You belong hereScope and responsibility
This policy covers untilshessafe.org and the untilshessafe.com addresses that redirect here. Emily Runnels is the current operator of Until She’s Safe and is responsible for this website. Kittrell Co. provides founding and technical support. Independent resource providers operate their own websites and services; this policy does not govern them.
Browse without telling us your story
You do not need an account or to identify yourself to read our pages. The site has no survivor intake, story submissions, file uploads, comments, embedded chat, newsletter signups or donation checkout. We do not ask for case details, identity documents, medical records or evidence of abuse.
The website does not request your device’s location. It does not record what you type into the ZIP search before you submit it.
Technical information and its purpose
Serving a page involves technical information such as an IP address, requested URL, request time, browser or device information, response status and potentially a referring address. Hosting and network services may process this information to deliver pages, protect systems, investigate abuse and diagnose problems. This means browsing is not guaranteed to be anonymous.
The website application does not write request logs, but our hosting provider maintains technical logs. Authorized people administering the hosting account may be able to access those records. We do not use this website to build advertising profiles or track a person’s resource choices across sites.
Optional ZIP and service search
You may select a support category and enter a five-digit U.S. ZIP code. Submitting sends those two fields to Until She’s Safe to search our provider directory and display matches here. Our application processes the fields in memory for the response and does not write them to the database, request logs or a search history. You can use other resources without entering a ZIP.
The provider database and ZIP reference data are hosted with the site. A search does not send your ZIP or selected category to SAMHSA, GeoNames, Findhelp or a listed provider. Fields travel in a request body rather than a URL; hosting and security systems still process requests and connection information. Browser restoration, device monitoring or infrastructure records may retain information. Search is not an application, a booking or a guarantee of eligibility.
Administrative messages
Use the organizational email only for privacy questions, accessibility barriers and corrections to the website. Email sends your address, message and ordinary message metadata to the mailbox provider and the people handling that mailbox. Send only what is needed to explain the website issue. Do not send a survivor’s story, case files, identification documents or urgent requests for protection.
Administrative correspondence is used to respond to the issue, maintain the site and meet applicable legal obligations. Email is not a confidential counseling or legal service, is not continuously monitored and may leave records in email accounts and on devices. A message does not establish a professional relationship or open a survivor case.
Cookies, analytics and browser storage
Our public resource application does not create visitor cookies, use analytics or advertising pixels, or store resource activity in localStorage or sessionStorage. Hosting security systems may use necessary cookies and connection checks. Same-site searches can send those cookies to our hosting service; the application does not use them to save search histories. We do not use session replay, a service worker or embedded maps and chat. Images, scripts and styles load from our own site.
We do not operate targeted advertising, sell visitor data through this website or use it for decisions about eligibility for housing, employment, treatment or other services. The current site does not vary these practices based on Do Not Track or Global Privacy Control signals because these advertising and profiling features are absent. External websites and hosting security systems have their own practices.
The separate, restricted staff workspace uses a necessary HttpOnly sign-in cookie scoped to its own /admin/ area. It stores staff usernames, password hashes, sessions, account invitations and short-lived hashed identifiers for sign-in abuse prevention, along with provider edits, organizational partnership notes and an editorial activity record. It does not provide survivor accounts or intake. Staff sessions expire after 30 minutes of inactivity or 12 hours, invitations expire after 48 hours, and the activity record is retained for up to one year. Expired authentication records are removed during subsequent account activity.
Who can receive information
Hosting and email services process the technical records or correspondence needed to provide their services. Authorized administrators and people responding to administrative messages may access information necessary for those tasks. Data may also need to be preserved or disclosed to meet a valid legal requirement or investigate a security incident.
Our on-site ZIP search queries a local provider database. Following an external link sends a request to the website you choose, which may receive your IP address and other connection information. A listed provider does not receive a survivor disclosure from us simply because you browse a listing. We do not run a referral intake system or transfer case records between providers.
Retention and security
The database stores public provider listings, their sources, review dates and geographic reference data. It does not store visitor ZIP searches or survivor-intake records. Technical logs and backups follow hosting-provider retention arrangements. Our hosting provider makes access-log archives available for up to 30 days; that is not a verified deletion deadline for every security record or backup.
We retain administrative correspondence only while needed to handle the request, maintain relevant records or meet legal obligations. Removing an active message may not immediately remove provider backups or copies held by its sender. We cannot erase browser history, phone records or records held independently by another provider.
The site uses HTTPS and browser protections to limit unnecessary connections and embedding. No website or email system can guarantee complete security or prevent monitoring on your device.
Privacy choices and requests
You can browse without using the ZIP search or contacting us. Depending on your location and the laws that apply, you may have rights to access, correct or delete personal information, obtain a copy, or appeal a response to a request. We do not require a website account to raise a privacy concern.
Contact the organizational email with the subject “Privacy request.” Describe the request without sending sensitive case information. If we need to verify that records relate to you, we will ask only for information reasonably necessary for that purpose. A request may be limited by legal obligations, security requirements or our inability to identify records. If a request is declined, you may reply with “Privacy appeal” for further review and may contact your state’s privacy regulator. We respond within the periods required by applicable law and explain any permitted extension.
A request about Findhelp or another independent provider must be directed to that provider. We cannot change records we do not control.
Young people and other locations
These are general U.S. resource pages. We do not offer children’s accounts, ask ages, or provide an intake service for children. Please do not send a child’s personal details through the administrative email. Technical information can still be processed when anyone visits.
Resource eligibility, confidentiality and reporting rules vary by provider and age. Visitors outside the U.S. should use locally appropriate emergency and support services. Hosting, email and external providers may process information in locations where they operate.
Changes and contact
We will update this page when the website’s information practices change and show the revision date above. New visitor accounts, intake, fundraising or other collection features would require a fresh privacy review and appropriate notices before launch.
Email hello@untilshessafe.org for a website privacy question or request. Emily Runnels is responsible for reviewing these administrative requests. Do not use this address for emergencies or confidential case advice.