Privacy Policy

AutismHearts (autismhearts.com, "we," "us," or "our") is an independent autism resource directory and guide site. This policy explains what information the site collects, which outside services handle it, and the choices you have. We have tried to describe what the site actually does today, including where it is less private than we would like.

1. Who is responsible for your information

AutismHearts is operated by Zak. Our mailing address is AutismHearts, PO Box 1024, Denver, CO 80201.

Privacy questions and requests: legal@autismhearts.com.

2. What we collect, by feature

Browsing the site

Our hosting provider and server infrastructure receive standard request data (such as IP address, browser type, and the pages requested) in the ordinary course of serving the site. See "Analytics (Google Analytics 4)" below for analytics.

Free guides, newsletter, and "email me this listing" forms

Email sign-ups. If you sign up for the free guide or for updates (families, autistic adults, or providers), we collect your email address, your first name (families and adults) or practice name (providers, optional), which page you signed up on, and a record of the consent wording you saw and when you agreed. We store this in our database (Supabase) through our own server; it is not sent to a third-party form service. To limit abuse we briefly keep a one-way hash of your IP address (salted with the date) next to the sign-up and clear it after about a day. Every email we send to the list must include a one-click unsubscribe link, and unsubscribing is recorded against your address. [TODO: Zak / counsel: state how long sign-up records are kept after unsubscribing, and name the tool used to send list emails once one is chosen (no list email is sent by the site code today).]

Contact and listing forms. If you use the contact or corrections form, or the "send this provider to my email" form on a provider page, we collect what you type into it, such as your name, email address, and message, plus the provider details on the page you saved. These forms are processed by Formspree, which delivers the submission to us. We use it to reply to your message. [TODO: Confirm what Formspree actually sends back to the person who submits (the "email me this listing" form says it emails the listing to the visitor) and which Formspree plan and retention settings apply.]

The contact form asks you not to include private health information. Please follow that request.

Family inquiries to Featured Partner providers

Providers on the paid Featured Partner plan can show an inquiry form on their profile. If you submit it, we collect your name, email address, phone number (optional), your child's age group, insurance or coverage (optional), and your message, and we record that you ticked the box asking us to send it to that provider. We store the inquiry in our database (Supabase) and email you a confirmation link through Resend. Nothing is sent to the provider until you click that link within 24 hours. After you confirm, we forward the inquiry by email, through Resend, to that one provider's contact email on file, with your email set as the reply-to address so the provider can answer you directly. We do not sell inquiries or share them with other providers, and we do not send them to any other recipient or automation. If the email to the provider fails, we retry once a day until the inquiry is deleted; our internal alert about failed deliveries contains only counts, never your details.

To stop spam and duplicate inquiries, we keep keyed one-way hashes (not the readable values) of your email address and phone number together with the provider you contacted, for 30 days, so the same inquiry is not sent to the same provider twice in that period. We also keep a keyed hash of your IP address, combined with the date, for up to 1 day to limit how many inquiries one connection can send per hour. We check for hidden-field and too-fast submissions, disposable email addresses and links in the message, and reject those inquiries.

After a provider receives your inquiry, the provider is responsible for how it uses and protects that information, under its own policies and the laws that apply to it. We do not control the provider's response. Free (unpaid) listings do not have an inquiry form. Please do not include your child's name, diagnosis, medical records, or other private health details in the message. AutismHearts is not a medical provider; [TODO: counsel: confirm whether any HIPAA or state health-privacy law applies to inquiry data held by AutismHearts and adjust this paragraph accordingly.]

Retention: if you do not confirm an inquiry, we delete it within 48 hours. Once an inquiry has been forwarded to the provider by email, we delete our copy from our database 7 days after we received it. A scheduled job runs once a day, so deletion can take up to about a day longer. If the email to the provider could not be sent, we keep the inquiry for up to 30 days so it is not lost before the provider sees it, and then delete it. Deleted data may remain in our database provider's backups for a limited period. [TODO: Zak: confirm the backup retention period on the Supabase plan in use and state it here.] Copies that were already emailed to the provider, and email delivery logs kept by our email service, are not covered by this period; the provider's own policies apply to its copy.

Provider accounts and claims

Providers can create an account with an email and password or with Google sign-in. Authentication and account data are handled by Supabase. When a provider claims a listing we collect the contact name, work email, role, an optional NPI or license number, the plan chosen, and the profile details the provider chooses to publish (for example phone, website, hours, services, insurance accepted, languages, bio, logo and photos, and optional inquiry-notification preferences including an optional phone number for text alerts). Account holders can delete their account from the provider dashboard, which first cancels any active Stripe subscription (if the cancellation cannot be confirmed, nothing is deleted) and then removes the account and claim records. Listing data that comes from public sources is not removed by account deletion. A record that a practice has used its free trial is kept so the one-trial-per-practice rule continues to work.

Payments

• Stripe processes Featured Partner subscriptions. Providers are sent to a Stripe-hosted checkout page, and we pass along a claim reference and the work email to prefill it. Card details are entered with Stripe and are never received or stored by us. We receive and store the Stripe customer and subscription identifiers, subscription status, and trial and billing dates. Stripe's handling of your data is governed by the Stripe Privacy Policy.
• PayPal processes purchases of digital products from our shop. The PayPal checkout script loads from PayPal on the shop page, and PayPal receives the payment details you enter there. We receive the order confirmation and order ID and give you a download link that expires after 24 hours. See the PayPal Privacy Statement. Some products link out to Etsy instead, which is governed by Etsy's terms and privacy policy.

Emails to providers (Resend)

We use Resend to send transactional email to providers: welcome and trial-ending notices, payment-failed notices, monthly listing reports, and forwarded family inquiries. Provider emails should include an unsubscribe link, but we may still send essential account and billing messages.

AI Care Navigator (assistant)

If you use the AI assistant, the text you type is sent through our server to AI services. We first remove some obvious sensitive patterns (such as Social Security, payment card, and medical record numbers) before sending. Google (Gemini) generates the answer and may use Google Search or Google Maps to ground it. OpenRouter is used for a short classification step that decides whether a question is about a local search or may describe an urgent crisis. Please do not type names, health details, or other sensitive information into the assistant. Our code does not save assistant conversations to our database. [TODO: Zak: confirm that hosting logs do not retain prompts, and check the retention and training settings on the Gemini and OpenRouter accounts, then describe them here.]

Location

On the home page, only if you tap "Use my location", your browser asks for permission to share your location. If you allow it, your coordinates are sent to our server only to look up a nearby city and ZIP code from a local dataset; our code does not store them. Typing a city or ZIP into search works the same way. Provider pages show an embedded OpenStreetMap map, which means OpenStreetMap receives a request from your browser when you view it.

Information stored on your device

Your browser stores some information locally: accessibility and sensory display settings, saved favorites, a per-day marker so a listing view is counted once, and, for signed-in providers, the sign-in session. We load fonts from Google Fonts, which means Google receives a request from your browser for them.

Listing activity counts

For provider listings we keep simple daily counts of profile views, phone-number clicks, website clicks, and inquiries. Featured Partners can see these counts for their own listing. The counts are not tied to your name or email.

3. Analytics (Google Analytics 4 and Vercel Web Analytics)

We also use Vercel Web Analytics, provided by our hosting company, to count page views and see which pages are visited. It does not use cookies and does not build a profile of you across sites; visits are counted with a short-lived, anonymized identifier that Vercel discards within a day.

We use Google Analytics 4 to understand which pages are useful. The Google Analytics tag loads on every page (a moment after the page itself has loaded). There is currently no cookie or consent banner, and analytics is not blocked until you opt in. Google sets analytics cookies and receives information such as the page address, referrer, device and browser type, approximate location derived from your IP address, and the interactions the tag records.

In addition, the site sends a small set of named events (for example a search, a click on a phone number, or a sign-up). Before these events are sent, our code removes names, emails, phone numbers, addresses, ZIP codes, coordinates, and any free text such as search or chat text, and keeps only coarse values such as state or category. These custom events are skipped if your browser sends a Do Not Track or Global Privacy Control signal. That signal does not currently stop the base Google Analytics tag from loading and recording a page view. To avoid Google Analytics entirely, use a browser or extension that blocks it, such as the Google Analytics opt-out browser add-on. See how Google uses data from sites that use its services.

[TODO: Zak / counsel: decide whether to add a consent banner or Google consent mode, and whether GA4 data-retention settings and IP handling need to be stated here. Update this section when the site changes.]

4. How we use information

• To run the directory, guides, shop, and provider accounts.
• To forward family inquiries to the provider you chose.
• To process payments and manage Featured Partner subscriptions.
• To send the guides, replies, and emails you asked for, and account and billing notices to providers.
• To answer assistant questions and keep the site safe and working.
• To understand aggregate usage and improve the site.
• To handle correction and removal requests for directory listings.

We do not sell your personal information, and paying for a Featured Partner profile does not change organic directory ranking.

5. Who receives information

We use the following service providers, each of which handles data only as needed to provide its service to us:

We may also disclose information if required by law or to protect the rights, safety, or security of our users or the site.

6. Directory listings and public information

Most provider listings are built from the public U.S. National Provider Identifier (NPI) registry and similar public sources and describe businesses and professionals, not site visitors. If a listing is wrong, outdated, or should be removed, use our corrections page.

7. How long we keep information

Family inquiries: see the retention paragraph in section 2 (7 days after forwarding; up to 30 days if forwarding failed; backups may keep deleted data for a limited period). [TODO: Zak / counsel: retention periods are not defined for the other data types. Decide and state them for email sign-ups, form submissions (Formspree), provider claim and subscription records, billing records (Stripe/tax), email logs (Resend), and analytics (GA4).]

What we can say today: if a provider cancels a Featured subscription, the photos, bio, and profile details it entered stay saved on its account unless it deletes the account. Deleting a provider account removes the account and its claim records. Information in your browser stays until you clear it.

8. Your choices and rights

• Unsubscribe from marketing emails using the link in the message.
• Delete a provider account from the provider dashboard.
• Correct or remove a listing through the corrections page.
• Ask us about access to, correction of, or deletion of other information we hold about you by emailing legal@autismhearts.com. We will respond as required by applicable law.
• Block analytics as described in section 3.

[TODO: Counsel: add state-specific privacy rights language (for example California and other states with comprehensive privacy laws), response timelines, and an appeals process if they apply to AutismHearts.]

9. Security

We serve the site over HTTPS and take reasonable steps to limit access to the systems that hold your information. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

10. Affiliate links and third-party purchases

Some pages contain affiliate links, including links to books or other resources sold by third-party retailers such as Amazon. If you buy through an affiliate link, AutismHearts may receive a commission at no additional cost to you. Affiliate relationships do not determine our editorial recommendations, and purchases are governed by the third party's terms and privacy policy. See our Disclosure Policy.

11. Children

The site is for parents, caregivers, autistic adults, and professionals. We do not knowingly collect personal information directly from children under 13. Parents and guardians who send an inquiry about a child should limit it to what the provider needs to reply, such as an age group. If you believe a child has given us personal information, contact us at legal@autismhearts.com.

12. Where information is processed

AutismHearts is intended for people in the United States, and our service providers may process information in the United States and other countries. [TODO: Counsel: confirm whether any international-visitor language is needed.]

13. Changes to this policy

We will update the "Last Updated" date when this policy changes. If a change is significant, we will say so on this page.

14. Contact

Email: legal@autismhearts.com
Mailing address: AutismHearts, PO Box 1024, Denver, CO 80201

This policy is a plain-language description of the site's practices and is not legal advice. [TODO: Have counsel review before treating this as final.]