Privacy Policy

Draft — under legal review. This policy describes how Multimodal Mondays handles information today and is being reviewed before final publication. Text in [brackets] is still to be filled in.

Last updated: October 22, 2026

This Privacy Policy explains what information [Multimodal Mondays legal entity name] ("Multimodal Mondays," "we," "us") collects through the multimodalmondays.com website and the Multimodal Mondays app (the "Service"), how we use it, and the choices you have. It's part of our Terms of Use.

1. Information we collect

When you create an account

• Your name (display name), email address, and password. Passwords are stored by our authentication provider in hashed form — we can't see them.
• The invite or pilot access code you used, and the referral code of whoever invited you (if any).
• Your city or town, and the approximate map coordinates we look up for it.
• If your rewards access is sponsored by an employer or organization, which organization that is.

When you use the app

• Trip logs: the date and the modes you selected (for example walk, bike, bus/train, roll, run, scoot/skate, carpool, or drive), and the points earned. We don't collect routes, distances, times of travel, or GPS location.
• Monday photos: the photo, the date, your city, and the modes logged. When you choose a photo, your device reads its capture date (from the photo's embedded data) to check it was taken that Monday. The photo is then resized and re-saved on your device before upload, which removes embedded metadata — including any GPS location — so it never reaches us.
• Reactions you leave on community photos.
• Monthly reflections: your answers to the monthly reflection prompts.
• Points, bonuses, streaks, referrals, and reward redemptions, including which rewards you redeemed and the redemption emails we sent you.

When you buy a membership

Payments are handled by Stripe. Stripe collects your payment card details and billing information directly; we never receive your full card number. We receive and keep your Stripe customer ID, your plan (monthly or yearly), subscription status, and renewal dates.

When you fill out a form on the website

• Individual sign-up / waitlist: your name, email, address (and its coordinates), the modes you already use (optional), how you heard about us (optional), and any notes.
• Organization sign-up: organization name, contact name, email, address (and coordinates), approximate employee count, nonprofit status, whether you need vehicle-miles-traveled (VMT) tracking, notes, and any additional locations.
• Reward offers: business name, address (and coordinates), contact name and email, who the reward should be visible to, and each reward's details and optional photo.
• Partner interest and business nominations: the business's name, website or link, city, and any contact name, email, and notes provided. If you nominate a business, you may be giving us information about someone else — please only share business contact details that are publicly available or that you have permission to share.

Automatically

• Site analytics: page-view data through Vercel Web Analytics, which is designed not to use cookies or identify individual visitors.
• Error reports: when something breaks, technical details about the error (such as the browser, device type, and what the app was doing) are sent to Sentry so we can fix it. We've configured it not to send personal information by default.
• Data stored on your device: the app saves your sign-in session, a referral code you arrived with, whether you've dismissed the "install the app" prompt, and cached app files (so it loads fast and works as an installed app). This lives in your browser's storage, not on our servers.

When you contact us

Your email and anything you include in your message.

2. How we use information

• To run the Service: create your account, record your logs, calculate points and streaks, show your stats, process redemptions, and manage memberships.
• To show community features: the Monday photo collage, shareable graphics, and city leaderboards.
• To screen photos and keep the community family-friendly (see Section 4).
• To enforce our Terms of Use, including our Honest Logging Policy — for example, reviewing logs, photos, referrals, and account patterns for signs of dishonest activity.
• To run the Monthly Monday Raffle and other promotions, including contacting winners.
• To send you service emails: account and password emails, reward codes and instructions, membership receipts and renewal notices, and important updates. [If marketing emails are added: describe and include opt-out.]
• To measure impact and improve the Service, using aggregate or de-identified data (for example, total active trips by city, or reports to partners, funders, and grant programs).
• To review pilot, organization, and reward partner applications and follow up with you.
• To comply with the law and protect the safety and rights of our users, partners, and us.
• To feature Monday photos in our website, social media, and promotional materials, as described in the Photo Release in our Terms of Use.

3. Who can see your information

• Other users can see Monday photos that pass screening, along with the city and modes logged for each, in the community collage. They can also see reactions on photos. Photos are stored at web addresses that anyone with the link can open, so a photo shared outside the app (for example, as a downloaded graphic) can be seen by anyone.
• Leaderboards show totals by city, not individual people's logs.
• Your trip logs, stats, reflections, points, and email are visible only to you and to the Multimodal Mondays team.
• Sponsoring employers or organizations see only aggregate participation numbers (for example, how many people logged qualifying trips), not your individual logs.
• Reward partners don't receive your email or other account details from us when you redeem a reward. If you redeem in person or online, the partner will see whatever you give them when you redeem.
• The public may see photos we feature on our website, social media, or in promotional materials, as described in the Photo Release.

4. Service providers we use

We share information with companies that help us run the Service, only as needed for them to do that work:

• Supabase — database, authentication, file storage, and server functions.
• Vercel — website and app hosting, and privacy-friendly analytics.
• Stripe — membership payments and billing management.
• Resend — sending emails such as reward redemptions and internal moderation alerts.
• Anthropic — automated screening of Monday photos for inappropriate content. Each photo is sent to Anthropic's AI service for a yes/no check; under Anthropic's commercial terms, photos sent through its API aren't used to train its models. [Confirm current terms before publishing.]
• Sentry — error monitoring.
• OpenStreetMap — when you type a city or address, that text is sent from your browser to OpenStreetMap's Nominatim service to look up coordinates; maps in the app load tiles from OpenStreetMap's servers.
• Google — our pages load fonts from Google Fonts, and if you use the language dropdown on the website, page text is sent to Google Translate.

Each of these providers handles data under its own privacy policy.

Other sharing

• Legal reasons: if required by law, or to protect the rights, safety, or property of our users, partners, the public, or us.
• Business changes: if Multimodal Mondays is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that deal, subject to this policy.
• With your permission.

We don't sell your personal information, and we don't share it for targeted (cross-context behavioral) advertising.

5. Teens and children

The Service is for people 13 and older. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, email lauren@multimodalmondays.com and we'll delete it.

Users aged 13 to 17 need a parent or guardian's permission to use the Service and to share Monday photos (see our Terms of Use). A parent or guardian can contact us to review, correct, or delete their teen's information or photos.

6. How long we keep information

• Account information, logs, photos, and points: for as long as your account is open, then deleted within [30–90] days of account deletion, except as described below.
• Website form submissions: for as long as needed to review them and follow up, or until you ask us to delete them.
• Payment and transaction records: as long as required for tax, accounting, and legal purposes.
• Records related to a Terms violation (such as an Honest Logging Policy violation), for as long as needed to enforce the decision and prevent repeat accounts.
• Photos already used in published or printed materials under the Photo Release may continue to appear there.
• Backups are overwritten on a rolling schedule. [Confirm backup retention period.]

7. Your choices and rights

• Access and correction: you can see your logs, stats, and account details in the app. Email us to get a copy of your data or correct something.
• Deleting photos: email us to remove any Monday photo.
• Deleting your account: email us and we'll delete your account and associated data (cancel any paid membership first).
• Emails: service emails (like reward codes and billing notices) are part of using the Service. [If marketing emails are added: "You can unsubscribe from marketing emails using the link in any email."]

Depending on where you live (for example, California, Colorado, Virginia, or other states with consumer privacy laws), you may have additional rights, such as to know, access, correct, delete, or port your personal information, and to opt out of sale, sharing, or targeted advertising (which we don't do). [Confirm which state laws apply and whether thresholds are met.] To make a request, email lauren@multimodalmondays.com. We'll verify your request using your account email and won't treat you differently for exercising your rights. You can use an authorized agent as allowed by law.

8. Security

We use reasonable safeguards to protect your information, including encrypted connections (HTTPS), access controls in our database so each user can reach only their own private data, and limited team access. No system is perfectly secure, so we can't guarantee absolute security. If we learn of a breach affecting your information, we'll notify you as required by law.

9. Where information is stored

Multimodal Mondays is based in the United States, and our service providers may store and process information in the United States and other countries. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S.

10. Changes to this policy

We'll update this policy as the Service changes. We'll change the "Last updated" date above and, for meaningful changes, let you know in the app or by email before they take effect.

11. Contact

Questions or requests? Email lauren@multimodalmondays.com.
[Mailing address]