Privacy Policy

Last updated: February 2026

February 2026 changes
  • Added opt-in feedback collection terms and stated how we use submissions
  • Clarified that logged in app pages do not include advertising tags
  • Added Privacy Choices opt-out page for advertising attribution
  • Added additional ad networks and clarified advertising data sharing
  • Added policy links for ad platforms

This explains how Charity Record collects, uses, and protects your information. Charity Record is owned and operated by Infoportfolio, LLC, a New Hampshire limited liability company, and this policy applies only to the Charity Record donation-tracking service at charityrecord.com (including its apps and APIs); it does not cover any other Infoportfolio, LLC websites or services. Use of the service is also governed by our Terms of Service.

What We Collect

Account Data

Email (required), name (optional), and securely hashed password.

Optional tax profile data you can provide to improve estimates: estimated income (AGI estimate) and filing status.

If you subscribe to a paid plan, billing information is collected and processed by our merchant of record, Polar.sh. We receive non-sensitive billing metadata (subscription status, billing period, discount applied). We do not store credit card numbers.

Donation Records

Organization details and donation data you enter or import, including dates/amounts, item descriptions and values, charitable mileage, and stock & securities details, plus any notes you add.

Uploaded Files

We do not retain your CSV or XLSX files. We parse uploads on submission to create donation records, then discard the files. The parsed donation data is stored in your account. If we later support receipt or photo uploads, those files will be stored in encrypted object storage and will be subject to the same deletion policies described below.

Technical Data

We also collect standard web analytics (for example IP address, browser/version, device type, pages viewed, referral URLs, and timestamps) so we can understand how people access Charity Record and keep the service secure. We also log signup metadata (IP address, country, user agent, referrer, and UTM parameters) for fraud prevention and service analytics. Our analytics and advertising vendors may collect additional data under their own policies; for details see Google Analytics & Ads, Microsoft Privacy Statement, Meta/Facebook Privacy Policy, LinkedIn Privacy Policy, and any other services listed below.

Optional Feedback

If you opt in, we may collect comments, suggestions, quotes, issues, and feedback you submit, including requests for custom items or features. We use this feedback to improve the product.

How We Use Your Data

  • Run the service: Store and organize your donations
  • Generate exports: Create files for tax software or other destinations.
  • Send notifications: Account emails, password resets, two-factor authentication (2FA) setup emails and security changes, responses to your inquiries, and important service announcements (for example, pricing changes or policy updates). These transactional notices go out even if you opt out of marketing so we can inform you about your account.
  • Send product updates and promotional offers: Tax season reminders, upgrade notifications, new features, and special offers. We will only send marketing emails if you opt in during registration or via your account settings. You can unsubscribe at any time via the link in any email. Transactional emails (account notifications, security alerts, billing reminders) cannot be disabled.
  • Improve the product: Anonymized or aggregated usage analytics. Opt-in feedback or custom item submissions may be used to improve the product.
  • Support and safety: Respond to support requests, investigate errors, and monitor for abuse, fraud, or illegal content. We reserve the right to remove data that violates our Terms, such as CSAM or malware, and report it to authorities.

You Own Your Data

We never share information about your individual donations or charities outside our organization except as required by law, to protect our rights or prevent harm, or in a business transfer. If we receive a valid legal request, or if Charity Record is ever sold or merged, we will notify you when possible and only disclose the minimum data necessary, continuing to protect it under this policy. Export everything anytime in CSV format.

  • Free accounts: Account deletion is immediate and permanent; data is removed as soon as you confirm deletion.
  • Paid accounts: A 30-day countdown before deletion is permanent.

Who We Share With

We never sell your data. We only share it with service providers to keep Charity Record running, or with a new owner if Charity Record is bought, and the data stays under this policy:

Email: Amazon SES (transactional and marketing emails from hello@charityrecord.com), FeedBlitz (newsletter, optional), and email providers (Gmail/Migadu) for correspondence. (Privacy policies: Amazon, FeedBlitz, Migadu)

Payments: Polar.sh (merchant of record) processes subscription payments. They may use sub-processors including Stripe for payment processing. (Privacy policy: Polar)

Hosting: DigitalOcean (US servers). (Privacy policy: DigitalOcean)

Security & abuse prevention: Cloudflare. (Privacy policy: Cloudflare)

Fraud prevention: proxycheck.io and country.is (for consent geolocation). (Privacy policies: proxycheck.io, country.is)

Error tracking: Sentry. (Privacy policy: Sentry)

Analytics & Advertising: Google Analytics 4, Google Ads, Microsoft Advertising, Meta/Facebook Ads, and LinkedIn Ads for conversion tracking and ad targeting. We may collect ad click identifiers and share hashed identifiers and events with ad platforms for attribution. We also use internal, aggregated analytics to understand usage patterns and improve the product. (Privacy policies: Google, Microsoft, Meta/Facebook, LinkedIn)

We may disclose your information if required by law, to comply with valid court orders or government requests, to protect our rights, or to prevent harm. If Charity Record is involved in a merger, acquisition, or asset sale, we will provide notice before your personal information is transferred to a different owner whenever legally permitted; some transactions (for example government orders that include non-disclosure requirements) may restrict our ability to notify you.

Security & Retention

We use HTTPS encryption, secure password hashing, backups, and rate limiting. You can also enable two-factor authentication (2FA) on your account using an authenticator app or email verification. No system is 100% secure, but we take reasonable precautions.

In the event of a data breach affecting your personal information, we will notify you via email within 72 hours of discovering the breach and outline the steps we're taking to address it.

Your data stays active as long as your account exists. Delete your account anytime – free account deletion is immediate, paid accounts have a 30-day grace period. We will permanently remove deleted accounts within 30 days, except where we must retain limited records for legal, security, or billing purposes (for example, transaction records for tax compliance). For abuse prevention, we retain a one-way hash of deleted email addresses for up to one year.

Your Rights

Access, export, correct, or delete your data anytime. Unsubscribe from marketing emails with one click. If you are a U.S. resident, your rights may vary by state (for example, California users have CCPA/CPRA rights). Contact us to exercise your rights, and we typically respond within 30 days.

State Privacy Rights (California)

No sale: We do not sell your personal information. We may share limited identifiers, such as cookie or device IDs, with analytics and advertising partners to measure campaigns and improve our marketing. You can opt out of sharing for advertising attribution in our Privacy Choices page, and you can control cookies in your browser and, where available, in our cookie banner on public marketing pages. Authenticated app pages (URLs under /app/) do not include advertising tags.

CCPA/CPRA rights: California residents can request access, correction, or deletion of personal information and can designate an authorized agent. We do not discriminate for exercising privacy rights.

Other Details

Children: Our service is not intended for users under 13. We do not knowingly collect data from children; if we learn we have, we will delete it.

International: We host in the United States. If you are outside the US, your data will be transferred to and processed in the US. By using our service, you consent to this transfer.

Cookies: We use essential cookies for login sessions and CSRF protection, plus analytics and advertising cookies to understand site usage and measure marketing on public pages and registration. We do not run advertising tags on authenticated app pages (URLs under /app/). You can control cookies in your browser, in our cookie banner where available, and in Privacy Choices, but the app may not function without essential cookies. We treat Global Privacy Control as an opt-out for advertising attribution where supported.

Updates: We post the Last updated date at the top. We email you about material changes that affect your account or rights. We may post minor updates, such as adding service providers, without email notification. Your continued use after updates means you accept the changes.

Questions?

Email: legal@charityrecord.com (privacy inquiries)
Infoportfolio, LLC (Attn: Charity Record)
6801 Jefferson St NE Ste 150 PMB 3682
Albuquerque, NM 87109