Public progress. Private details.

Public pages show published business profiles, category progress, non-currency totals, rank and aggregate reviewed supporter actions. They do not show buyer identities, passwords, outcome references or transaction-level details.

Owner accounts store email addresses and salted password hashes. Sessions expire after eight hours. Owner dashboards restrict business data to that owner. League administrators can review operating data and audit records. Exact revenue is hidden publicly by default. This pilot uses a private SQLite database on the operator’s VPS; encrypted disk and backup configuration are operator responsibilities.

Supporter confirmations use a random browser-session identifier, stored as a hash on the server. They remain pending until reviewed and expire after 90 days. No supporter email or nickname is required. Optional email notifications require confirmation and include an unsubscribe link. Team notifications contain operational summaries, not customer records.

Owner outcome reporting stores only category, net value, opaque reference, timestamp and provenance. Do not submit names, addresses, payment details or coaching intake answers. Merchant-hosted embeds have their own privacy terms.

Optional Meta and Google tags are disabled until accepted and are not loaded on private dashboard, admin, email-preferences or report pages. Configure containers without form capture, customer identifiers or sensitive custom events. Preferences can be changed below; declining reloads the page. Previously collected third-party data is governed by that provider.

Owners can export their report. Contact your launch administrator for account deletion and retention requests. Password resets revoke sessions; operator controls are explained in the installation guide. This policy must be reviewed and given an operator contact before public launch.