Back to NowKind

NowKind Privacy Policy

Last updated July 1, 2026

This policy explains what personal information NowKind collects, why we collect it, who we share it with, and the choices you have. It is written to be read, not skimmed past. If something here is unclear, email us at privacy@nowkind.org and we will explain it plainly.

This policy is provided for your information. It is not legal advice. If you need advice about your own situation, please consult a professional.

Who we are

NowKind is a coordination service operated by GuyFin LLC, a New Jersey limited liability company ("NowKind", "we", "us", "our"). We run the website at https://nowkind.org (the "Services").

For anything about your privacy or your data, contact us:

• Email: privacy@nowkind.org
• Mail: GuyFin LLC, [GUYFIN LLC MAILING ADDRESS, CITY, NJ ZIP]

For the purposes of data-protection law, GuyFin LLC is the controller of the personal information described here.

The short version

NowKind gives one person (the Organizer) a single shareable Page to coordinate real help for someone going through a major life moment: a new baby, a surgery, an illness, a loss. People who want to help (Supporters) can claim a meal or a task, or leave a message, without creating an account.

A few things worth knowing up front:

• A Page is about a real person, and that person may never use NowKind. We call them the Recipient. Because a Page can carry someone's name, their situation, and their home address, we treat consent and takedown seriously. See "If a Page is about you" below.
• Pages are private by design. Each Page lives at an unguessable web address, is set to noindex so search engines do not list it, and never appears in any public directory.
• A drop-off address is never put in an email. It is shown only to the specific Supporter who claimed that slot, and only through their private Claim link.
• We do not sell or share your personal information, and we do not run advertising or cross-site tracking.
• We only send email that confirms something you did or asks you to sign in. We do not send marketing email today.

Some terms we use

• Services means the NowKind website and its coordination features.
• Organizer means the account holder who creates and manages a Page. Organizers sign in by a magic link sent to their email (there is no password). You must be 18 or older to be an Organizer.
• Supporter means a person who claims a meal or task, or leaves a well-wish. Supporters have no account. You must be 13 or older to be a Supporter.
• Recipient means the person a Page is about. A Recipient may never be a user of NowKind. That is exactly why we require the Organizer to have permission, and why we offer a takedown path.
• Page means a NowKind coordination page, reachable only at an unguessable web address.
• Claim means a Supporter signing up for a specific meal slot or task.
• Claim link means the private, unguessable link we email a Supporter after they claim. It is the only way to see the drop-off address and to edit or cancel that Claim.
• Well-wish means a message of support posted to a Page.
• Content means anything users submit: names, the situation category, stories, photos, messages, a drop-off address and instructions, and notes.

What we collect

We keep collection deliberately small. Here is everything, grouped by whose information it is.

From the Organizer

• Email address, used to sign you in by magic link (there is no password). This is handled through our authentication provider, Supabase.
• An optional display name for the coordinator.

We keep the Organizer's sign-in email out of the public Page. It is used to authenticate you and to reach you about your Page, and it is not shown to Supporters or Recipients.

About the Recipient and the situation (entered by the Organizer)

When an Organizer sets up a Page, they may enter information about the person being helped:

• Recipient name, usually a first name.
• A situation category: new baby, surgery, illness, loss, or other. We treat this as sensitive, because it can reveal a health or bereavement context about a real person. See "Sensitive information" below.
• An optional short story about the situation.
• An optional photo.
• An optional start date, along with the time zone captured when the Page is created (which loosely indicates locality).
• An optional drop-off address and drop-off instructions.

The Organizer confirms, when creating a Page, that they have permission from the Recipient or their family to create the Page and share this information.

From a Supporter

• When you claim a meal or task: your name, your email address, and an optional note (for example, "bringing soup around 5:30").
• When you leave a well-wish: your name and your message. A well-wish does not collect your email.

Supporters do not create an account and we do not collect a password from you.

Information collected automatically

When you use the Services, some technical information is collected to keep the site running, secure, and free of abuse:

• IP address, and basic device and browser information, along with the pages you view. This flows through Vercel (our host, which also provides basic analytics), PostHog (product analytics), and Sentry (error diagnostics).
• Bot-detection signals, through Vercel BotID, to tell real people apart from automated abuse.
• Rate-limit counters keyed to an IP address and, for certain actions, an email address, stored in Upstash Redis to prevent abuse of sign-in, Page creation, and claiming.
• Email delivery events (delivered, bounced, complained), recorded through a webhook from our email provider, Resend. Each event is stored with the recipient's email address and the provider's message identifier, so an Organizer can see whether a claim-confirmation email reached the Supporter who signed up.

Cookies and local storage

We keep this minimal:

• Essential: the cookies that keep an Organizer signed in. Supporters have no account and receive no sign-in cookie.
• Analytics: when analytics are enabled, PostHog and Vercel Analytics set their own cookies or local-storage entries to measure usage. Supporters' pageviews are kept anonymous; a person profile is only created once an Organizer signs in, and it is tied to an internal account identifier, not to your email.

We do not use advertising cookies or any cross-site tracking. The exact cookie names in use are being finalized.

What we do not collect

To be clear about the edges:

• No passwords. Organizers sign in by magic link only.
• No payment or card data. NowKind does not process payments today. If we add payments later, a payment processor (Stripe) will handle card details, and NowKind will not see full card numbers.
• No phone numbers and no SMS. That is not built.
• No precise device geolocation.
• No health records or clinical data by intent. We ask Organizers not to post clinical or diagnostic detail. See the honest caveat below.

Sensitive information

By its nature, a NowKind Page can touch on a person's health or a bereavement, and can include a home address. We take a few steps to keep that in proportion:

• We do not ask for, and there is no field for, clinical or diagnostic detail. The situation category is a coarse label (for example, "illness"), not a medical record.
• The drop-off address is never placed in an email and is shown only to the Supporter who claimed the relevant slot, through their Claim link.

Here is the honest part: the story field is free text. We cannot prevent an Organizer from typing something sensitive there. We ask Organizers to keep it to what a helper needs to know, and we give Recipients a fast way to request changes or removal (see below).

How and why we use your information

We use the information above only to run and protect the Services:

• To provide the coordination features you asked for. Creating and displaying a Page, letting Supporters claim slots and post well-wishes, and showing the drop-off address to the right Supporter. (For anyone in the EU or UK, our legal basis is performance of a contract, and where the Recipient is a third party, our and the Organizer's legitimate interest in coordinating help they have authorized.)
• To send the two emails we send. A magic-link sign-in email to an Organizer, and a claim-confirmation email to a Supporter who just signed up. Both confirm an action you took. (Legal basis: performance of a contract.)
• To keep the Services secure and free of abuse. Bot detection, rate limiting, and error monitoring, and to show an Organizer whether a claim-confirmation email bounced. (Legal basis: our legitimate interest in security and reliability.)
• To understand and improve how the Services are used. Basic, first-party analytics, kept anonymous for Supporters. (Legal basis: our legitimate interest, or consent where local law requires it for analytics cookies.)
• To comply with law and to enforce our Terms of Service and Acceptable Use Policy.

We do not use your information to build advertising profiles, and we do not sell it.

The privacy protections built into NowKind

Some of our privacy choices are product features, not just promises:

• Unguessable Page addresses. A Page is reachable only at a hard-to-guess URL, and it is set to noindex so search engines do not list it. Pages do not appear in any public directory.
• Address kept off email. A drop-off address is shown only to the Supporter who claimed that slot, through their private Claim link, and it is never included in any email we send. If a Supporter cancels, that access ends.
• Signed-in before public. A new Page starts unpublished and becomes viewable only when the Organizer, signed in through their magic link, deliberately publishes it.

Two features described in our product plans are not yet built, and we will not claim them until they are: automatic stripping of EXIF and GPS metadata from uploaded photos, and private photo storage served by signed links. Today there is no photo-upload feature in the Services. When we add photo upload, we will strip location metadata on upload and serve photos from a private store, and we will update this policy at the same time.

How we share information, and our sub-processors

We do not sell your personal information and we do not share it for advertising. We share it only with the service providers ("sub-processors") that we rely on to run NowKind, and only for the purposes below. All of these providers process data primarily in the United States.

We may also disclose information if the law requires it, to enforce our terms, to protect the rights or safety of people using NowKind, or as part of a merger, acquisition, or sale of assets (in which case we will require the recipient to honor this policy or notify you of any material change).

When we launch payments, Stripe will be added as a sub-processor for payment processing, and we will update this list before that happens.

We do not sell or share your personal information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are used under the California Consumer Privacy Act and similar state laws. We do not run advertising, and we keep our analytics first-party and free of ad targeting. Because of that, there is no "Do Not Sell or Share My Personal Information" choice to make here, but you are always free to contact us about your data.

International data transfers

NowKind is intended for users in the United States, and your information is processed in the United States. If you access the Services from outside the United States, understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

How long we keep your information

Our retention approach is simple:

• Pages are meant to be temporary. Our policy is that a Page auto-archives after a long quiet period (about 180 days with no activity), and an Organizer can ask us to delete a Page at any time by emailing privacy@nowkind.org.
• Deleting a Page removes the Supporter records tied only to it. When a Page is deleted, its meal slots, tasks, claims, and well-wishes are purged, including the name, email, and any note a Supporter left on a claim.
• Email delivery events (delivered, bounced, complained) are kept for a limited period for deliverability and abuse handling, up to about 12 months.
• Analytics and error logs follow each provider's default retention.

Two honest notes. First, the automatic 180-day auto-archive and the automatic purge of old data are part of our stated policy, and the automated job that enforces them may not yet be running; until it is, we will honor deletion on request (below). Second, one narrow record can outlive a Page: the email-delivery-event record that holds a Supporter's email on a bounce or complaint is kept for the deliverability window above and is not automatically removed when a Page is deleted. You can ask us to delete it.

Cancelling a claim marks it cancelled but does not by itself erase the name, email, and note on that claim. If you want that removed, email privacy@nowkind.org and we will delete it, or the Organizer can ask us to delete the Page.

How we protect your information

We use reasonable measures to protect personal information, including:

• HTTPS encryption for data in transit.
• Encryption at rest, managed by our database provider, Supabase.
• Access controls, including database row-level security that limits an Organizer to their own Pages, and server-only handling of the keys that gate the public surface, so those keys never reach your browser.
• A Claim link (a private token) that gates the drop-off address and a Supporter's ability to edit or cancel their own claim.

No online service can promise perfect security, and we do not. We aim to be careful, to collect little, and to be honest about what we do.

If there is a data breach

If we experience a breach of personal information that the law requires us to report, we will notify affected individuals, and any regulators we are required to notify, without unreasonable delay and consistent with applicable law, including New Jersey's breach-notification requirements.

If a Page is about you

If a Page is about you or someone in your family and you did not authorize it, or you want something changed or removed, you can reach us without any account. Every Page carries a "Is this page about you? Request changes or removal" option, and you can also email privacy@nowkind.org or abuse@nowkind.org. We can remove content and, where needed, act quickly to protect people.

Your privacy rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you.
• Correct information that is wrong.
• Delete your information. Email privacy@nowkind.org to request this. A self-serve delete control is on the way; until it ships, we handle deletion on request.
• Export a copy of your information in a portable form.
• Opt out of any sale or sharing (we do none) and of targeted advertising or profiling (we do none).

To make a request, email privacy@nowkind.org, or use the "Is this page about you?" path on the Page. We will confirm your request and respond within the time the law allows (for California, generally within 45 days, with an extension where permitted). We will not deny you service or treat you worse for exercising these rights. You may use an authorized agent to make a request on your behalf, and we may need to verify their authority and your identity.

For residents of California and other US states

The categories of personal information we collect are described in "What we collect" above: identifiers (such as name and email), internet and device activity (such as IP address and pages viewed), and, in the situation category and any story text, information that can reveal a health or bereavement context. We collect this to provide and secure the Services, as described in "How and why we use your information". We do not sell or share personal information, and we do not use or disclose sensitive information for purposes beyond providing the Services. You have the rights listed above, including the right to non-discrimination for exercising them.

For individuals in the EU, UK, and EEA

NowKind is intended for a US audience, and we do not target or intentionally monitor users in the EU, UK, or EEA. If you are there and this policy applies to you, the legal bases for our processing are set out in "How and why we use your information": performance of a contract, our legitimate interests, and consent where required. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. Where processing relies on consent, you can withdraw it at any time. To exercise any of these, email privacy@nowkind.org.

Children

NowKind is a general-audience service and is not directed to children under 13. You must be 18 or older to create a Page, and 13 or older to claim a slot or leave a well-wish. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, contact privacy@nowkind.org and we will delete it.

Your email choices

We send two kinds of email today, both of them transactional:

• A magic-link sign-in email to an Organizer.
• A claim-confirmation email to a Supporter who just signed up to help.

Because these confirm something you did or let you sign in, they do not carry an unsubscribe footer. We do not send marketing email today. If we ever send commercial email, such as a promotional newsletter, it will include our physical mailing address and a one-click way to unsubscribe, and we will honor unsubscribe requests promptly.

Changes to this policy

If we change this policy, we will update the "Last updated" date at the top, and for material changes we will take reasonable steps to let you know. Using the Services after a change means you accept the updated policy.

Contact us

Questions, requests, or concerns about privacy:

• Email: privacy@nowkind.org
• Mail: GuyFin LLC, [GUYFIN LLC MAILING ADDRESS, CITY, NJ ZIP]

For a report or takedown, you can also reach abuse@nowkind.org, or use the "Is this page about you? Request changes or removal" option on any Page.