How we handle your information

Your account

When you create an account we keep your name, your email address and, if you choose one, your password. You can sign in with a one-time code we email you instead of a password. Sign-in is handled by Supabase, and a password is stored only in scrambled (hashed) form, so we can't see it. You can also upload a profile photo if you want one. We use your account to sign you in, to email you meal codes and receipts, and to keep reservations to one meal per person per day. Members of the Pay It Forward team who use the admin tools also set up an authenticator app as a second sign-in step.

Meal reservations

When you reserve a meal we record which restaurant partner you chose, when you reserved, your meal code, and whether and when the meal was picked up. We need this to hold your meal, to keep it to one a day, and to pay the restaurant for the meals it serves. The restaurant sees the last few characters of your meal code and the time, not your name or email, and checks the full code when you show it at the counter. We never ask about your income, housing or why you need a meal. Meals reserved on a restaurant's counter tablet or a community partner's tablet, or by a community partner's staff for someone, are not linked to the person who eats them: we record which tablet or which staff member made the reservation, never who it was for.

Donations

When you give, we keep the amount, the number of meals, the date, whether it is a monthly gift, and the email address for your receipt. Payments are handled by Stripe: your card number goes straight to Stripe, and we never see or store it. We keep Stripe's reference for your payment so we can confirm it, send receipts (and, if you have an account, a yearly giving summary), and answer any questions about it.

Partner applications and partner accounts

Restaurants and community organizations that apply give us details about the organization (name, address, contact person, email, phone, hours, how they serve meals). We use them to review the application, set the partner up, and stay in touch. Restaurant payouts are set up with Stripe, which collects and holds the bank details; we don't store bank account numbers. We also record setup steps, meal pickup orders, and the meals each partner serves, so we can pay restaurants and report on the program.

Signing the partner agreement

When someone signs the partner agreement online for their organization, we keep a record of the signature: the name and title they type, the account they used, the date and time, which version of the agreement they signed, the statements they agreed to, and the internet address (IP address) the signature came from. We keep it as proof of what was agreed, for as long as the partnership lasts and afterwards.

Public restaurant pages

A restaurant partner can choose to have a public page on this site. It shows the restaurant's name, address, phone number, hours and type of food, and never its contact email, payment details or staff. The restaurant can turn it off at any time, and the page and its entry in our sitemap come off the site within a few minutes. Pages are only about restaurants, never about the people who eat there.

Messages you send us

The contact form asks for your name, your email and your message, and depending on the topic your phone, organization, city or how many printed copies you need. We use them to answer you. Messages go to the Pay It Forward team. If you're signed in and type your account's email, we also email that account a short note saying we got your message; otherwise the confirmation appears only on screen, so the form can't be used to send our emails to someone else.

How people find us

Some links, flyers and QR codes include a short tag (like ?ref=counter-sign) so we can tell which ones help people find us. If you arrive with one, your browser remembers it for 30 days. If you then donate or apply as a partner, the tag is saved with it. When you reserve a meal, create an account or send us a message, the tag is only added to a running count for that day; it is never stored next to your name.

Your location, only if you share it

On the find-a-meal map you can choose to share your location to see nearby restaurant partners. Your browser asks first. We use it to sort the list and don't save it to our database.

Keeping the site safe

To slow down abuse of public forms, sign-in codes and tablets, we count requests using a scrambled (hashed) version of your internet address (and, for sign-in codes, your email address), never the address itself, and delete old counts automatically after they are two days old. Like most websites, our hosting providers also keep standard server logs for security. We keep a record of actions our team takes in the admin tools, such as approving a partner or changing a setting.

These services handle information for us, only to provide their part of the site:

• Supabase stores our database and handles sign-in.
• Netlify hosts the website and the code that runs behind it.
• Stripe processes donations and pays restaurant partners.
• Resend sends our emails.
• Mapbox draws the maps on the find-a-meal page.
• Google Analytics counts visits to our main pages, only if you allow it. It never runs on pages for getting a meal or help (restaurant pages included), or on account, admin or signed-in partner pages, and we never send it your name, email or meal codes. Calls and texts to help lines are never counted.

Our fonts are served from pifboard.com itself, so loading a page doesn't send requests to a font service.

People also see some information as part of the program: restaurant partners see meal codes for their restaurant, and the Pay It Forward team at the Foundation for Innovation in Society can see program records so we can run it and help when something goes wrong.