PrivacyPolicy

The Method Project is a Wyoming-based nonprofit organization providing fiscal sponsorship, capacity building, and collaborative networks for nonprofits nationwide. Our EIN is 42-3630821 and our mailing address is PO Box 12212, Jackson, WY 83002. For any privacy question, contact us at hello@themethodproject.org.

We are the party responsible (the "controller") for the personal information described in this policy.

Information you provide to us

• Contact and identity information, such as your name, email address, telephone number, mailing address, organization, role, and professional information.
• Inquiry, application, and program information, including the contents of messages, applications, forms, surveys, supporting documents, and other information you choose to provide about yourself, your organization, or a proposed project.
• Account information, such as your email address, account preferences, and authentication information handled through our authentication provider.
• Donation and transaction information, such as your name, contact information, donation or payment amount, date, designation, billing address, transaction identifier, payment status, and limited payment-method details. Depending on the option you select, payment details may be collected directly by Stripe, Mercury Technologies, Inc. ("Mercury"), or their applicable payment, banking, digital-wallet, or network partners. We do not receive or store full payment-card numbers through the Services, although we may receive transaction records and limited bank-account or payment-method information made available by the applicable provider.
• Subscription and communication preferences, such as your email address, newsletter selections, and unsubscribe choices. When you submit our sign-up form, we also record the IP address and browser user-agent the submission came from, along with which form it came from, and we keep those with your subscription record. We use them to rate-limit the form and to screen automated abuse of it. Note that this is not the same as the visit beacon described below, which keeps neither.
• Other information you choose to provide, including information submitted during events, meetings, support requests, or other interactions with us.

Information we collect automatically

We do not use a third-party analytics vendor, and we do not permit third-party advertising or tracking cookies on the Services. Our website measurement is first-party and deliberately minimal:

• Server and delivery data processed by our hosting provider to serve the site and keep it secure, such as IP address, browser type, referring pages, and request timestamps. This data is handled by our hosting provider in the ordinary course of delivering the Services.
• Aggregate visit counts and page counts collected by our own first-party beacon. For this measurement we do not store your IP address or your browser user-agent string. We derive a hashed value from them together with the current date, and record that value so we can count how many distinct people visited on a given day. We also record, alongside that value, which of our pages were opened, so we can count how many distinct people opened each page on a given day. We record a page only when we recognize it. That means our own public pages, and our shop product pages by their product address. If a shop address is one we do not recognize, we record the visit as the shop page generally rather than by product, so it is still counted but not identified. Anything we do not recognize at all is discarded, and we never record the query string or anything after it. The hashed value changes every day, so it is not a stable identifier for you, and we do not use it to recognize or track you across days or across other sites. We keep these records for 90 days. The beacon also honors your browser’s Do Not Track and Global Privacy Control signals. If either is turned on, the beacon does not send anything, so your visit is not counted.
• Error and performance diagnostics collected by our monitoring provider when something goes wrong, which may include technical details about the request and the browser.
• Aggregate search statistics that Google Search Console reports to us about how our site appears in Google Search results, such as queries, impressions, and clicks. Google collects this data through Google Search; we receive it only in aggregate form and it does not identify you.
• Nothing, by us, when your browser fetches our typefaces from Google Fonts. We do not receive that request or anything from it. We list it here because it is a request your browser makes to a third party on page load, which means Google receives your IP address and user-agent even though we do not. See our service providers below.

We use the information we collect to:

• Respond to inquiries, support requests, and other communications;
• Review applications, assess eligibility, administer programs, and communicate about participation;
• Create and manage accounts and authenticate users;
• Process donations and other payments, issue acknowledgments and receipts, reconcile transactions, maintain financial and compliance records, and address payment questions;
• Send newsletters or other communications you request and manage communication preferences;
• Understand and improve the Services, programs, communications, and user experience;
• Detect, investigate, and prevent fraud, abuse, security incidents, and technical problems;
• Comply with legal obligations and enforce our Terms of Service and other agreements; and
• Establish, exercise, or defend legal claims.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising. We may disclose personal information in the following circumstances:

• Service providers and contractors. We use providers that support donation and payment processing, banking and transaction administration, email delivery, website hosting and infrastructure, databases, authentication, error monitoring, security, professional services, and similar functions. Our current providers are listed under "Our service providers" below. Depending on the transaction, Mercury's applicable banking, payment, digital-wallet, or network partners may also process information. These providers process information according to their role, our instructions where applicable, and their contractual and legal obligations.
• Program and project administration. We may disclose information to staff, volunteers, contractors, reviewers, project representatives, partner organizations, or other participants when reasonably necessary to evaluate an application, respond to a request, or administer a program or sponsored project. We use confidentiality or other safeguards where appropriate.
• Professional advisers. We may disclose information to attorneys, accountants, auditors, insurers, and other professional advisers when reasonably necessary for their services.
• Legal, compliance, and safety purposes. We may disclose information when we reasonably believe disclosure is required or permitted by law, legal process, or governmental request, or is necessary to enforce an agreement, investigate wrongdoing, protect rights or safety, or prevent harm.
• Business transfers. If we are involved in a merger, reorganization, dissolution, or transfer of assets, your information may be transferred as part of that transaction, subject to this policy.
• With your consent or at your direction. We disclose information when you ask us to or otherwise direct us to do so.

We name our current providers so you can review their practices. This list reflects the providers we use today and may change as the Services evolve.

• Stripe, Inc. Card and digital-wallet donation processing. Stripe collects payment credentials directly.
• Mercury Technologies, Inc. Banking and transaction administration, including ACH and wire options for larger contributions. Mercury and its banking, payment, digital-wallet, and network partners collect payment credentials and bank-account information directly.
• Postmark (Wildbit, LLC / ActiveCampaign). Email delivery for messages we send from our themethodproject.org address, including launch notifications and newsletters.
• Resend, Inc. Email delivery for administrative account messages, such as team invitations, password resets, and multi-factor authentication recovery.
• Vercel Inc. Website hosting, content delivery, and infrastructure.
• Supabase, Inc. Database, file storage, and authentication services.
• Twilio Inc. Delivery of one-time sign-in codes by text message to people who have set up text-message sign-in on their account. Twilio receives the mobile number and the message content in order to deliver it.
• Functional Software, Inc. (Sentry). Application error and performance monitoring.
• Google LLC. Font delivery: our pages load typefaces from Google Fonts, so your browser requests files from Google and Google receives your IP address and browser user-agent as part of that request. This happens on page load, before you interact with the site. Google Search Console for aggregate search statistics. We also use Google Workspace and Google APIs for internal operations, and staff may connect a Google account so that meeting notes and email they designate can be turned into internal task records.
• Anthropic, PBC. AI processing used internally to summarize staff meeting notes and designated internal email into proposed task records. Content submitted for this purpose is not used to train Anthropic models.

We use cookies to operate the Services. Examples include keeping you signed in to protected areas and remembering that you have entered a preview access code. These are strictly necessary and the site cannot function correctly without them.

We use two separate first-party measurements, and only one of them stores anything in your browser. The visit counter, which records that someone visited on a given day, stores one short-lived value in your browser’s session storage so that it counts a browsing session once rather than on every page you open. That value records only that the counter has already run during this session; it does not list the pages you viewed, it stays in your browser, it is not sent to us, and it is discarded when you close the tab. The page counter described above is separate and stores nothing in your browser at all: it reports each page as you open it, and repeated views of the same page on the same day are combined when we store them. Both are measurement rather than strictly necessary operation, so we call them out separately here, and neither runs if your browser signals Do Not Track or Global Privacy Control.

We do not use third-party advertising cookies, advertising pixels, or third-party analytics cookies. You can set your browser to refuse cookies, but some parts of the Services may not work as intended. If we later add non-essential cookies or tracking technologies, we will update this policy, name the providers, describe your choices, and obtain consent where the law requires it before enabling them.

We keep personal information only as long as needed for the purposes described in this policy, including to provide the Services, administer programs, maintain donation and accounting records, resolve disputes and payment matters, and meet legal and regulatory obligations. We then delete or de-identify it. Retention periods vary by the type of data and the reason we hold it. Donation and financial records are generally retained for the periods required by tax and nonprofit recordkeeping rules, which are longer than the periods that apply to ordinary correspondence.

We extend the following choices to everyone who interacts with us, regardless of where you live:

• Access, correction, and deletion. You may ask us to confirm what personal information we hold about you, to correct it, or to delete it, subject to legal, accounting, and recordkeeping limits.
• Email preferences. You can unsubscribe from our newsletters and marketing messages at any time using the link in each message or by contacting us. We may still send you messages about a transaction, an application, or your account.
• Cookie choices. You can manage cookies through your browser settings, as described above.
• Complaints. You may raise a concern with us directly, and depending on where you live you may also have the right to complain to your state attorney general or data-protection authority.

Most comprehensive United States privacy laws, including the California Consumer Privacy Act, apply to businesses operating for profit and do not cover a nonprofit organization such as ours. Some state laws reach nonprofits when statutory thresholds are met, and Colorado and Oregon in particular extend coverage to certain nonprofit activity. We monitor whether those thresholds apply to us and will honor the additional rights and procedures those laws require if and when they do.

The Services are directed to a United States audience. We do not target the Services to the European Union or the United Kingdom.

To exercise any of these choices, email us at hello@themethodproject.org. We may need to verify your identity before acting on a request, and we will respond within the time the applicable law allows.

You receive these messages only if you set them up yourself, on your own account, as a second layer of sign-in security. Providing your mobile number and checking the consent box on the setup screen is what enrolls you, and the setup screen is the only place it can happen. We never enroll you automatically and never add a number on anyone's behalf. Text messages are never required to use the Services: an authenticator app is offered as an alternative at the same step. Whether text messages are available to a particular account is decided at setup and shown to you there.

• What we send. Automated one-time sign-in codes, and nothing else. We do not send marketing or fundraising messages to this number.
• How often. Only when you sign in or set up text message codes. There is no recurring or scheduled message.
• Cost. Standard message and data rates may apply, depending on your mobile plan. We do not charge for these messages.
• How to stop. Reply STOP to any message to cancel at any time. To change or remove the number on your account, contact an administrator: there is no self-service option today. Reply HELP for help. Cancelling texts does not close your account, but you will need another sign-in method to keep access.
• Who we share it with. We disclose your mobile number to Twilio Inc., our messaging provider, solely to deliver these codes. Twilio is listed in the Our service providers section above. We do not sell your mobile number, and we do not share it with third parties for their own marketing purposes.
• What we keep about your consent. When you opt in we record that you did so, with your account, the number you entered, the exact wording you agreed to, and the date and time. We keep this as evidence of consent, which our messaging provider can require us to produce, and we do not use it for any other purpose.

Carrier delivery is outside our control, and we cannot guarantee that a given message arrives. Carriers are not liable for delayed or undelivered messages. Keep backup codes or a second sign-in method so that a delivery failure does not lock you out. Questions about text messages can go to hello@themethodproject.org.

The Services are intended for adults and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us and we will delete it.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit, restricted administrative access, and multi-factor authentication on administrative accounts. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

The Services may link to third-party sites and services we do not control, including the payment pages operated by our payment providers. This policy does not apply to those sites, and we are not responsible for their content or privacy practices. Please review their policies before providing information.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how we handle your information, contact The Method Project at hello@themethodproject.org or PO Box 12212, Jackson, WY 83002.