Personal account privacy notice

Information used for your account

• Profile: your name, email address when provided, account status, role, and sign-in history. A phone-only account may have no email address.
• Email and password: a password hash, pending registration details, and protected verification or recovery tokens. Your password is not stored as readable text.
• Google sign-in, when available: a verified email address, basic profile name, and a protected identifier for your Google account.
• Phone sign-in, when available: your number is processed to send and check a verification code through Twilio Verify. The phone identity and challenge records store an identifier derived from your number with a server secret, rather than the number itself, plus the provider’s verification reference.
• Security: session activity, verification attempts, account security events, and hashed rate-limit identifiers derived from an account identifier or network address.

We use these records to create and authenticate accounts, recover access, limit unauthorized attempts, and investigate account security issues.

Services that support verification

Resend receives the destination address and message needed to deliver verification and recovery emails. Google handles Google sign-in. Twilio Verify receives your phone number and verification request when you choose phone sign-in. Our hosting and database services process account and security records to operate the portal.

Available methods depend on which services are configured. Choosing phone verification authorizes the requested verification text. Creating an account does not subscribe you to marketing emails or marketing texts.

Sign-in cookies and expiry

A session cookie keeps you signed in. Temporary cookies connect Google or phone verification to the browser that started it. These cookies support account access, rather than advertising. They are not readable by browser scripts and are sent over secure connections on the production site.

The database stores a hash of the session token. Sessions expire after eight hours, or after 30 minutes without activity. Signing out revokes that session. Email registration links expire after 30 minutes; Google and phone verification attempts expire after 10 minutes.

Expiry prevents further use of a session or verification attempt. It does not automatically delete the associated account, verification, or security records.

Organizational access is separate

A verified personal account opens automatically. Organization information, property access, staff management, and administrative tools require a separate authorized assignment. A property request is a separate process.

Community training records

When you take the community awareness course, we record enrollment, the learner name used for your certificate, the course and version, lesson progress, quiz responses, video progress or transcript alternatives, completion evidence, and certificate issue, expiration, and revocation information. These records let you resume and review the course, demonstrate completion, and verify a certificate.

Authorized Harbor Alliance administrators can manage course assignments and review training completion. Creating a personal account does not make your account or training record available to other learners. Course content and practice situations do not ask you to identify a real person or disclose a personal experience. Do not enter another person’s sensitive information into the course or an AI assistant.

Certificate QR codes and verification links

Anyone who has your certificate QR code or verification link can view your learner name, course title and version, certificate number, issue and expiration dates, and current validity status. That view does not provide your email address, quiz answers, account access, or certificate download. Share the QR code or link only with people you want to have those details.

A certificate is valid for one calendar year after issuance unless revoked. Expiration does not delete its completion or verification record. Verification pages are not listed for search engines; someone who receives your QR code or link can still share it.

OVIS reporting cases

A case is linked to your account; it is not anonymous. We store the concern category, website or platform name, any website address or platform reference you provide, an optional official report reference, and your brief summary. We also store your acknowledgement, case status, updates, review requests, timestamps, and recorded outcomes. Provide only non-graphic information. Do not submit abuse material, files, screenshots, chat transcripts, or identifying details about a child or another person at risk.

You can view your own cases and their reporter-visible updates. Authorized Harbor Alliance administrators can review cases and add internal notes. Internal notes are separate from the timeline shown to the reporter. Audit records document authorized access and changes. Hosting and database services process these records to operate and protect the portal.

OVIS organizes case records for human review. Submitting a case does not automatically send a report to law enforcement, NCMEC, a platform, or an AI service. The portal does not automatically open reported addresses or download content. Cases and their details are not published on a community map or shown to other account holders. Any external referral documented by a reviewer is a separate action, not a live connection to external case systems.

Case records are retained to support follow-up, accountability, security, and applicable recordkeeping obligations. Closing a case does not automatically delete it, and the portal does not currently provide an automatic deletion schedule. You may request access, correction, or deletion through the contact process below. Do not include sensitive report details or material in an ordinary support message; provide your case reference only.

This portal is not an emergency service and does not replace official reporting or legal reporting duties. A recorded closure may mean referral, inability to verify, duplication, or withdrawal; it does not necessarily mean removal. A removal-confirmed outcome requires a reviewer to record provider acknowledgement and applies only to the identified content.

Questions and requests

Use our contact page for questions about account, training, or reporting information, retention, corrections, access, or deletion. Ask for your request to be directed to Alex Borrego, Founder. We may need to verify your identity and review related recordkeeping obligations before acting on a request.

Do not send passwords, verification codes, or sign-in links in a support message.