Skip to content

Legal

Privacy Policy

Effective Date: March 25, 2026

Last Updated: August 14, 2026

PeaceRise operates the website peacerise.global and the companion application at peacerise.app. This Privacy Policy explains what we collect, why we're allowed to collect it, how long we keep it, and the rights you have over it. We've tried to write it the way we'd want it explained to us.

1. Who is responsible for your data

The data controller for PeaceRise is Alloy Growth Lab, the U.S. 501(c)(3) nonprofit behind the PeaceRise initiative.

2. What we collect

Information you provide

  • Account information: When you sign in with Google, we receive your name, email address, and profile photo from your Google account.
  • Profile information: If you create a Peace Partner profile, you may provide a bio, pathway preference, country, skills, organization affiliations, and other optional details. You choose what becomes public.
  • Entity registration: Organizations and ventures registering in the ecosystem provide names, descriptions, websites, contact information, and logos.
  • Contact form: When you write to us through the About page form, we collect your name, email address, chosen topic, and message.

Information collected automatically

  • Peace Timer data: If you use the Peace Timer on peacerise.app, we record session duration, activity type, and timestamps to track your practice and award badges.
  • Email delivery logs: When we send you a transactional email, we log the recipient, template, and delivery outcome so we can detect failures.
  • Cookies: We use essential cookies for authentication and session management only. We do not use advertising cookies or third-party analytics trackers.

3. The founding community import

PeaceRise began as the 2024 PeaceRise Innovation Challenge, whose community lived on the Disco platform. When we rebuilt this site, we imported the founding community roster — around 278 member profiles and 33 organization listings — so that founding members could reclaim their place in the ecosystem.

Here is exactly how that import is handled:

  • Imported member profiles are unpublished by default. Your profile only becomes publicly visible if you sign in and claim it yourself.
  • Imported organization listings are held as unlisted pending confirmation from someone at the organization.
  • If you were part of the founding community and want your imported record removed entirely, email connect@peacerise.global and we will delete it.

This section is our notice to founding members under GDPR Article 14: the data came from the Disco community export, not from you directly.

4. Why we're allowed to process your data

Where GDPR or similar laws apply, our lawful bases are:

  • Contract: account creation, profile management, entity registration, and transactional email (we can't provide the service without them).
  • Consent: publishing your Peace Partner profile — publication happens only through your explicit publish or claim action, and you can unpublish at any time.
  • Legitimate interest: the founding-community import described in §3 (re-establishing an existing community, with unpublished-by-default records and an unconditional removal right), spam protection, and service security.
  • Legal obligation: where we must retain or disclose records by law.

5. How long we keep it

  • Account and profile data: until you ask us to delete it (§7).
  • Unclaimed founding-community records: until claimed or until you request removal; we review unclaimed records periodically.
  • Contact-form messages: up to 24 months, so we can follow up on ongoing conversations.
  • Email delivery logs: up to 12 months.
  • Aggregated ecosystem statistics: retained indefinitely — they contain no personal data.

6. Who processes your data, and where

We do not sell your personal information. We share it only with the service providers that run the platform, and with authorities where legally required:

  • Google Firebase / Google Cloud (United States) — authentication, database, file storage, and Cloud Functions.
  • Vercel (United States) — website hosting.
  • Resend (United States) — transactional email delivery.
  • Google reCAPTCHA (United States) — spam protection on registration.

These providers are based in the United States, so your data may be transferred outside your country. Where GDPR applies, transfers rely on the providers' EU–U.S. Data Privacy Framework certifications and/or Standard Contractual Clauses, per each provider's data processing terms.

7. Your rights

Depending on where you live (including under GDPR and UK GDPR), you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data — profile fields you can edit yourself from your dashboard.
  • Erase your data ("right to be forgotten").
  • Restrict or object to processing, including the founding-community import (§3).
  • Portability — receive your data in a usable format.
  • Withdraw consent at any time — unpublishing your profile takes effect immediately.
  • Complain to your local data-protection supervisory authority.

To exercise any of these rights, email connect@peacerise.global (or use the About page contact form and pick “Privacy or data request”). Requests are handled by a human; we aim to respond within 30 days. Deletion removes your personal data, though anonymized aggregate statistics may be retained.

8. Data storage and security

Your data is stored in Google Cloud Firestore and Firebase services. We protect it with Firestore security rules, authentication checks, admin role-based access control, and point-in-time recovery backups. No method of electronic storage is 100% secure, but access to personal data is limited to what each surface actually needs.

9. Children's privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can promptly remove it.

10. Third-party links

Our site links to external websites, including organizations listed in the ecosystem directory. We are not responsible for their privacy practices and encourage you to review their policies.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post changes on this page with a revised "Last Updated" date, and notify account holders by email when a change is significant.

12. Contact us

Questions about this policy or our data practices: connect@peacerise.global, or the contact form on our About page.