Privacy Policy

1. Information We Collect

Account & identity

• Your name, email address, and profile photo.
• A unique account identifier, and the identifier from any sign-in provider you choose (Google, Apple, or Facebook).
• A phone number, only if you choose to link a phone sign-in method.

Content you create

• Tasks you post or volunteer for, including any location you choose for a task.
• Groups you create or join, and your participation in them.
• Messages you send, including direct messages between members.
• Photos you upload, and feedback you submit.

Contacts (only when you invite someone)

• If you choose to invite someone from your device contacts, you pick a single person and we use only that contact’s name, phone number, or email to pre-fill an invite message. Your contacts stay on your device — we never upload, store, or transmit them to Lightwork.

Device location (only when you tap “Use my location”)

• On the web and in our iOS and Android apps, you can tap “Use my location” to see organizations and help requests near you. Your device asks your permission first — When-In-Use only, never in the background — and nothing happens unless you allow it.
• Sorting organizations by distance, and showing which help requests are within your area on the map, happens entirely on your device. We don’t send your location to our servers for either, and we never share it with anyone.
• When you open the map, it starts centered on your area. Like any map, the map service loads the images for the part of the map on your screen — Apple Maps in our iOS app, Google Maps on the web and in our Android app. Those requests go straight from your device to the map service; Lightwork doesn’t receive them.
• If you set your town by hand, we suggest it as the place when you ask for help. It’s only shared if you post the request, as part of it.
• For your Help Out feed, we send a rounded-off, approximate version of your location to our database so it can look up what’s nearby — never your exact coordinates. That lookup isn’t stored as part of your account or history, and we don’t share it with anyone.
• We remember your last location on your own device so you don’t have to grant permission every time you open the app.
• You can change your mind any time: turn off location access for Lightwork in your device or browser settings, or use the manual town picker we show instead.

Information organizations provide about volunteers (no account required)

• If you volunteer with an organization that uses Lightwork to track service hours — for example, a church or nonprofit filing a grant report — that organization may add a record about you (your name, and often contact information) even if you don’t have a Lightwork account yourself.
• That information is the organization’s data about you, supplied on its own instruction. Lightwork holds and processes it on the organization’s behalf; the organization is responsible for you having been given any notice it owes you, and for responding if you want to access, correct, or delete it — see “If an organization added you as a volunteer” under Your Rights (Section 5).

Device & technical data

• Push notification tokens (so we can deliver notifications you opt into).
• Device and app information — device identifier, operating system, app version, and IP address.
• Crash reports, diagnostics, and performance data when something goes wrong.

Usage & analytics

• Aggregate, non-identifying interaction events (for example, which screens are opened) used to understand and improve the App. We do not include the content of your messages or another member’s identity in these events.
• On the web, cookies and similar analytics — see “Cookies & analytics” below.

2. How We Use Your Information

• Operating, maintaining, and improving the App.
• Connecting members and facilitating task collaboration and groups.
• Sending push and email notifications you’ve opted into.
• Analyzing aggregate usage to improve performance and reliability.
• Detecting, preventing, and responding to fraud, abuse, or safety issues.
• Answering your support questions and looking into reports — see “Staff access to your account” under Security.
• Complying with our legal obligations.

3. Cookies & Analytics (Web)

On the web we use Vercel Web Analytics & Speed Insights to understand aggregate traffic and page performance, and PostHog for product analytics. Vercel Web Analytics and Speed Insights are first-party, set no advertising cookies, and never build a profile of you or follow you to other sites. PostHog sets no advertising cookies, and browsing while signed out creates no profile. What PostHog collects, including page recordings in the Lightwork web app, is described under Companies That Handle Your Data. We do not use Google Analytics on the web. Our mobile apps do not use these web cookies; on those apps, analytics run through Google / Firebase and PostHog, as that section describes.

Because Lightwork is offered in the United States and is not marketed to people in the EU or UK, analytics on this marketing site run by default rather than behind a consent banner. You can turn them off at any time using Turn off analytics in the footer of any page on this site. Withdrawal takes effect immediately, with no page reload — collection stops and the analytics scripts are unloaded. In the Lightwork web app, Vercel and PostHog run only after you accept analytics cookies. If we later offer Lightwork in a place that requires asking first, we will ask first.

This site sets three first-party cookies.

lw_hero_variant is a single letter naming which version of the home page you were shown, kept for 30 days, and only while we are comparing those versions. It is a group label. If you turn analytics off we delete it.

ph_phc_pydn9nRUpD2ZzxkmqGgUrJAdz4KzxyLKby23hybRVFZq_posthog is the visitor identifier PostHog stores, kept for a year. It is set on getlightwork.com so a visit here and a later visit in the Lightwork web app can be recognized as the same browser. We set it when analytics is on, which is the default. If you turn analytics off we stop sending these events. A copy already stored in your browser stays until it expires or you clear cookies.

lw_analytics_consent stores your choice — accepted or declined — for 180 days, and only after you use the footer control, so we can honor it.

In the mobile apps, the same choice lives on the Preferences screen, under Privacy → Analytics. In the Lightwork web app we do not start analytics until you accept. The visitor-identifier cookie above is shared with that app so the two visits can be tied together.

4. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Consent (for example, marketing, and web analytics wherever local law requires us to ask first).
• Legitimate interests in understanding aggregate site usage, where local law does not require consent — always subject to your right to opt out.
• Contract (to provide the services you request).
• Legal obligation (to comply with applicable law).
• Legitimate interests (to improve the App and keep the community safe).

5. Your Rights

Under the GDPR (EU/EEA users)

• Access your personal data.
• Correct inaccurate information.
• Delete your personal data (the “right to be forgotten”).
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.

Under the CCPA/CPRA (California residents)

• Know what personal data we collect and how it’s used.
• Access and receive a copy of your data.
• Request deletion of your data.
• Opt out of the sale or sharing of personal data — we do not sell or share your data.
• Correct inaccurate personal information.
• Limit the use of sensitive personal information.

You can exercise these rights in the App, or by emailing us at matt@mksolutionsky.com. See our Data Deletion Policy for how to delete your account.

If an organization added you as a volunteer

If an organization added a record about you as a volunteer and you don’t have a Lightwork account, we act as a processor for that organization, not as the party responsible for the record. To access, correct, or delete it, contact the organization directly. If you contact us instead, we’ll forward your request to the organization responsible for it rather than act on it ourselves.

6. How We Share Your Information

We do not sell your personal information. We share data only as described here:

• With other members: limited information (such as your name and profile photo) is visible when you post or volunteer for tasks, or participate in groups.
• With service providers (sub-processors) who help us run the App, and with a few services that handle your data under their own rules rather than ours — both listed below, in their own groups.
• With legal authorities, if required by law or to protect the rights, property, or safety of our members or the public.

Our mobile apps include Meta’s Facebook Login SDK so you can sign in with Facebook. That SDK is capable of collecting a device identifier for advertising; we disable that collection, so no advertising identifier is accessed and no tracking prompt appears.

7. Companies That Handle Your Data

Running Lightwork means some other companies see some of your data. They fall into two groups, and the difference matters enough that we list them separately: the first group handles your data only for us, on our instructions. The second group handles it under their own rules, so we link each one’s policy instead of making a promise on its behalf.

Service providers acting for us (sub-processors)

Each company below acts on our behalf under data protection terms, and is not permitted to use your data for its own purposes:

• Google / Firebase — your Lightwork account and sign-in, our database, file storage, push delivery, and (on mobile) analytics and crash reporting. If you use “Use my location,” a rounded-off, approximate version of it is also sent here to look up nearby help requests.
• Sentry — crash and error diagnostics.
• PostHog — product analytics in our mobile apps and on our website (usage and feature-adoption events; no message content). Browsing the website while signed out creates no profile. The visitor-identifier cookie that recognizes the same browser on a later visit is named under Cookies & analytics. In the Lightwork web app, and only if you accept analytics cookies, PostHog also records how you move through a page — clicks, scrolls, and layout — so we can find and fix what gets in the way. Before a recording leaves your browser, the words on the page and everything you type are replaced with placeholder characters, and photos attached to asks are left out. Other images, such as profile photos, can still appear. No network requests or console messages are recorded, recordings are deleted after 30 days, and our mobile apps do not record at all.
• Mailgun — sending invitation emails.
• Vercel — web hosting and web analytics.

Services that apply their own privacy terms

These companies handle your data under their own rules, not ours. We can’t say they only use it for us, because that isn’t something they agree to — so here is what each one receives, and a link to its own policy:

• Apple — Sign in with Apple, if you choose it; Apple Push Notification service, which delivers notifications to iPhones and iPads; and Apple Maps, which loads the map in our iOS app. These requests go from your device to Apple, and Apple handles them under the Apple Privacy Policy.
• Google Maps, Places & Sign in with Google — the map on the web and in our Android app, the place suggestions when you choose a location for a help request, and Sign in with Google if you choose it. Google handles these under the Google Privacy Policy, and the maps and place lookups are additionally covered by the Google Maps/Google Earth Additional Terms of Service. This is separate from Firebase above, which is Google acting for us.
• Google reCAPTCHA Enterprise — the Lightwork web app is protected by reCAPTCHA, so that we can tell real people apart from automated traffic. While you are signed in on the web, your browser sends Google page-load signals — the page you came from, and basic characteristics of your browser — and gets back a risk score. Your name, email, and account identifier are not part of that, and we never see the signals themselves. It does not run in our mobile apps, which check that the app itself is genuine using Apple’s and Google’s own app-attestation instead. Google may also use these signals to keep reCAPTCHA working and for general security, so it belongs in this group rather than with the providers acting only for us. The Google Privacy Policy and Google Terms of Service apply to it.
• Meta — Facebook Login, only if you choose it. Meta handles it under the Meta Privacy Policy.

8. International Transfers

Lightwork is operated from the United States, and your data may be transferred to and stored in the U.S. Where required, we use appropriate safeguards, such as Standard Contractual Clauses, to protect your data.

9. Data Retention

We retain your personal data only as long as necessary for the purposes described above, or as required by law. You may request deletion of your account and associated data at any time — see our Data Deletion Policy.

Volunteer records an organization adds for you follow a different rule once they’re attached to a filed report: federal grant-reporting requirements (2 CFR § 200.334) require the organization to retain those records for three years from the date its related report is filed. We retain a filed record for that period even if you ask us to delete it. Any part of your record that hasn’t been attached to a filed report is deleted on request like any other data.

10. Security

We implement technical and organizational measures to safeguard your data, including encryption in transit, access controls, and secure storage. No system is completely secure, but we work to protect your information and to respond promptly to any incident.

Staff access to your account

To answer a support question or look into a safety report, an authorized member of our team may open your account and see it the way you see it — including your groups, your tasks, and your messages. That access is read-only: we can look, but we can’t post, send a message, or change anything as you. Every time it happens we record who looked, whose account it was, why, and when.

11. Children’s Privacy

Lightwork is not intended for children under 13. We do not knowingly collect personal information from anyone under 13, and the App applies an age gate at sign-up. Members aged 13–17 should use Lightwork only with the involvement and consent of a parent or legal guardian. If you believe a child under 13 has provided us personal information, contact us and we will delete it. See also our Child Safety Standards.

We don’t collect or store an age for anyone in a volunteer record an organization adds — organizations are responsible for their own volunteers, including any minors. If that record is later claimed as a Lightwork account, the same 13+ sign-up requirement above applies.

12. Your Privacy Controls

• Access, update, or delete your account information in the App.
• Change your notification preferences at any time.
• On this website, turn analytics off (or back on) at any time from the “Turn off analytics” control in the footer.
• In the mobile apps, change the same setting from Preferences → Privacy → Analytics.
• Request a copy of your data (data export).

13. Changes to This Privacy Policy

We may update this policy periodically. If we make material changes, we’ll notify you by email or in-app notification and update the “Last updated” date above.

14. Contact Us

For questions, data requests, or complaints, email us at matt@mksolutionsky.com.

MK Solutions, LLC · Richmond, KY