Privacy Policy

What We Collect

When you apply to the oPPal Program, we collect:

• Identity & contact: name, email address, phone number
• Location: ZIP code (used to derive city and state, and as a fraud-prevention signal — see "Verification & Fraud Prevention" below)
• Pregnancy & health-related information: due date or birth date, pregnancy stage, complications, feeding plans
• Personal background: relationship status, path to parenthood, work situation, support circle, personality, faith and cultural preferences
• Social media: an optional link to your social profile
• Communication preferences: how you prefer to be contacted and matched
• Technical information: the IP address you submit your application from, used solely as a fraud-prevention signal
• Cookies & analytics: standard cookies and device information (browser type, operating system, pages visited, referring URL) collected via Google Analytics to help us understand how visitors use the site and improve the Program. Analytics cookies are only set after you consent via our cookie banner. See "Cookies & Your Choices" and "How We Share Your Information" below.
• Referral source: if you reach our site from a partner newsletter, a social post, or another website, we store a first-party cookie on your browser recording where that visit came from — the campaign or partner name, the referring website address, and which page you landed on. This cookie is set by us, is not shared with anyone, and lasts up to 90 days. If you go on to apply, this referral information is saved alongside your application record so we know which partners are reaching the moms we're trying to serve.
• Other information: any additional information you voluntarily provide when signing up for or participating in the Program.

How We Use Your Information

• To match you with a compatible oPPal participant
• To administer and improve the oPPal Program
• To contact you about your application, match, and Program updates
• To send optional news and community updates (only if you opt in)
• To facilitate communication between matched oPPal pairs. Depending on Program operational state and the participants' consent at the time of match, this may take one of two forms: (a) a proxy phone number that masks both parties' real numbers, or (b) direct exchange of phone numbers so participants can communicate on their personal phone lines
• To comply with legal requirements and legal process, and to protect oPPal's rights, privacy, and safety, and that of our participants and other third parties
• To develop new services and features for the Program
• To prevent fraud or illegal activity and to ensure the safety of the Program, its participants, and oPPal

How We Share Your Information

We share your information only as needed to operate the Program:

• With your matched oPPal — only the information you consent to share (controlled by your sharing preference during application). In matches where direct phone-number exchange is the communication method, your phone number is shared with your matched oPPal once both parties have actively confirmed the match. Once shared, oPPal cannot retrieve or revoke this information from the recipient's device.
• With the oPPal internal team — for matching, support, and Program operations.
• With Twilio, Inc. — We use Twilio as our SMS provider to route messages between matched oPPal pairs via proxy phone numbers. Twilio processes message content solely to deliver messages. Your real phone number is never shared with your matched oPPal in matches that use the proxy SMS form. See Twilio's Privacy Policy for how they handle data.
• With verification and fraud-prevention providers — when you submit an application, limited information (phone number, email, and IP address) is shared with third-party providers that help us confirm contact details and screen for fraudulent submissions. See "Verification & Fraud Prevention" below for the full list.
• With Google LLC (Google Analytics) — usage data is processed by Google to provide site analytics. We use Google Consent Mode v2 so that analytics data is only collected after you grant consent via our cookie banner. See Google's Privacy Policy.
• Legal requirements — we may share your information when required by law, subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to protect rights, property, or safety.

We do not sell, rent, or share your personal information with third parties for commercial or advertising purposes.

Verification & Fraud Prevention

When you submit an application, we run automated checks on the contact details you provide to confirm they are real and to screen for fraudulent submissions. These checks help us prioritize staff review and protect Program participants. Results inform human review — they are not used as the sole basis for denying an application.

We use the following providers for verification and fraud prevention:

• Twilio, Inc. (Verify and Lookup) — receives your phone number to send a one-time verification code and to assess phone-number quality signals (carrier, line type, recent reassignment). See Twilio's Privacy Policy.
• SEON Technologies Ltd. — receives your email address and IP address to return a fraud risk score based on signals such as domain age, known fraud reports, and IP geolocation. See SEON's Privacy Policy.

In addition to the third-party providers above, we run internal cross-checks on the information you submit — for example, comparing your ZIP code against your phone's area code and the geographic location of your submission IP address. We may also use a locally-hosted geolocation database (MaxMind GeoLite2) to map your IP address to an approximate region; in that case, your IP address is not sent to a third party. We also limit how many applications we accept from a single ZIP code in a short period of time.

Verification results are stored on your applicant record for staff review. We do not retain raw third-party responses beyond what is needed to review your application. These checks are not consumer reports under the Fair Credit Reporting Act and do not include a criminal background check.

Data Storage & Security

Your data is stored securely using Supabase, a cloud database provider. We take reasonable technical and organizational measures to protect your information.

No method of internet or email transmission is completely secure or error-free. You participate in the Program and submit information to us at your own risk. While we take reasonable measures to protect your information, we cannot guarantee absolute security.

Health-Related Information

oPPal is a voluntary peer support program, not a medical or therapeutic service. Any health-related information you share (such as pregnancy complications or mental health context) is used solely to facilitate a meaningful peer match. It is not used for medical purposes and is not shared with healthcare providers.

HIPAA Disclaimer

oPPal is not a healthcare provider, health plan, or healthcare clearinghouse, and is not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act ("HIPAA"). Information you share through the Program — including pregnancy and health-related information — is not protected health information under HIPAA. We treat this information as described in this policy, but it does not receive HIPAA's protections.

Minors

The Program is not directed to individuals under the age of 18. oPPal does not knowingly collect personal information from minors under 18. If we learn we have collected information from a minor under 18, we will delete it. If you believe a minor has provided us with information, contact [email protected].

Third-Party Links

The Program may contain links to third-party websites, applications, or social-media platforms — for example, a social profile you optionally provide on your application, or a partner organization linked from our site. oPPal does not control and is not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before sharing information with them.

Cookies & Your Choices

Cookies are small text files stored on your device. We use them for different purposes, grouped into three categories:

• Strictly necessary — required for the site to function. These handle authentication sessions, payment checkout state, and security (admin impersonation, password-change grants). They cannot be turned off.
• Functional — remember your preferences, such as whether you have dismissed a notification so we do not ask again. These are always active.
• Analytics — help us understand how visitors use our site through Google Analytics (_ga and _ga_* cookies) and a first-party attribution cookie (oppal-attribution) that records how you found us. These cookies are only set after you consent via the cookie banner shown at the bottom of the page on your first visit.

You can change your cookie preferences at any time by clearing the oppal-cookie-consent cookie in your browser settings, which will cause the banner to reappear on your next visit. Your preference is stored for up to 400 days.

Your Rights

You have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of your data
• Withdraw from the Program at any time, for any reason
• Opt out of marketing communications at any time

To exercise any of these rights, contact us at [email protected].

SMS Communications

Depending on Program operational state at the time of your match, communication with your matched oPPal will take one of two forms — proxy SMS or direct phone-number exchange. The form is disclosed at the moment of match confirmation and you actively consent before any communication channel is opened.

Proxy SMS

• SMS messages are routed via a proxy phone number managed by Twilio, Inc. This proxy number masks both parties' real phone numbers so neither can see the other's personal number.
• You consent to receive these messages when you confirm your match in the oPPal customer portal.
• Message and data rates may apply.
• You can opt out at any time by replying STOP to any message. For help, reply HELP or contact [email protected].
• Opting out of SMS does not remove you from the Program — contact us to discuss alternatives.
• Mobile opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes under any circumstances.

Changes to This Policy

We may update this policy as the Program evolves. When we do, we will revise the effective date at the top of this page. Continued participation in oPPal after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or how we handle your data, reach out at [email protected].