Privacy policy

Shamp is run by goimpactnow, a brand of Truthsprout Network ("we", "us"). This policy covers Shamp at shamp.goimpactnow.org and in the Shamp app. The rest of goimpactnow.org has its own privacy policy. We do not sell your information, and Shamp has no advertising trackers.

What we keep

Your account

Your username, email address and password. The password is never stored as you typed it: only a salted scrypt hash, which cannot be turned back into the password. We also keep whether you are a person or an organisation, when you joined, the causes you have joined, and your settings.

Your profile

Anything you add: your name, headline, introduction, photo and background, where you are, your organisation, what you are open to, your experience, education and skills, and endorsements others give you.

What you do on Shamp

Your posts and replies, with any photo, PDF, video or link; reactions; reposts; who you follow; the posts you save; what you have marked on an opportunity (applying, selected); Shamp Live sessions you said you would attend; and the endorsements you give.

Messages

Messages you send and receive. They are kept on our servers and are not end-to-end encrypted.

Notifications

Your list of notifications. If you turn on notifications on a phone or browser, we keep the address your browser gives us for delivering them. The push itself carries no words: your device fetches what happened from us when it arrives.

Technical information

• A one-way scrambled form (a hash) of your internet address, stored with what you post and used to limit abuse. We do not keep the address itself with your posts.
• How many times each post is viewed, as a plain count, not who viewed it.
• Page views, counted without cookies: the page and the site you came from.
• A record of the emails we sent you (confirming your address, resetting your password), with your address partly hidden.

What is public, and what is not

• Public: your username and profile, your posts and replies, reactions and reposts, the causes you are active in, and how many people follow you and you follow. Public pages can be found by search engines and shown in link previews on other apps.
• Signed-in members only: the lists of who follows you and who you follow, unless you hide them in Settings.
• Private: your email address, your saved posts, your messages, your notifications and your settings.

How we use it

• To run Shamp: your account, your profile, your posts and the conversations around them.
• To choose what you see: the For you feed uses who you follow, the causes you joined, and what people found useful; suggestions of who to follow use the same kind of signals.
• To tell you what happened: notifications, and emails about your account.
• To keep Shamp safe: screening posts for fees, scams, links and spam; limiting how fast anyone can post; moderation.
• To answer you when you write to us, and to understand in aggregate how Shamp is used so we can improve it.

Who else handles it

We use a small number of services to run Shamp. They handle information only to provide their service to us:

• Our hosting provider, whose servers store Shamp and its data.
• Cloudflare, which delivers Shamp's pages and protects it from attacks, and so sees your internet address.
• Resend, which delivers the emails we send.
• Your browser's push service (from Google, Apple or Mozilla), if you turn on notifications. It delivers a signal with no content.
• The meeting service a Shamp Live host chose, when you join their session there.

When you post a link, Shamp's server fetches that page to make the link's card, and keeps its picture on our servers, so people reading the post do not contact that site. We share information with authorities only when the law requires it. These services and our servers may be outside the country where you live.

How long we keep it

• Your account and what you post, for as long as your account exists, or until you delete them.
• Notifications: the most recent two hundred.
• Link cards: a week, then fetched again if needed.
• When you delete your account, your email, password, profile, notifications, phone notification settings and endorsements are removed. Your username is kept, marked deleted, so no one else can take it and appear to have written your posts. Your posts stay up unless you choose to hide them, which also removes their files. Messages you sent stay in the other person's conversation.
• Backups are overwritten over time.

Your choices and rights

• See and change your profile at any time, and delete posts, replies and your whole account yourself.
• Hide who follows you and who you follow. Turn phone notifications off, or stop one person's posts buzzing your phone with the bell on their profile.
• Ask us for a copy of your information, to correct or delete it, or to stop using it for something, by contacting us. You can also complain to the data protection authority where you live.

Children

Shamp is not for anyone under 16. If we learn an account belongs to someone younger, we close it.

Security

Shamp is served only over HTTPS. Passwords are hashed, and changing or resetting yours signs every other device out. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Changes

If we change this policy, the date at the top changes, and for important changes we will tell you on Shamp first.

Contact

Questions or requests about your information: contact us.