the Terms of Use and Privacy Policy you agreed to, your IP, and timestamp. Retained until your account is deleted.

2.3 Premium subscription (when you subscribe)

Payment processing. Subscription payments are processed by Stripe, Inc. We never see, receive, or store your full credit card number, CVV, or billing address. Stripe holds those. We retain only: your Stripe customer ID, subscription ID, plan tier (monthly/annual), card last 4 digits and brand (e.g., "Visa ending in 1234"), subscription dates, and event timestamps. Payment-event records are retained 7 years for IRS/tax compliance.

Refund, cancellation, and dispute events. When you cancel a subscription, request a refund, or initiate a card-dispute / chargeback, Stripe notifies our server via signed webhook. We record the event type, timestamp, Stripe-issued reason code, and amount in the payment log. We use this only to (a) end Premium access at the correct time, (b) prevent re-billing on a canceled card, and (c) respond to legitimate billing-error correspondence. We do not share dispute history with any third party other than Stripe (who already has it) and our tax preparer at year-end if the amounts affect reportable revenue.

Email communications. Receipt emails, payment failures, subscription changes, and (if opted in) weekly digests and movement alerts. Sent via Resend.

2.4 What we do NOT collect

• Full credit card numbers or CVV (Stripe holds them)
• Plain-text passwords (hashed by Supabase Auth)
• Live AI chat with users (parents or children). In May 2026 we deprecated the live AI chat features (kid support, grooming analyzer) and replaced them with static, human-curated reference content. No live AI conversation occurs with any user. The legacy endpoints, if hit, return the same static safety resources the UI now shows natively, without invoking any AI model.
• Any input from children — the app has no surface that asks a child for their name, location, photo, or contact information
• Phone numbers, biometric data, government identifiers, health information, financial account numbers beyond what Stripe holds
• Browsing activity outside WeWillHelp

3. How We Use Information

• To run the service: query registry/missing-persons APIs, render the map, deliver AI summaries, send alerts
• To enforce daily caps and prevent abuse
• To bill you for Premium subscriptions and send receipts
• To respond to lawful legal requests (subpoenas, court orders, preservation requests)
• To investigate suspected abuse, fraud, or violations of our Terms of Use
• To send transactional email (account verification, password reset, payment receipts) — these cannot be opted out of while your account is active
• To send marketing/digest email only if you opted in; you can opt out from any email or in account settings

We do not use your information for advertising, third-party profiling, or any purpose beyond the immediate functions of the service.

4. Third-Party Services (Sub-processors)

WeWillHelp depends on the following sub-processors. Each has its own privacy policy and is bound by data-processing terms with us:

• Vercel, Inc. — Hosting and serverless functions. Standard web logs (IP, request, response code) per Vercel policy. Privacy Policy
• Supabase, Inc. — Database (account data, watch zones, search logs, payment-event mirror), authentication, encrypted storage. SOC 2 Type II. Privacy Policy
• Stripe, Inc. — Payment processing for Premium subscriptions. PCI Service Provider Level 1. We receive only tokens and last-4 digits. Privacy Policy
• Resend (Resend.com, Inc.) — Transactional email delivery (auth confirmations, alerts, digests). Privacy Policy
• Anthropic, PBC (Claude API) — AI processing for area briefings and chat features. Per Anthropic's commercial terms, prompts are not used to train models and are retained per their policy. Privacy Policy
• Offenders.io — Sex offender registry data aggregator. offenders.io
• Google LLC (Maps Platform, Sign-In) — Mapping, geocoding, address autocomplete, optional Sign-in-with-Google. Privacy Policy
• Cloudflare, Inc. — DNS, edge security, bot/abuse detection (Turnstile CAPTCHA). Privacy Policy
• NCMEC (National Center for Missing & Exploited Children) — Missing-children data via NCMEC public ArcGIS feature service and Poster API. Privacy Policy
• Florida Department of Law Enforcement — Florida offender photos and All Current Alerts feed.
• Esri / ArcGIS Online — Hosting NCMEC's missing-children dataset. Privacy
• Overpass API (OpenStreetMap) — Park, playground, and childcare facility overlays.
• NCES (National Center for Education Statistics) — Public school location data.

5. Data Retention

• Search log (anonymized API activity — endpoint, timestamp, and a location rounded to a ~0.6-mile grid square; never an exact position): 30 days, then automatically deleted by a daily retention job. Your IP address is stripped from these rows earlier still, at 7 days.
• Audit log (sign-in events, account actions, security events): 1 year.
• Anonymous usage records (browser fingerprint hash + truncated IP, used only to enforce per-day free-tier search caps for users not signed in): 2 days, then automatically deleted. We never link this to a name, email, or account.
• Push notification subscriptions (the encrypted endpoint URL + public keys your browser hands us when you opt in): retained while your account is active. Deleted on account deletion, on explicit unsubscribe from the toggle in Settings → Registry Alerts, and automatically whenever the push service returns HTTP 410 (you uninstalled the PWA or revoked permission in browser settings).
• Terms acceptance records: retained until your account is deleted (cascades).
• Payment records (Stripe charge IDs, amounts, dates — never card numbers): 7 years (IRS retention requirement).
• Account data (email, profile, watch zones, notification preferences): retained until you delete your account, then 90 days in deletion-grace before permanent removal.
• Cached registry data: 7 days, then refreshed from source.

Off-site backups. Once weekly, a compressed JSON dump of account-relevant tables (the data above, excluding the high-volume search and audit logs) is emailed to the operator's admin inbox as a disaster-recovery copy. The backup is encrypted in transit (TLS) and lives only in the operator's email until the operator's mail provider's retention policy removes it. If you delete your account, your data is removed from the live database; backup copies older than your deletion are not retroactively scrubbed, but those older copies are never restored unless we're recovering from a catastrophic data loss.

6. Children's Privacy (COPPA)

WeWillHelp accounts require users to be at least 18 years old. We do not knowingly collect personal information from anyone under 13.

The "Safe" tab is a static educational reference for ages 5–17. It contains age-segmented safety guidance and tap-to-call links to human-staffed crisis lines (988 Suicide & Crisis Lifeline, Crisis Text Line, NCMEC). It does not include a child-facing AI chat; we removed the experimental AI chat surface in v139 (2026-05-14) and do not plan to reintroduce it. No content the child reads on the Safe tab is sent to or stored on our servers — it's all client-rendered. Tapping a tap-to-call link uses your device's native dialer and is not routed through us.

If you believe a child under 13 has provided personal information through our platform, contact us immediately at [email protected] and we will delete the information promptly.

7. Data Security

All data in transit is encrypted via HTTPS/TLS 1.2+. Strict-Transport-Security is enforced for one year. API keys and credentials are stored as encrypted server-side environment variables and never exposed to browsers. Supabase data is encrypted at rest (AES-256) and isolated by row-level security so each user can only see their own records. Passwords are hashed with bcrypt (one-way; we cannot retrieve plain text). Payment card data is held by Stripe under PCI Level 1 compliance — never on our systems.

Despite reasonable precautions, no system is perfectly secure. If a breach occurs that affects your data, we will notify you in accordance with applicable state and federal breach-notification laws.

8. Registry Data Disclaimer and Use Restrictions

Sex offender registry data is sourced from official state registries via Offenders.io. This data is public information provided for community awareness. Registry information may not be current. Always verify with local law enforcement before acting. WeWillHelp makes no warranties regarding the accuracy, completeness, or timeliness of registry data.

Registry data is provided for awareness purposes only. It is not intended for harassment, vigilantism, employment decisions, housing decisions, insurance decisions, education decisions, business licensing, government benefits, or any consumer-reporting use. WeWillHelp is not a consumer reporting agency under the Fair Credit Reporting Act (FCRA), and its data may not be used for any FCRA-regulated purpose.

Many states (including Florida F.S. §775.21(7)(d), California Penal Code §290.46(j)(1), Texas Penal Code §43.26-related restrictions, and similar provisions in other states) explicitly prohibit using registry data for purposes such as harassment, vigilantism, or commercial solicitation. Misuse may violate federal and state laws and is grounds for immediate account termination.

9. Your Privacy Rights

9.1 Rights all users have, regardless of state

• Access: Request a copy of the data we hold about you. We will respond within 45 days.
• Correction: Update or correct inaccurate information in your account.
• Deletion: Request that we delete your account and associated data. Some records (payment history per IRS retention, terms-acceptance log) may be retained where required by law.
• Portability: Receive a copy of your data in a structured, machine-readable format (JSON).
• Opt out of marketing email: Use the unsubscribe link in any email or change preferences in account settings. Transactional email (account verification, password reset, payment receipts) cannot be opted out while your account is active.
• Account self-service deletion: Sign in → Account → "Delete account." Permanent and immediate. We anonymize records that are legally retained.
• Data breach notification: Every US state requires notification of security breaches affecting personal information. We comply with the strictest applicable timeline (typically 30–60 days from discovery).

9.2 California — CCPA & CPRA

California residents have rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. WeWillHelp does not sell or share personal information for cross-context behavioral advertising or any purpose. A "Do Not Sell My Personal Information" link is provided below as required, but functions as confirmation that we do not sell. We do not engage in profiling or automated decision-making producing legal effects. To exercise California rights, email [email protected] with subject "CCPA Request." Authorized agents may submit requests with proof of authorization. Response within 45 days.

9.3 States with comprehensive privacy laws (effective 2026)

Residents of the following states have rights similar to California's under comprehensive consumer privacy laws — typically access, correction, deletion, portability, opt-out of targeted advertising, opt-out of sale, opt-out of profiling. To exercise rights, email [email protected] with subject "State Privacy Request" and your state of residence. Response within 45 days.

• Virginia — Virginia Consumer Data Protection Act (VCDPA)
• Colorado — Colorado Privacy Act (CPA)
• Connecticut — Connecticut Data Privacy Act (CTDPA)
• Utah — Utah Consumer Privacy Act (UCPA)
• Texas — Texas Data Privacy and Security Act (TDPSA)
• Iowa — Iowa Consumer Data Protection Act (ICDPA)
• Oregon — Oregon Consumer Privacy Act (OCPA)
• Montana — Montana Consumer Data Privacy Act (MCDPA)
• Indiana — Indiana Consumer Data Protection Act (INCDPA)
• Tennessee — Tennessee Information Protection Act (TIPA)
• Delaware — Delaware Personal Data Privacy Act (DPDPA)
• New Jersey — New Jersey Data Privacy Act
• New Hampshire — New Hampshire Privacy Act
• Kentucky — Kentucky Consumer Data Protection Act (KCDPA)
• Maryland — Maryland Online Data Privacy Act (MODPA)
• Minnesota — Minnesota Consumer Data Privacy Act
• Rhode Island — Rhode Island Data Transparency and Privacy Protection Act
• Nebraska — Nebraska Data Privacy Act

9.4 States with sector-specific or breach-notification protections

Residents of the following states are protected by state-specific data breach notification laws, state Unfair and Deceptive Acts and Practices (UDAP) statutes, and where applicable, sector-specific privacy laws (financial, health, education). We comply with all applicable laws. Email [email protected] with subject "Privacy Request" + your state for any inquiry.

• Alabama — Alabama Data Breach Notification Act of 2018
• Alaska — Alaska Personal Information Protection Act
• Arizona — A.R.S. §18-552 (breach notification)
• Arkansas — Arkansas Personal Information Protection Act
• Florida — Florida Information Protection Act (FIPA), 30-day breach notification
• Georgia — O.C.G.A. §10-1-911 (breach notification)
• Hawaii — Hawaii Security Breach of Personal Information statute
• Idaho — Idaho Code §28-51-104 et seq.
• Illinois — Illinois Personal Information Protection Act (PIPA); Biometric Information Privacy Act (BIPA) — we do not collect biometrics
• Kansas — Kansas Wireless Communication Devices Act; Personal Information Protection
• Louisiana — Louisiana Database Security Breach Notification Law
• Maine — Maine Notice of Risk to Personal Data Act; Maine Act to Protect the Privacy of Online Customer Information (ISP-specific)
• Massachusetts — Massachusetts 201 CMR 17.00 (security safeguards) — we maintain a Written Information Security Program consistent with this requirement
• Michigan — Michigan Identity Theft Protection Act
• Mississippi — Mississippi Code §75-24-29
• Missouri — Missouri Revised Statutes §407.1500
• Nevada — Nevada Online Privacy Act (NRS §603A) — opt-out of sale of personal information honored by default
• New Mexico — New Mexico Data Breach Notification Act
• New York — New York SHIELD Act (security + breach) — we maintain reasonable safeguards consistent with this law
• North Carolina — North Carolina Identity Theft Protection Act
• North Dakota — N.D. Cent. Code §51-30 (breach notification)
• Ohio — Ohio Revised Code §1349.19; Ohio Data Protection Act (cybersecurity safe harbor)
• Oklahoma — Oklahoma Security Breach Notification Act
• Pennsylvania — Pennsylvania Breach of Personal Information Notification Act
• South Carolina — S.C. Code §39-1-90 (breach notification)
• South Dakota — S.D. Codified Laws §22-40-19 et seq.
• Vermont — Vermont Security Breach Notice Act; Vermont Data Broker Regulation
• Washington — Washington My Health My Data Act (we do not collect health data); Washington breach notification
• West Virginia — West Virginia Code §46A-2A-101 et seq.
• Wisconsin — Wisconsin Statute §134.98 (breach notification)
• Wyoming — Wyoming Statute §40-12-501 et seq.
• District of Columbia — D.C. Security Breach Notification Act

Where state law provides rights beyond what is listed here, we will honor those rights upon request even if not specifically enumerated above. Email us with the law you're invoking and we will respond appropriately within the timeframe required.

9.5 Territories and federal districts

Residents of Puerto Rico, Guam, the U.S. Virgin Islands, American Samoa, and the Northern Mariana Islands may exercise the same rights described in section 9.1, plus any rights granted by their territory's privacy framework. Federal employees and military personnel are covered by their state of residence.

9.6 Children and parents

Parents may request deletion of any data associated with a child by emailing [email protected]. Because the child chat tab does not collect identifying information, there is typically nothing to delete, but we will investigate and confirm in writing.

9.7 EU/UK residents

WeWillHelp is designed for use in the United States. We do not intentionally collect data from EU/UK residents. If you are in the EU/UK and believe we hold data about you, contact us and we will investigate and delete as appropriate. We do not market or knowingly serve users in the EU/UK.

9.8 Federal sector-specific protections

The following federal laws may apply depending on the type of information involved. We do not knowingly collect data subject to these laws beyond what is disclosed in this policy:

• COPPA (Children's Online Privacy Protection Act) — addressed in Section 6 above. Account creation requires age 18+. The kid chat is anonymous.
• HIPAA — does not apply; we are not a covered entity or business associate, and we do not collect protected health information.
• GLBA — does not apply; we are not a financial institution.
• FERPA — does not apply; we are not an educational institution.
• FCRA — does not apply; we are not a consumer reporting agency. Use of registry data for FCRA-covered decisions is prohibited by our Terms of Use.
• CAN-SPAM — applies to our marketing/digest email. Every promotional email includes an unsubscribe link and our physical address.
• TCPA — applies if we ever send SMS (we currently do not). If we add SMS, opt-in will be required and STOP will unsubscribe.
• VPPA — does not apply; we do not provide video rental or streaming services.

10. Cookies and Tracking

WeWillHelp does not use third-party analytics cookies or advertising trackers. We use first-party browser localStorage for app preferences and authentication session tokens (when signed in). Stripe and Cloudflare may set their own cookies for payment processing and bot detection respectively; see their privacy policies linked above.

11. Data Breach Notification

If we become aware of a security incident affecting your personal information, we will notify you and relevant authorities in accordance with applicable law (e.g., Florida Information Protection Act 30-day window, California Civil Code §1798.82, GDPR-equivalent timelines for any affected EU users) by email and, where appropriate, by in-app notice.

12. International Transfers

Our service operates from US-based infrastructure (AWS us-east-1 via Vercel and Supabase). If you access WeWillHelp from outside the US, your information will be transferred to and processed in the US. By using the service, you consent to this transfer.

13. Changes to This Policy

We may update this policy as the platform evolves. The version number above changes when material updates are made. Existing users will be notified by email of material changes at least 30 days before they take effect, and asked to re-accept the updated terms. Continued use after the change date constitutes acceptance.

14. Do Not Sell My Personal Information

WeWillHelp does not sell your personal information to anyone, for any purpose, ever. This statement satisfies the "Do Not Sell" notice requirement under California Civil Code §1798.135 and equivalent state laws. If you have questions, contact [email protected].

15. Contact