Privacy Policy

We collect different categories of information depending on how you interact with our website:

A. Account Registration (Volunteers)

When you register as a volunteer on our platform, we collect the following personal information:

• Full Name: First name and last name, used to identify you on the platform.
• Email Address: Used as your unique login identifier and for communications.
• Contact Number: Your phone number for coordination and outreach purposes.
• Residential Address: Collected to coordinate local volunteering activities.
• Gender: Optional; one of: Male, Female, Transgender, or Rather Not Disclose.
• Profile Photo: An optional profile picture displayed on your account.
• National ID (NID) Images: Front and back images of your National Identity Card — collected to verify your identity for trust and security. Stored securely and never shared publicly.
• Facebook Profile URL: Optional; used as an additional contact or social reference.
• Password: Stored as a cryptographic hash (bcrypt). Plain-text passwords are never retained.
• Account Role: Automatically assigned as "Volunteer" upon registration. Admin status is granted internally.

B. Automatically Collected Information

When you visit our website, certain technical data is automatically collected:

• Browser type and version
• Device type and operating system
• IP address (anonymised where possible)
• Pages visited and time spent
• Referring URLs
• HTTP cookies and session tokens

C. Media & Uploaded Files

Administrators may upload images and media for news articles, project pages, and hero banners. These are stored in our database and may be served publicly as website content. User-uploaded media (profile photos, NID images) are stored separately and are not publicly accessible.

D. Team Member Profiles

If you are promoted to an official team member, additional information such as your role/position, biography, photo, and optional contact details may be collected and displayed publicly on the Members page — with your awareness.

We use the collected information for the following purposes:

• To create and manage your volunteer account and authenticate your identity.
• To communicate regarding volunteer activities, project updates, events, and news.
• To send in-app notifications about pinned projects, news, and broadcast messages.
• To verify your identity using the NID documents you provided, ensuring organizational trust and safety.
• To display your profile (name, role, bio, photo) on the Members page if you become an official team member.
• To improve and personalize the website experience based on usage patterns.
• To maintain platform security, detect fraud or abuse, and enforce our policies.
• To comply with applicable laws and legal obligations.

All data is stored in a MongoDB database hosted via MongoDB Atlas (cloud-based, encrypted). We implement the following security measures:

• Passwords are hashed using bcrypt before storage — plain-text passwords are never retained.
• Sensitive NID images are stored as binary data and are never exposed via public API endpoints.
• Authentication uses secure HTTP-only cookies (charity_token) with a 7-day session expiry, preventing XSS access.
• API routes are protected with server-side token verification to prevent unauthorized access.
• Media uploaded by administrators is only served through appropriate content delivery routes.
• Database connections are encrypted using TLS/SSL.

While we strive to use commercially acceptable means to protect your data, no method of transmission over the internet is 100% secure.

HaqMaryFoundation Bangladesh does not sell, trade, or rent your personal information to third parties. We may share data only in these limited circumstances:

• Service Providers: Trusted third-party providers (cloud hosting, email delivery) who operate our website under confidentiality agreements.
• Legal Requirements: If required by law, court order, or government authority.
• Organizational Safety: To investigate or prevent illegal activities, fraud, or threats to personal safety.
• Team Member Profiles: If promoted to an official team member, your name, position, bio, and photo may be displayed publicly on the Members page — with your knowledge.

• You are responsible for maintaining the confidentiality of your login credentials.
• You must provide accurate, current, and complete information during registration.
• NID images are used solely for identity verification by authorized administrators and are never shared publicly.
• Administrators can review and manage volunteer accounts for organizational coordination.
• Your role is initially set to "Volunteer". Elevation to "Admin" is at the sole discretion of organizational leadership.
• You may request deletion of your account at any time by contacting us at the email address below.

Our platform sends in-app notifications to volunteers and members, including:

• Pinned Projects: Alerts about newly featured or highlighted projects.
• Pinned News: Alerts about important news articles or stories.
• Broadcast Messages: General announcements to volunteers, members, or specific groups.

Notifications are delivered within the platform only. We do not currently send unsolicited SMS or marketing emails. Administrative communications (e.g., account verification) may be sent by email.

We retain your personal data for the following periods:

You may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal obligations.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Object: Object to certain types of data processing.
• Right to Data Portability: Request your data in a structured, commonly used format.

To exercise any of these rights, please contact us using the details in the Contact Us section. We will respond within 30 days.

Our website uses the following cookies and local storage items:

• charity_token: An HTTP-only authentication cookie set on login. Contains a signed JWT identifying your session. Expires after 7 days.
• Theme Preference (localStorage): Your light/dark mode choice, stored locally in your browser to persist across visits.
• Language Preference (localStorage): Your selected language (English or Bangla), stored locally to persist across page loads.

We do not use third-party tracking cookies or advertising cookies. Refusing cookies may limit website functionality (e.g., staying logged in).

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

We reserve the right to update this Privacy Policy at any time. Changes will be reflected on this page with an updated “Last Updated” date. Continued use of the website after changes constitutes acceptance of the updated policy.