Privacy notice

Who we are

Project Heroes First (PHF) is a Texas 501(c)(3) public charity, EIN 93-2002908. We run a website and a member platform for Veterans, Active Duty service members, Law Enforcement, Firefighters, EMS personnel, Dispatchers, community supporters and their families. This notice explains what we collect, why, who can see it, and what you can do about it.

What we collect

Website forms

The Join and Contact forms collect what you type: name, contact details, how you served, what help you're looking for, and any documents you attach (such as a DD214). Uploaded documents are stored outside the public web folder, are downloadable only by signed-in staff through expiring links, and every download is logged.

Member platform accounts

Accounts are created by PHF staff when you're enrolled; there is no self-registration. An account holds: your name, email, member number, category (Veteran, Firefighter, and so on), state, an optional city, optional goals, your password (stored as a one-way hash, never readable by us), and your activity log.

Activity you log

Workouts, wellness activities and service entries you choose to record: the type, date, minutes or hours, and an optional note. We do not collect injuries, diagnoses, medications, therapy attendance, sleep, hydration, heart rate, GPS routes or any other health or location data. If you connect Strava, we read only the activity type, date and duration of each activity; nothing else from your Strava account is requested or stored.

Technical

Two cookies make the platform work: a session cookie that keeps you signed in and a token that protects forms. We keep the IP address and browser type of sign-ins and staff actions in an audit log for security. We use no advertising, analytics or tracking cookies.

How we use it

To run the Paladin Program: enrol you, contact you about the program and events, award Hero Points, confirm event attendance, show partner offers, and report our impact to sponsors and grant providers in aggregate only (counts and totals, never names). We do not sell your information and do not share it with anyone for their own marketing.

Who can see what

• PHF staff see your name, contact details, category, location, service entries they approve, and event records. They see how many wellness entries you've logged, never the entries themselves.
• Other members see your display name, state and physical-readiness points on the leaderboard only if you opt in on your profile; city appears only if you enter one. Wellness and service entries are never shown to other members.
• Partner businesses that scan your member card see your first name, last initial, member number, category, rank and whether your membership is active. Nothing else. The link in the card expires within 24 hours.
• Service providers: Zeffy processes donations and event tickets (card details never touch our systems); Hostinger hosts the website, mail and the platform; Strava, if you connect it. Each handles your data under its own privacy policy.
• We disclose information if the law requires it, or to protect someone's safety.

Your choices

• Edit your name, category, state, city, goals and leaderboard visibility any time on your profile.
• Delete any activity entry you logged.
• Disconnect Strava from your profile; activities already imported stay unless you delete them.
• Ask us to delete your account and everything in it. Staff remove it from the console; backups age out within 14 days.
• Ask us for a copy of what we hold about you.

Email info@projectheroesfirst.org or call 210-816-2606.

How long we keep it

Website form submissions and uploaded documents: for as long as you're an applicant or member, then deleted on request. Platform accounts and activity: until you ask us to delete them or the account has been inactive for two years, whichever comes first. Audit and sign-in logs: 12 months. Backups: 14 days.

How we protect it

Encrypted connections (HTTPS) everywhere. Passwords hashed with Argon2. Staff and administrator accounts require an authenticator app in addition to a password. Access to member records is limited by role and logged. Uploaded documents sit outside the web root with expiring, logged download links. If we ever have a breach that affects you, we will tell you promptly and as the law requires.

Age

The member platform is for adults. We do not knowingly create accounts for anyone under 18; family members under 18 are served through their adult family member.

Changes

If this notice changes in a way that matters, we'll post the new date here and tell members by email. Questions: info@projectheroesfirst.org.