Privacy Policy

1. Who this covers

This policy applies to nakadafoundation.org and the forms we run on it. The Nakada Foundation to Save Humanity is the controller of the personal information described here.

It does not cover other sites we link to, or platforms where we also publish — for example LinkedIn, or a video host embedded on a page. Those services set their own terms and collect their own data.

2. What we collect

Information you give us

Only what you type into a form. Depending on the form, that is an email address, and optionally a name, a subject line, and the message itself. Nothing is required beyond an email address on the update form, and an email address plus a message on the contact form.

Information collected automatically

The site is hosted on Cloudflare Pages. Like any web host, it processes technical request data — IP address, user agent, requested URL, timestamp, and country — to serve pages and to block abuse. We do not build visitor profiles from it, and we do not maintain our own server access logs beyond what our host retains.

Information stored in your browser

One item: a localStorage key called nf-theme, which remembers whether you chose light or dark mode. It stays on your device, is never sent to us, and clearing your browser data removes it.

3. Analytics

We use Google Analytics to understand which pages people read and where they arrive from. Two details worth knowing:

• It is deferred. The analytics script does not load when the page does. It loads only on your first real interaction — a scroll, a tap, a keypress — or when you leave the page. If you open a page and close it without touching anything, in most cases nothing loads.
• It is aggregate. We look at page counts, referrers, and rough geography. We do not use Analytics to identify individuals, and we have not connected it to advertising or remarketing features.

Once loaded, Google Analytics sets its own cookies and processes your IP address as described in Google's privacy policy. If you would rather not be counted, a tracker-blocking extension or Google's opt-out add-on will stop it, and the site works normally without it.

4. Forms and where they go

When you submit a form, the data goes to a Cloudflare Worker we operate and is stored in a Cloudflare D1 database. It is not emailed to a third-party inbox service and it is not pushed into a marketing platform.

Please do not put sensitive information — financial details, government identifiers, health information, or anything confidential to an employer — into these forms.

5. Email updates

If you join the update list we use your address for one purpose: sending occasional updates about the Foundation's work. We do not add addresses collected through the contact form to the update list, and we do not buy or import lists.

Every update includes an unsubscribe link, and you can ask us to remove you at any time through the contact page. Unsubscribing deletes the record; we do not keep a suppression profile beyond what is needed to honor the request.

6. Donations

Donations are handled by a third-party payment processor. Your card details are entered on the processor's infrastructure and never pass through our servers — we do not see, store, or have access to a full card number.

What we receive from the processor is the information needed to acknowledge and account for a gift: name, email address, amount, and date. We use it for receipts, thank-you notes, required financial records, and — if you have asked to hear from us — occasional updates. The processor handles your payment data under its own privacy policy.

7. Cookies and browser storage

We set no cookies of our own. The site's only first-party storage is the nf-theme preference described above.

Google Analytics sets cookies once it loads, on your first interaction. Embedded third-party content, where a page includes it, may set its own. Blocking cookies will not break anything on this site apart from your saved theme preference.

8. Our interactive tools

The calculators, quizzes, and trackers run entirely in your browser. Answers you give a quiz, numbers you enter in a calculator, and the job title you type into a job-risk tool are processed on your device and are not transmitted to us or stored on our servers. The site search works the same way: it downloads a small index file and filters it locally, so your search terms never reach us.

The exception is the ordinary analytics event that records which tool page was viewed — the same page-level data as any other page, with no tool inputs attached.

9. Why we process it

For visitors in the UK, the EU, and other regions with equivalent law, our legal bases are:

• Consent — for email updates and for analytics, which you can withdraw at any time;
• Legitimate interests — to answer messages you send us, to keep the site secure and working, and to understand aggregate readership;
• Legal obligation — to keep the financial and donor records the law requires us to keep.

10. Who else sees it

We do not sell, rent, or trade personal information, and we never will. We share it only with:

• Service providers that make the site run — our host and database provider (Cloudflare), our analytics provider (Google), and our payment processor — each acting on our instructions for the purposes described here;
• Legal authorities, where a valid legal process requires it, or where disclosure is necessary to protect someone's safety or to address fraud or a security incident.

If the Foundation ever merges with or transfers its programs to another organization, personal information may move as part of that transfer, and it would remain subject to a policy at least as protective as this one.

11. How long we keep it

• Update list: until you unsubscribe or ask to be removed.
• Contact messages: up to two years after the exchange ends, so we can pick up a thread we have handled before.
• Donation records: as long as financial and tax rules require, which is typically seven years.
• Analytics: according to Google's retention settings for the property.
• Host request logs: according to Cloudflare's own retention schedule; we do not maintain a separate copy.

12. Security

The site is served over HTTPS. Form data travels encrypted, is stored on managed Cloudflare infrastructure, and is reachable only by the small number of people who need it. We collect little precisely so there is little to lose.

No system is perfectly secure. If a breach affects your personal information, we will tell affected people and the relevant authorities as the law requires, and we will say plainly what happened.

13. Your rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you;
• give you a copy of it;
• correct anything inaccurate;
• delete it;
• stop sending you email;
• restrict or object to a particular use.

Write to us through the contact page and we will respond within 30 days. There is no charge, and we will not treat you differently for asking.

Residents of California have specific rights under the CCPA and CPRA, including the right to know, delete, and correct, and the right to opt out of sale or sharing — we do not sell or share personal information as those laws define it, so there is nothing to opt out of. Residents of the UK and EU have the rights above under the UK GDPR and GDPR, including the right to lodge a complaint with a supervisory authority, though we would appreciate the chance to put things right first.

We honor Global Privacy Control and Do Not Track signals where your browser sends them.

14. Children

This site is written for a general adult audience. We do not knowingly collect personal information from children under 13 (or under 16 in regions where that is the threshold). If you believe a child has sent us information, tell us and we will delete it.

15. International transfers

We are based in the United States and our providers operate globally, so information you send us will be processed in the United States and potentially in other countries where those providers run infrastructure. Where personal information moves out of the UK or the European Economic Area, our providers rely on standard contractual clauses or another approved transfer mechanism.

16. Changes to this policy

When our practices change, this page changes with them, and the "last updated" date at the top moves. If a change materially affects how we use information you have already given us, we will say so here and, where we can reach you, by email.

17. Contact

Please contact us for privacy questions, access requests, or deletion requests.