Privacy policy

Summary

• We collect little. For an account we ask for an email address, a password, a display name (a nickname is fine) and your language. We do not ask for your real name, date of birth, phone number, address or documents.
• Your email address is never shown to other members.
• What you post is public. Approved stories (with their photos and video), questions, comments, events and public groups can be read by anyone on the internet, with your display name.
• Some parts are for signed-in members only. The “looking for someone” notices, the list of volunteers and private messages can be seen only by members who are signed in.
• You decide who sees your directory profile. You are in the people directory only if you choose to be listed. For each detail you choose who sees it: only you, signed-in members, or everyone. People who are not signed in see your profile only if you also choose that.
• If you ask for an invitation, we keep the email address, name and note you gave until your request is decided or you withdraw it, and for a short time after.
• Private messages are between two members. Moderators do not review them and cannot read them. There is one exception: if a member reports a message they received, a copy of that one message goes to the moderators.
• Photos have their location data removed. Before a photo is stored, the system removes the hidden information inside the file, including the place where the photo was taken.
• A video is not cleaned by the server. Before an MP4 or MOV video is sent, the site’s page in your browser blanks the part of the file where a phone usually saves the place of recording. The server does not check this and does not change the video. Everything that can be seen and heard in a video is shared.
• Public groups show a number, not names. The site records which groups you have joined. It shows other people only how many members a group has, not who they are.
• No advertising, no analytics, no trackers. We do not sell your personal data and we do not share it with advertisers or data companies.
• Only four cookies, and only when you sign in. They keep you signed in. Nothing else.
• The application does not store or log your IP address.
• Your information is kept in the United States, on Amazon Web Services.
• You are in control. On your account page you can correct your profile, use “Download my data”, and use “Delete my account”. Deletion is usually immediate.
• Being a member here can reveal something sensitive about you. Please read the section on sensitive information below.

1. Who we are

“Our Roots Connect · Bhutanese Refugee Connect” is run by DW BARRON CONSULTING LLC, a limited liability company in Colorado, USA. This company decides how the information described on this page is used. In this policy, “we”, “us” and “the site” mean this website and that company.

The site is independent. It is not part of UNHCR, any government or any resettlement agency.

How to contact us is in the last section of this page.

2. What we collect and why

If you only read the public pages, we do not ask you for anything and we do not set any cookies.

Account details

• What: your email address; your password; your display name; your language (English or Nepali); your confirmation that you are 18 or older, with the time you gave it; your acceptance of the terms, with the time and the version you accepted. The system also records when the account was created, its role (member, moderator or administrator) and its status (not yet confirmed, active or suspended).
• Why: the email address is used to sign you in, to send you a 6-digit code that confirms your account, and to send a code if you forget your password. Unless we have set up our own mail sending, these codes are sent by Amazon Cognito’s standard mail service, in English. The site does not send newsletters or marketing email. The display name is shown next to what you post. The language is used to show the site in your language, and it is also kept in Amazon Cognito as your language preference. The confirmations are our record that you are an adult and that you agreed to the terms.
• Your password: it is passed to Amazon Cognito, the sign-in service we use. Cognito checks it and keeps it in the form in which Cognito stores passwords. The site never sees a stored copy of your password. The site’s own database does not store it, and it is not written to our logs.
• How long: until you delete your account. If you sign up but never confirm your email address, the unconfirmed sign-up record is deleted after 7 days.

Invitations

• What, when you join: if sign-up is by invitation, the invite code you used is kept on your member record. If a member made that invite, their internal ID is kept on your record too, together with a mark that says whether you joined in the first group of members or were invited by a member. That mark decides how many people you can invite yourself: 5 for the first group, 2 for members whom a member invited.
• What, when you invite someone: each invite you make is kept with its code, the time it was made, the time it stops working, and whether somebody has used it. The site does not ask you who the invite is for, and it does not show you who used it.
• Why: to control who can join, to keep to the number of invitations each member has, and so that abuse can be traced back to an invitation.
• Who can see it: you see the invites you made. Moderators see all invites, who made each one, and for each member who invited them.
• How long: the code you used stays on your member record until you delete your account. It is included in “Download my data”. An invite that nobody used is deleted 30 days after it stops working, or at once when you take it back. An invite that somebody used is kept for as long as the member who made it has an account, because it counts towards the number of people that member can invite. A moderator’s invite is deleted 30 days after it is used up or runs out.

The waitlist

• What: if you ask for an invitation, the form takes your email address, a name (a nickname is fine), a short note if you want to add one, your language, and your confirmation that you are 18 or older. You get a withdraw code, which your browser keeps so that you can withdraw the request later; the site keeps only a scrambled form of that code. The form does not ask for documents or proof of anything.
• Why: so that a moderator can decide on your request and an invite can reach you.
• Who can see it: moderators see your name, your note, your language and the dates. Only administrators see your email address. If your request is approved, the invite code is sent to your email address. This one email is sent through Amazon SES when our own mail sending is set up; otherwise an administrator sends you the code.
• How long: a request that is still waiting is deleted 180 days after you made it. After a moderator has approved or declined it, it is deleted 30 days later. You can withdraw it sooner with “Withdraw my request” on the sign-in page, in the browser you used to make it; it is then deleted at once, together with an invite that was made for it and not yet used. A request is not linked to an account, so deleting an account does not delete it.

Things you post

• What: stories and questions (title, text, topic and language, and, if you add them, the country and the region it is about, and for a story the public group you posted it in); up to 4 photos and one video on a story (see “Photos on stories” and “Videos on stories” below); comments and answers (the text and, if you add them, the country your answer is about, what it is based on, and a link to an official source); events, camp visits and group calls (type, title, description, date, time, time zone, place or “online”, a link, the language, who may see the link, accessibility notes, and for a group call its format, if the host states one). Each item records who posted it, when it was posted and edited, and its review status.
• Topics: the topic of a post is a choice from the list or words that you type yourself, up to 40 characters. A typed topic is part of the post and is public with it. The site shows everyone a list of the topics that recent approved posts use, with the number of those posts under each topic.
• A link to your own post on another service: a story can carry a link to your own post on Facebook, Instagram or TikTok. The site keeps the link and the time you confirmed that the post is yours. It shows the link with your story. It does not fetch, copy or show anything from the other service, and it holds no sign-in or password for it. What happens when someone follows the link is up to that service and its own privacy rules.
• Why: to show them on the site. This is the purpose of the community pages.
• How long: until you delete the item or your account. A post or event that a moderator rejected or removed is deleted after 90 days, unless it is restored. The comments, likes and RSVPs under it are deleted together with it, even if other members wrote them. A comment that was itself rejected or removed is deleted after 90 days.

Likes and RSVPs

• What: which posts you liked and which events you said you would attend.
• Why: to show the total number of likes and RSVPs, and to show you your own. The site shows other people only the total number, not who.
• Events where the host lets people in: the host of an event or group call can choose that only people they let in see its link. For such an event, your RSVP is a request to join: the host sees the display names of the members who RSVPed, and the site records which of them the host let in. The page tells you this before you RSVP.
• How long: until you remove the like or RSVP, or delete your account, or until the post or event is deleted. This includes a post or event that was rejected or removed and not restored within 90 days.

Photos on stories

• What: up to 4 photos on a story. For each photo the system keeps the picture, its width and height, and a short description for people who cannot see the picture, if you write one. Besides stories, the only other place for a photo is your directory profile (one photo; see “Your directory profile” below). Photos cannot be added to questions, comments, events, notices, groups or private messages.
• How a photo is handled: your browser makes the photo smaller before it is sent. Before the server stores the photo, it removes the hidden information that cameras and phones put inside the file. This includes the place where the photo was taken (the GPS position) and any small preview picture inside the file. What can be seen in the picture itself is not changed. Please think about who and what the photo shows.
• Why: to show the photos with your story.
• Who can see it: the same people who can see the story. When the story is approved, that is anyone on the internet. Each photo has its own web address. The address is long and random, so it is hard to guess. But it is not protected by a sign-in: anyone who has the address can open the photo while the story is on the site. While a story waits for review, the address is given only to you and the moderators. When a moderator rejects or removes a story, its photos are no longer shown at that address.
• How long: until you delete the story or your account. The photos are deleted with it. Copies held by the delivery network (Amazon CloudFront) can remain for up to one hour after that. A photo that you uploaded but did not put on a story is deleted automatically within 2 days. The photos of a story that was rejected or removed are deleted with the story after 90 days, unless it is restored. Photos cannot be changed by editing a story.

Videos on stories

• What: one video on a story, with or without photos. The file must be an MP4, MOV or WebM video of at most 50 MB. The system keeps the video, its type, its size, and a short description for people who cannot see or hear it, if you write one. A video cannot be added to a question, comment, event, notice, group, directory profile or private message.
• How a video is sent: a video does not pass through the site’s application. The server issues an address for that one upload, and your browser sends the file straight to the site’s private storage area on Amazon S3 at that address. The address works for 15 minutes. It is an Amazon S3 address, not this website’s own address, and the site’s cookies are not sent with the file. The story is then created with the video.
• What is removed, and what is not: a video is not handled like a photo. The server does not make a new copy of the video and does not remove anything from it. It checks only the size of the file and that the file starts like an MP4, MOV or WebM file. Before the upload, the site’s page in your own browser blanks the parts of an MP4 or MOV file where a phone usually saves the place of recording and details of the device. The pictures and the sound are not changed. A WebM file, and a file that your browser cannot read, is sent unchanged. The server does not check that this was done, and we do not guarantee that no hidden information is left in a video file.
• What the video shows: everything that can be seen and heard in the video is shared. Please watch it before you post it, and think about who and what it shows.
• Why: to show the video with your story.
• Who can see it: the same people who can see the story. When the story is approved, that is anyone on the internet. The video has its own web address. The address is long and random, so it is hard to guess. But it is not protected by a sign-in: anyone who has the address can open the video while the story is on the site. While a story waits for review, the address is given only to you and the moderators. When a moderator rejects or removes a story, its video is no longer shown at that address.
• How long: until you delete the story or your account. The video is deleted with it. Copies held by the delivery network (Amazon CloudFront) can remain for up to one hour after that. A video that you uploaded but did not put on a story is deleted automatically within 2 days. The video of a story that was rejected or removed is deleted with the story after 90 days, unless it is restored. A video cannot be changed by editing a story.

Public groups

• What, when you start a group: its name and its description. The group records who started it, when, its review status and the number of its members. You are its first member.
• What, when you join a group: the system records the group, your account and the time you joined.
• What, when you post in a group: a story that you post into a group you have joined records which group it is in. It is an ordinary story and also appears in the main list of stories.
• Why: to show the group and the stories posted in it, to show the number of its members, and to know who may post in it.
• Who can see it: anyone on the internet can read an approved group: its name, its description, the display name of the member who started it, the date it was started and the number of its members. A new group may wait for review first, in the same way as posts. The site shows you which groups you have joined. It does not show the list of a group’s members to anyone: not to visitors, not to other members and not on the moderation pages. A story posted in a group shows the name of the group next to your display name, so readers can see that you posted there.
• How long: a group stays until the member who started it or a moderator deletes it, or until that member’s account is deleted. The record of who joined is deleted with the group. The stories posted in it are not deleted: they stay on the site as ordinary stories. Your own membership is kept until you leave the group, the group is deleted, or you delete your account. A group that was rejected or removed is deleted after 90 days, together with the record of who joined it, unless it is restored. A group cannot be edited.

Your directory profile

• What: a profile for the people directory, if you choose to make one. It shows your display name. You can add a one-line introduction, a camp and a country (each chosen from a list), a town or region, a short text about yourself, your interests, an avatar colour, and one photo. All of these are optional, and a photo of your face is never required. The profile also holds your choices: whether you are listed in the directory, whether people who are not signed in may see it, who sees each detail, and whether members who find you there may send you private messages. The system records when the profile was last changed. The profile has no fields for an email address, a phone number or a home address.
• The profile photo: it is handled like a photo on a story: your browser makes it smaller, and the server removes the hidden information inside the file, including the place where it was taken, before storing it. It has its own long, random web address. The site only shows the photo. It is not used to recognise faces or to check who you are.
• Why: so that people can find people they know, for example people from the same camp.
• Who can see it: nobody, until you tick the box to be listed. For each detail you choose “Only me”, “Members” or “Everyone”, and a new profile starts with every detail on “Only me”. Signed-in members see a listed profile with your display name, your avatar and the details you set to “Members” or “Everyone”. People who are not signed in see it only if you also tick the box that shows it to them, and then only your display name, your avatar and the details you set to “Everyone”. A profile saved before these choices existed keeps what it had: its details are shown to signed-in members only.
• Your internal ID: for signed-in members a listed profile also carries your account’s internal ID, so that the site knows who a message is for. People who are not signed in are never given it and cannot write to you. Profiles are not reviewed before they show. Members can report a profile, and a moderator can delete it.
• How long: until you delete the profile or your account. You can change it, change who sees what, take yourself off the list, or delete it at any time on the Find people page → The photo is deleted when you remove or replace it and when the profile is deleted; copies held by the delivery network can remain for up to one hour. If your account is suspended, your profile is taken off the list.

Volunteering to answer questions

• What: if you offer to answer community questions, the site keeps the topics, the countries and the languages you chose, how often you are available, and a short note if you write one.
• Why: so that members can see who is willing to answer which kind of question, and so that the site can show you the questions that fit your offer.
• Who can see it: signed-in members see your display name and your offer. The list does not carry your internal ID, and offering to answer does not let anyone send you private messages.
• How long: until you withdraw the offer or delete your account. If your account is suspended, the offer is deleted.

Blocks

• What: which members you have blocked, and when.
• Why: a block stops private messages between you and that member, in both directions. It also hides you and that member from each other in the directory and in the notices list. The other member is not told that you blocked them.
• Who can see it: the site shows your list of blocks only to you.
• How long: until you remove the block or delete your account.

Private messages

• What: the text of each message, who sent it, who it was sent to, and when. Messages are plain text. For each conversation the system also keeps the time of the latest message and whether you have unread messages.
• Why: so that two members can talk to each other without publishing what they say.
• Who can see it: you and the other member. Messages are not reviewed, and moderators cannot read them. There is one exception: when a member reports a message they received, a copy of that one message goes to the moderators with the report. The copy is kept with the report, also if the sender deletes the message afterwards. It is deleted with the report, 365 days after the report was resolved.
• Who can write to you: a member can write to you only if you are listed in the directory and accept messages, or you have a notice that is listed now, or you have written to that member before. Until you answer, they can send you at most 3 messages. You can block any member.
• How long: a message stays until the member who sent it deletes it, or until that member’s account is deleted. When you delete a message you sent, it is removed for both of you. When you delete a whole conversation, only your own side is cleared: the other member keeps their view of it.
• Please note: messages are kept in the site’s database, like the other information on this page. They are not hidden from the system itself. The few administrators who can reach the systems on AWS to run and repair the site (see section 5) could reach them there. Do not send anything in a message that would put you or another person at risk.

“Looking for someone” notices

• What: a notice written by a member who is looking for an adult they have lost touch with. It holds the name or nickname of the person they are looking for, how the writer knows them, and a short message. The writer can add a camp, a school and a period of time (for example “1995 to 2003”). The writer must confirm that the person is an adult. A notice cannot have a photo, and it has no fields for a phone number, an address or documents. Each notice records who wrote it, when it was written, when it ends, and its review status.
• Why: to help people who were separated to find each other again.
• Who can see it: only signed-in members. A new notice may wait for review first, in the same way as posts. The notice shows the writer’s display name and carries the writer’s internal ID, so that members can answer by private message. While a notice is listed, any member can write to its writer.
• How long: a notice is listed for 30 days from the day it was written. Then it is deleted. The writer can delete it sooner, and a moderator can remove it. A notice that was rejected or removed is also deleted at the latest 30 days after it was written. If the writer’s account is suspended, their notices are removed.
• If a notice is about you: a notice contains information about another person, and that person has not been asked. If a notice is about you, or about someone you know, you can ask for it to be removed. If you are a member, use the Report button on the notice and choose the reason “privacy”. If you are not a member, contact us (see the last section of this page). Until a contact address is published, use the suggestions form → Write the name that the notice uses and say that you want it removed. Do not write other private details in the form. Moderators can remove any notice.

The suggestions form

• What: the topic you choose, the page you mention (optional), your message, and whether you ticked the consent box. The form is anonymous. It does not ask for your name or email address, and a suggestion is never linked to an account, even if you are signed in.
• The correction form on the history pages: the pages Camp life, Our history, UNHCR and Resettlement have a small form, “Is something on this page not accurate?”. It sends a message through the same system, and the message is kept and handled like any other suggestion. The message holds a fixed topic (“Something on a page is wrong or out of date”), the address of the page it was sent from, and what you wrote, including where it can be checked, if you add that. This form has no consent box: a correction is recorded as a message that the site team may use to improve the site. It is anonymous in the same way: no name, no email address, and no link to an account. Nothing about it is kept in your browser.
• Why: to improve the site, correct errors, and receive requests when no contact address exists yet.
• How long: 365 days from the day it was sent, then deleted. A moderator may delete a suggestion sooner.
• Please note: because suggestions are anonymous, we cannot find “your” suggestions later to show them to you or delete them for you. Do not write private details in the form.

Reports

• What: which post, comment, event, public group, notice, directory profile or private message you reported; the reason you chose (scam, threat, privacy, copyright, spam or other); your explanation, if you wrote one. If you are signed in, the report is linked to your account and no contact address is taken. If you are not signed in, you may add a contact email address. This is optional. Notices, profiles and messages can be reported only by signed-in members.
• Reported messages: when you report a private message that you received, a copy of that one message is kept with the report, so that moderators can read it.
• Why: so that moderators can look at the problem and, if you gave an email address, contact you about it.
• How long: an open report is kept until a moderator has dealt with it. A resolved report is deleted 365 days after it was resolved. The copy of a reported message is deleted with the report.

Moderation records

• What: every moderation action writes an audit entry: the internal member ID of the moderator who acted (not their display name), what they did (for example approve, reject, remove, restore, suspend), the internal ID of the item it was about, when, and a short note if the moderator wrote one. For a suspension, the end of a suspension, a change of role, or the removal of a directory profile, the entry records the internal member ID of the member it was about.
• Why: so that decisions can be checked and mistakes corrected.
• How long: 730 days (2 years), then deleted. Audit entries are kept for this time even if the account is deleted.

Technical information

• Your IP address: every device on the internet has an IP address, and the network that delivers our pages must see it to send you the page. When your browser sends a video, Amazon S3 sees the address in the same way. Our application does not store it and does not log it. To stop abuse, such as thousands of sign-up attempts, the application turns the address into a scrambled code (a “hash”) using a secret random value that changes every day. It counts requests against that code. For the newer kind of address (IPv6), only the network part of the address (the “/64”) is used. The codes, the counters and the daily secret values are deleted within 2 days.
• Your email address, for limits only: a scrambled code of the same kind is made from the email address to limit how often confirmation and reset codes can be tried. It is also deleted within 2 days.
• Counters for members: the site also counts how many posts, comments, events, reports, likes, RSVPs, times of joining or leaving a group, new groups, notices, private messages, new conversations, blocks, photo uploads, video uploads, profile changes, invites, changes to a volunteer offer and guests let in an account makes per day, to apply daily limits. The account is counted under a scrambled code of the same kind. These counters are deleted within 2 days.
• Display name reserved at sign-up: if someone tries to sign up with an email address that already has an account, the display name they chose is reserved for 7 days under a scrambled code of that address. This is so that the sign-up form cannot be used to find out whether an address has an account.
• Request logs: for each request to the application, one log line records the type of request, the part of the site it went to, the result code, how long it took, and an error code if there was one. The logs never contain IP addresses, email addresses, display names, cookies, sign-in tokens, or the content of what you sent. Logs are kept in Amazon CloudWatch Logs for 30 days. Access logs on Amazon API Gateway are switched off.

What we do not collect

• No date of birth, phone number or home address. We do not ask for your real name.
• No location, except what you choose to add: a camp, a country, and a town or region on a directory profile, and a country or region on a post or an answer. The location data inside photos is removed. A video is handled differently: see “Videos on stories” above.
• No documents. The only uploads are photos and one video on a story, and one photo on a directory profile.
• No sign-in to Facebook, Instagram, TikTok or any other service. A link you add to a story is only a link.
• No calls. A group call takes place on the calling service its host chose; this site only lists it and does not carry, record or listen to it.
• No payment details. There is nothing to pay for.
• No analytics, no advertising identifiers, and no information bought or received from other companies.

3. Cookies and browser storage

A cookie is a small piece of information that a website saves in your browser. This site uses only four cookies. They are set only when you sign in, and they are needed to keep you signed in. Without them, an account cannot work. Each cookie lasts 30 days.

• __Host-rr_at — your sign-in token. It shows the site that you are signed in. The token inside this cookie stops working after 60 minutes. It is then renewed automatically while you stay signed in.
• __Secure-rr_rt — your renewal token. It is used to get a new sign-in token without asking for your password again. It is sent only to the sign-in part of the site.
• __Secure-rr_uid — your account’s internal ID. It is needed together with the renewal token. It is sent only to the sign-in part of the site.
• __Host-rr_in — a marker. It holds only the value 1 and no secret. It tells the pages that you are probably signed in, so that they know to load your account.

The first three cookies are “HttpOnly”. This means that scripts running in the page cannot read them. The marker cookie can be read by the site’s own scripts, because that is its purpose. All four cookies are sent only over an encrypted connection, and only with requests that come from this website’s own pages. When you sign out, the renewal token is cancelled and all four cookies are removed.

No other cookies. There are no advertising cookies, no analytics cookies and no trackers. The site does not load scripts, fonts or images from other companies’ servers.

Browser storage. A few small things are kept in your browser’s storage. Nothing about you as a member is stored there.

• Local storage holds your language choice (English or Nepali), so that the site opens in the same language next time. If you asked for an invitation through the waitlist, it also holds the email address you gave and your withdraw code, so that you can withdraw the request from the same browser. The Legal & safety page → has a button that removes both.
• Session storage holds a copy of the site’s public settings (for example the sign-up mode, the moderation mode and the terms version), used for up to 5 minutes and removed when the tab is closed, so that the pages do not have to ask for them again each time.

You can also remove all of it by clearing the site data in your browser settings.

4. Where your information is kept

The site runs on Amazon Web Services (AWS), in the United States, in the AWS region called “us-east-1” (Northern Virginia). AWS is our hosting provider. It stores and processes the information for us. We use these AWS services:

• Amazon Cognito — sign-in. It holds your email address, your password (in the form in which Cognito stores passwords; the site never sees a stored copy) and your language preference. Unless we have set up our own mail sending, Cognito’s standard mail service sends the confirmation and password reset codes, in English.
• Amazon DynamoDB — the database. It holds member profiles, posts, comments, likes, events, RSVPs, public groups and the record of who joined them, directory profiles, volunteer offers, blocks, private messages, notices, the records of uploaded photos and videos, suggestions, reports, invite codes, waitlist requests and moderation records.
• AWS Lambda — runs the application code.
• Amazon API Gateway — passes requests from your browser to the application. Its access logs are switched off.
• Amazon CloudWatch Logs — holds the application’s request logs for 30 days. These logs contain no IP addresses, email addresses, names or content.
• Amazon CloudFront — delivers the pages, the photos and the videos to your browser over an encrypted connection.
• Amazon S3 — stores the public pages of the website. A separate storage area on S3 holds the photos and videos on stories and the profile photos. It is private and encrypted. Photos and videos reach your browser only through CloudFront, at this website’s own address. When you upload a video, your browser sends the file straight to this storage area, at an address that the server issues for that one upload. S3 holds no other member information.
• Amazon SES — sends the site’s own email, from contact@ourrootsconnect.com. It is used to send email alerts to moderators. These alerts contain only numbers, such as “3 posts are waiting”. They contain no member content. It is also used to send the invite code to a person whose waitlist request was approved. If we set up our own mail sending, the confirmation and password reset codes are also sent through this service. If an email to you cannot be delivered, or you mark one as spam, Amazon SES tells the person who runs the site which address it was, and no more email is sent to that address. Amazon SES also receives email that is sent to contact@ourrootsconnect.com and passes it on to the person who runs the site.

If you live outside the United States, this means your information is sent to and kept in the United States. Privacy laws there may be different from the laws where you live.

5. Who can see it

• Anyone on the internet can read approved stories (with their photos and video), questions, comments and events, with the display name of the person who posted them and the number of likes or RSVPs. No account is needed to read. Other websites, including search engines, may copy public pages, photos and videos. Anyone who has the web address of a photo or a video can open it while its story is on the site.
• Anyone on the internet can also read approved public groups: the name, the description, the display name of the member who started the group, the number of its members, and the stories posted in it. The site does not show anyone the list of a group’s members.
• Anyone on the internet can also see the directory profiles of members who chose to show them to everyone: the display name, the avatar, and the details that member set to “Everyone”. The link of an event or group call is shown to everyone unless its host limited it to members or to people they let in.
• Signed-in members can also see the rest of the people directory, the “looking for someone” notices and the list of volunteers. The directory shows only the profiles of members who chose to be listed, with the details they set to “Members” or “Everyone”. The notices list shows only notices that are approved and have not ended. Members who have blocked each other do not see each other there. Your email address is never shown to other members.
• The host of an event or group call that is by invitation sees the display names of the members who RSVPed.
• Only you and the other member can see a private conversation. Only you can see your list of blocks.
• Only you and the moderators can see your items that are waiting for review, or that were rejected or removed.
• Moderators see display names, not email addresses. They can see all posts, comments, events, notices and groups, the listed directory profiles, reports, suggestions, the moderation record, the invites and who made them, the waitlist requests (name, note, language and dates, without the email address), and the list of members with display name, role, status, joining date and who invited them. They cannot read private messages. The only exception is the copy of a message that a member reported. They are not shown which member sent a report. If a person who was not signed in added a contact email address to a report, moderators can see that address.
• Administrators can see everything moderators see, and also members’ email addresses and the email addresses on waitlist requests. A limited number of administrators can also reach the systems on AWS in order to run and repair the site.
• Amazon Web Services stores and processes the information as our hosting provider.

We do not sell your personal data. We do not share it with advertisers, data companies or other organisations. There is no advertising on this site.

6. How long we keep it

• Your account and profile: until you delete your account.
• Your posts, comments, events, likes and RSVPs: until you delete them or your account.
• Photos and the video on your stories: until you delete the story or your account. Copies held by the delivery network can remain for up to one hour after that. A photo or a video that you uploaded but did not put on a story is deleted within 2 days.
• Public groups you started: until you or a moderator deletes the group, or until your account is deleted. The stories posted in it stay.
• The record that you joined a group: until you leave the group, the group is deleted, or you delete your account.
• Your directory profile, its photo, your volunteer offer and your blocks: until you delete them or your account.
• Invites you made: an unused one is deleted 30 days after it stops working, or at once when you take it back. A used one is kept until you delete your account.
• Waitlist requests: 180 days while waiting, 30 days after a moderator decided, or until you withdraw the request.
• Private messages: until the member who sent them deletes them, or until that member’s account is deleted.
• “Looking for someone” notices: 30 days from the day they were written, or until the writer deletes them.
• Sign-ups that were never confirmed: 7 days.
• Content that was rejected or removed by a moderator: 90 days, unless it is restored. A notice is deleted at the latest 30 days after it was written. When a post or event is deleted in this way, the comments, likes and RSVPs under it are deleted together with it, even if other members wrote them. The photos and the video of a rejected or removed story are not shown, and they are deleted with the story. A rejected or removed group is deleted together with the record of who joined it.
• Suggestions: 365 days from the day they were sent.
• Resolved reports: 365 days from the day they were resolved. This includes the copy of a reported private message.
• Moderation audit entries: 730 days (2 years). They record internal member IDs: the moderator’s and, for a suspension, the end of a suspension, a change of role or the removal of a directory profile, the affected member’s. They are kept for the full 2 years even if the account is deleted.
• Moderators’ invite codes: 30 days after they are used up or run out. The code you used stays on your member record until you delete your account.
• Abuse-control counters and the daily secret values: 2 days.
• Request logs: 30 days.
• Email you send to contact@ourrootsconnect.com: a copy is kept for 30 days and then deleted. The person who runs the site also gets it in their own inbox.
• Cookies in your browser: 30 days for each of the four. The sign-in token inside its cookie stops working after 60 minutes and is renewed automatically.
• Public settings in your browser’s session storage: used for up to 5 minutes and removed when the tab is closed.

After these periods the system deletes the information automatically.

Backups. The database keeps a recovery copy, so that we can repair it after a fault. Information that has been deleted can remain in that recovery copy for a limited time before it is gone from there too. We do not use the recovery copy for anything except repair.

7. Your choices and rights

The main tools are built into your account page → You do not need to ask us or wait for us.

• See and correct your profile. Your account page shows your email address, display name and language. You can change your display name, your language and your password there. After a password change, all your other sessions are signed out.
• Change, unlist or delete your directory profile. You do this on the Find people page → You can change there who sees each detail, remove your photo, and choose not to receive private messages from members who find you in the directory.
• Take back an invite, or withdraw your offer to answer questions. You can take back an invite nobody has used on your account page, and change or withdraw a volunteer offer on the community page.
• “Download my data”. This gives you a file with your profile (including the times of your 18+ confirmation and your acceptance of the terms, and your invite code if you used one), your posts, comments, likes, events and RSVPs, the reports you sent while signed in, your directory profile, your volunteer offer, the invites you made, your blocks, your notices, the public groups you started, the groups you have joined (with the time you joined each one), and the private messages you sent. For photos and videos, the file has the web address of each photo and video on your stories, not the picture or the video itself. Messages that other members sent to you are not in the file. Your blocks and the messages you sent name the other member by their internal ID.
• Delete single items. You can delete any post, comment, event or notice of yours and any group you started, leave a group you joined, and remove a like, an RSVP or a block. You can delete a private message you sent: it is then removed for both of you. You can also delete a conversation from your own list: the other member keeps their view of it.
• Block a member. A block stops private messages between you and that member in both directions, and hides you from each other in the directory and the notices list. The other member is not told.
• “Delete my account”. This asks for your password and then deletes your account and everything you posted. This is usually immediate. For an account with a very large amount of content, it finishes over a few repeated steps while the page shows “Still deleting…”.

Suspended members can still sign in, read the site, change their password, download their data, delete their own posts, comments, events, notices and groups, leave a group, read and delete their private messages, block a member, delete their directory profile, take back an invite, and delete their account. They cannot change their profile, send private messages, post notices, start or join groups, make invites, or see the notices list and the members’ view of the directory. When an account is suspended, its volunteer offer is deleted and the invites it made that nobody has used stop working.

What “Delete my account” removes

• Your sign-in record in Amazon Cognito, including your email address and password.
• Your member profile. Your display name becomes free for someone else to use.
• Your posts, together with their photos and video and all comments and likes on them, including comments that other people wrote on your posts.
• Photos and videos that you uploaded but had not yet put on a story.
• The public groups you started, together with the record of who joined them, and your own membership of other groups.
• Your comments and likes on other people’s posts.
• Your events, together with their RSVPs, and your RSVPs to other people’s events.
• Your directory profile with its photo, your volunteer offer, and your “looking for someone” notices.
• The invites you made. The ones nobody has used stop working. People who joined with one of your invites keep their accounts; their records keep your internal ID as the member who invited them, but it then belongs to no account.
• Every private message you sent, and your list of conversations.
• Your blocks, and the blocks that other members made against you.

What it does not remove

• Reports you sent are kept so that moderators can still deal with them, but the link to you is removed.
• Private messages that other members sent to you. The messages you sent are deleted. The other member keeps what they wrote themself, in their own view of the conversation.
• A copy of a message of yours that another member reported. It stays with the report until the report is deleted, 365 days after it was resolved.
• Copies of your photos and videos held by the delivery network. They can remain for up to one hour.
• Stories that other members posted in a group you started. The group is deleted. Those stories stay on the site as ordinary stories.
• Moderation audit entries are kept for 2 years and are not removed when you delete your account. They keep only internal member IDs, not names or email addresses. If you were suspended, or your suspension was ended, or your role was changed, or a moderator removed your directory profile, that entry keeps your member ID. If you acted as a moderator, the entries about your actions keep your member ID. An entry about one of your items records the moderator’s action, the item’s internal ID and the moderator’s note, if there is one. It is not a copy of the item.
• Suggestions you sent through the anonymous form. They were never linked to you.
• A waitlist request you made before you had an account. It is not linked to your account and is deleted on its own schedule (see “The waitlist”).
• Your posts on other services. Deleting your account here removes the link, not the post on Facebook, Instagram or TikTok.
• Recovery copies of the database, for the short time described above.
• Copies made by other people or other websites while your posts were public. We cannot remove those.

In the same way, if another member deletes a post or an event, your comments, likes and RSVPs under it are deleted with it. The same happens when a moderator rejects or removes a post or event and it is not restored within 90 days.

Other requests

• Changing your email address: the account page cannot do this at this time. Contact us (see the last section), or delete your account and create a new one.
• Questions, objections or anything the account page cannot do: contact us. Until a contact address is published, use the suggestions form → but do not write private details in it.
• Complaints: if you are not satisfied with how we handle your information, you can also complain to the data protection or privacy authority in the country where you live.

8. Sensitive information

This is a community site for Bhutanese refugees and the diaspora. Simply being a member, or posting here, may show other people your ethnic origin or that you or your family have a refugee background. We treat this as sensitive. This is why:

• sign-up asks for your clear agreement before an account is created, and records when you gave it;
• your display name can be a nickname;
• your email address is never shown to other members, and moderators do not see it;
• we do not ask for your real name, home address or documents;
• you are in the people directory only if you choose to be listed, and you can take yourself off the list at any time;
• every detail of a directory profile starts as visible only to you, and people who are not signed in see a profile only if its owner chose that;
• the “looking for someone” notices and the list of volunteers are shown only to signed-in members, not to the public;
• neither an invitation nor the waitlist asks for documents or for proof that you are a refugee;
• the location data inside a photo is removed before the photo is stored;
• the list of a public group’s members is not shown, only their number.

What you write in a post is your choice, and approved posts are public. To protect yourself and others:

• Use a nickname.
• Do not share exact home locations or private documents.
• Do not post health, immigration, financial or legal details, about yourself or anyone else.
• Ask permission before you post another person’s story or a photo or video of them.
• Watch a video before you post it. Everything that can be seen and heard in it is shared.
• In a directory profile, a town or region is enough. In a notice, write only what is needed to recognise the person you are looking for.
• Never post about a child.
• Report scams, threats or unsafe requests to the moderators.

If you post sensitive details about yourself, you are choosing to make them public. Moderators may remove posts that put someone at risk. Read more in the community guidelines →

9. Children

Accounts are for adults aged 18 or over. At sign-up we ask you to confirm that you are 18 or older. We do not ask for a date of birth or check identity documents.

If we learn that an account belongs to someone under 18, we delete the account and what it posted. If you believe a person under 18 has an account, or that a post, a photo, a video or a notice is about a child, please use the Report button or the suggestions form.

“Looking for someone” notices are for finding adults only. The writer must confirm that the person they are looking for is an adult.

10. Requests from authorities

We hold a limited set of information about a member: the email address, the display name, the language, the confirmation of being 18 or older and the acceptance of the terms (with time and version), the invite code if one was used and who made it, the invites the member made, and the member’s posts (with their photos and video), comments, likes, events, RSVPs, the public groups they started and the record of the groups they joined, directory profile and volunteer offer (if they made one), blocks, notices, private messages and the reports they filed. For a person on the waitlist we hold the email address, name and note they gave. The application does not store IP addresses, and it does not ask for real names or home addresses, so we cannot give out what we do not have.

If a court, the police or another authority asks us for information about a member, we will [to be added: policy for requests from authorities]

11. Security

• Encrypted connection. Information travels between your browser and the site over HTTPS.
• Encrypted storage. The database and the storage for photos and videos are kept encrypted on AWS.
• Passwords. The site itself never stores your password. Amazon Cognito handles it. A password change or a password reset signs you out everywhere else.
• Sign-in cookies. The three cookies that hold your session cannot be read by scripts in the page. The fourth cookie is only a marker and holds no secret.
• Limited access. Only administrators chosen by the operator can reach the underlying systems. Moderators work through the moderation pages and do not see email addresses.
• No outside scripts. The pages do not load code from other companies.

No website can promise perfect security. Please choose a password that you do not use anywhere else, and do not post anything that would put you at risk if it became known.

How we will tell members about a security problem that affects their information: [to be added: security incident notice policy]

12. Changes to this policy

We may change this policy, for example when the site gets new features or after a lawyer has reviewed this draft. Each version has a version label and a date. They are shown at the top of this page.

The terms and this policy share one version label. When it changes, signed-in members are asked to accept the new version before they can post again. This version was updated to cover invitations made by members, the waitlist, profile details with their own audiences, profile photos, volunteers, links to a member’s own post on another service, group calls and their format, videos on stories, public groups, topics that members type themselves, camp visits, and the correction form on the history pages. If other new features are added, this policy will be updated before they are switched on.

13. Contact

Operator: DW BARRON CONSULTING LLC, a Colorado, USA limited liability company.

Email for privacy questions: [to be added: contact email address]

Postal address: [to be added: postal address]

Until a contact address is published, please use the suggestions form. It is anonymous, so we cannot answer you directly. Do not put private details in it.