Privacy Policy

This Privacy Policy explains how UpNextForYou.org, a United4Youth project (“UNFY,” “we,” “us,” or “our”), operated in partnership with United4Youth and Just in Time for Foster Youth (“JIT”), a California nonprofit corporation, collects, uses, shares, and protects your personal information when you use the Platform. By using the Platform, you agree to the practices described here.

1. Who We Are

UpNextForYou.org is a mission-driven platform that is a United4Youth project, operated in partnership with Just in Time for Foster Youth (JIT), a 501(c)(3) nonprofit organization based in San Diego, California. The Platform serves current and former foster youth and the organizations and volunteers that support them.

2. Information We Collect

2.1 Information You Provide

• Name, email address, and password
• Profile information (such as age, location, interests, goals, and background)
• Intake and onboarding responses
• Messages and communications sent through the Platform
• Documents or files you upload
• Feedback, support requests, or other communications you send us

2.2 Information Collected Automatically

• IP address and general geographic location
• Browser type and device information
• Pages visited, features used, and session duration
• Authentication events (login and logout timestamps)
• Security verification data via Cloudflare Turnstile
• Anonymized product analytics and interaction events via PostHog
• Anonymized session replay data — recordings of user interface interactions with sensitive inputs masked, via PostHog
• Error and crash data via Sentry

2.3 Information from Partner Referrals

Partner organizations may submit referral information about youth participants on their behalf. Partners are responsible for ensuring appropriate consent for any information they submit. We do not purchase personal data from data brokers.

3. Session Replay Disclosure

We use PostHog’s session replay feature to record anonymized user interactions with the Platform interface for the purpose of improving usability and identifying technical issues. Session replay captures mouse movements, clicks, scrolling, and page navigation. Passwords and other sensitive inputs are masked by default and are not captured. IP addresses are anonymized before storage.

PostHog processes this data on our behalf under a signed Data Processing Agreement and does not use it for its own purposes. Session replay data is retained for 90 days. You may contact us to request deletion of your replay data.

4. How We Use Your Information

• Create and manage your account
• Provide access to Platform features, resources, and connections
• Match youth users with appropriate mentors, coaches, and partner organizations
• Communicate with you about Platform updates, program opportunities, and services
• Operate intake and onboarding workflows
• Improve the Platform and develop new features using anonymized analytics and session replay
• Monitor and fix technical errors
• Ensure security and prevent fraud or abuse
• Comply with legal obligations and protect rights

We do not sell your personal information. We do not use your information for advertising or marketing unrelated to the Platform’s mission.

5. How We Share Your Information

5.1 Partner Organizations

Certain profile information may be shared with JIT program staff and vetted partner nonprofit organizations for the purpose of connecting you with services and support. You will be informed of such sharing and, where applicable, may limit it through your profile settings.

5.2 Mentors and Volunteers

Approved mentors may view limited profile information about matched youth participants, restricted to what is necessary to support the mentoring relationship.

5.3 Service Providers

We share data with trusted service providers who help us operate the Platform:

These providers are contractually bound to protect your data and may not use it for their own purposes.

5.4 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or if necessary to protect the safety of any person or prevent illegal activity.

5.5 Organizational Transfers

In the event of a merger, acquisition, or transfer of assets, your information may be transferred to the successor organization, which will be required to honor this Privacy Policy.

6. Sensitive Information

We recognize that many users of this Platform have been involved in the foster care system. We take special care with this information: sensitive intake data is accessible only to authorized program staff and partner organizations on a need-to-know basis; sensitive profile details are not displayed publicly; and role-based access controls govern who can view protected data.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time. We may retain certain information as required by law or for legitimate operational purposes for a period not to exceed 7 years unless otherwise required.

8. Your Rights (CCPA)

California residents have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to correct inaccurate information, the right to request deletion, the right to opt out of sale (we do not sell personal information), and the right to a portable copy of your data. To exercise any of these rights, contact us at the address below. We will respond within 30 days and will not discriminate against you for exercising your rights.

9. Security

We implement reasonable administrative, technical, and physical safeguards, including: encrypted storage and transmission (TLS/HTTPS), Supabase row-level security (RLS) policies, role-based access controls, Cloudflare Turnstile security verification, email verification required before account activation, and error monitoring via Sentry.

10. Children’s Privacy

The Platform is designed for users 18 years of age and older. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided information to us, please contact us at admin@upnextforyou.org.

11. Changes to This Policy

We will notify registered users of material changes to this policy via email or in-Platform notice at least 14 days before changes take effect. The effective date at the top of this policy will be updated with each revision.

12. Contact

UpNextForYou.org — A United4Youth Project
Email: admin@upnextforyou.org
Website: UpNextForYou.org