Privacy Policy

1. Scope and operator

This Policy applies to the Public Emergency Codes website and its same-site pages and tools, including the homepage, the interactive U.S. county directory, website forms, daily-tip viewer, poster creator and waitlist request, supporting-document request, and legal pages. It applies to the approved Public Emergency Codes hostnames, including emergency.codes and public.emergency.codes. It does not govern a third party’s independent website, application, payment page, telephone network, text-messaging service, or privacy practices.

Public Emergency Codes is a public-safety initiative operated by AID, a 501(c)(3) public charity, EIN 93-3844837. AID is the organization responsible for the information described in this Policy.

The website does not offer user accounts. The site’s application code does not include a first-party advertising network or general-purpose audience analytics service. Certain operational providers described below still receive technical information needed to deliver, secure, or support their services.

2. Information we collect

2.1 Information you submit

Please do not put Social Security numbers, payment credentials, medical records, protected health information, passwords, confidential law-enforcement information, or details requiring an emergency response in free-text fields.

2.2 Information processed automatically

• Normal connection information. When your browser requests a page or file, the web server and hosting provider necessarily receive information such as the requested URL, date and time, IP address, browser and device headers, and referring page when supplied. Hosting and server logs may retain some of this information under the host’s settings and policies.
• Form-security information. After you interact with or submit a protected form, the site requests a signed, one-use form token and applies rate limits. These requests process the IP address, requested form action, timing, host, origin or referrer, and the browser’s same-site/cross-site signal. The application stores rate-limit timestamps in files whose names are derived from a one-way hash of the applicable bucket. Rejected or rate-limited events can record a timestamp, event type, form action, keyed IP hash, and a limited reason, bucket type, or retry interval. Those abuse-event records do not include form messages, email addresses, phone numbers, uploaded poster images, or verification tokens.
• Cloudflare Turnstile. Bot protection is currently enabled for website forms and its browser software is loaded only after you interact with or submit a protected form. Cloudflare may receive the IP address and browser, device, network, interaction, and challenge signals needed to distinguish legitimate visitors from automated abuse. Our server sends Cloudflare the challenge response and visitor IP address for validation, then checks the action and hostname returned by Cloudflare against the expected form and approved Site hostnames.
• PayPal donation handoff. The homepage does not load PayPal software during an ordinary visit. If you choose Donate, the site first displays AID’s identity and key donation disclosures. PayPal is contacted only if you then choose “Continue to PayPal,” which navigates your browser to PayPal. PayPal may receive technical, usage, identity, and transaction information and use cookies or similar technologies under its own policies.
• County-number verification search. If you submit a county phone correction, our server sends DuckDuckGo a search query containing the county, state or abbreviation, and proposed phone number. DuckDuckGo sees the website server’s connection information, not the visitor’s IP address from the form. The server reviews result titles, snippets, phone matches, and source domains to decide whether the number can be published automatically.

2.3 Information kept only in your browser

The site generates contact cards, vCard files, QR codes, customized poster images, and poster PDF or PNG downloads in the browser. Public Emergency Codes does not receive the phone number typed into the custom QR/poster tool unless you later include it in a poster waitlist request. FAQ searches and the daily-tip viewer also operate in the browser and are not sent to our server. The phone and SMS screens shown in the educational presentation are visual demonstrations; text typed into the demonstration message field is not sent to 911, Public Emergency Codes, or anyone else by the Site.

When a county correction is pending manual verification, the map stores the state, county, proposed number, “pending” status, and submission time in your browser’s local storage under pecCountyPhoneOverridesV1. This lets only that browser continue displaying the pending number to you. It is removed when the public directory matches the number, when site data is cleared, or when the site otherwise clears that entry.

3. How we use information

We use information as reasonably necessary to:

• deliver the website, county directory, downloads, QR codes, and other requested functions;
• respond to contact messages and fulfill or evaluate document and poster requests;
• review feature suggestions and improve public-safety education, accessibility, and communications concepts;
• verify, publish, correct, and audit county non-emergency directory information;
• process, acknowledge, reconcile, and keep legally required records of donations made through PayPal;
• authenticate forms, detect bots, enforce rate limits, investigate misuse, protect the website and its users, and maintain service reliability;
• comply with law, enforce our Terms of Use, protect legal rights and safety, and establish or defend legal claims; and
• manage the charitable, financial, governance, and operational activities of AID and Public Emergency Codes.

Where a law requires a legal basis, the basis may be your consent; steps requested by you; our legitimate interests in operating, securing, and improving the site and responding to requests; compliance with legal obligations; or protection of legal rights and safety. You may withdraw consent for future processing where consent is the basis, without affecting earlier lawful processing.

4. When we disclose information

We do not sell personal information. We do not use personal information for cross-context behavioral advertising, and the application does not disclose it to data brokers. We may disclose information in these limited circumstances:

• Hosting and infrastructure. Hostinger and infrastructure providers may process connection data and hosted files to deliver and secure the site.
• Email. Website submissions are sent using Google/Gmail SMTP to designated Public Emergency Codes mailboxes. Google and any provider hosting a recipient mailbox process the message, attachment, routing, and delivery metadata.
• Bot and abuse prevention. Cloudflare processes Turnstile challenge information. Hosting or security providers may also process technical logs and security events.
• Public-source verification. DuckDuckGo receives county, state, and proposed phone-number search terms when a correction is submitted.
• Payments. PayPal processes donation and payment information under its own terms and privacy statement and may provide the charity with donor and transaction records.
• Communications and fulfillment. If a poster request is accepted, we may give the contact and commercial shipping information to printers, fulfillment vendors, or carriers as needed to produce and deliver the posters.
• Professional and organizational support. Authorized staff, volunteers, contractors, accountants, auditors, legal advisers, insurers, and other service providers may receive information when reasonably necessary for their work and subject to appropriate duties.
• Legal, safety, and organizational events. We may disclose information when required by law or legal process; to protect rights, property, systems, or safety; to investigate fraud or abuse; or as part of a merger, reorganization, transfer, or similar organizational event, subject to applicable law.

Current third-party information is available in the providers’ own notices: Cloudflare Privacy Policy, DuckDuckGo Privacy Policy, Google Privacy Policy, PayPal Privacy Statement, and Hostinger Privacy Policy.

Donation details

The website does not operate a payment form. Selecting Donate opens an on-site disclosure; selecting “Continue to PayPal” then leaves the Site for PayPal’s checkout. Only information confirmed in PayPal’s checkout controls the transaction. We do not directly store your full payment-card number, bank-account credentials, PayPal password, or payment security code.

Public county information

A county correction can result in the proposed non-emergency phone number, state, county, verification timestamp, and public source URL being published to all directory users. Do not submit a private, personal, unlisted, or unofficial number.

5. Cookies and browser storage

Our own application code does not set first-party advertising or analytics cookies. It uses local storage only for a pending county-number correction as described above. Signed form tokens and Turnstile response tokens are placed in temporary hidden form fields rather than permanent browser storage.

Cloudflare and PayPal may use cookies, local storage, pixels, scripts, or similar technologies under their own policies when their services are invoked. They are not contacted merely because the homepage or map is displayed: Cloudflare Turnstile is invoked after protected-form interaction, and PayPal after “Continue to PayPal.” Blocking third-party scripts or storage may prevent the requested form verification or donation flow from working.

Most browsers let you block or delete cookies and site storage. Clearing this site’s local storage removes a locally pending county correction from that browser but does not remove a correction already emailed, queued, or published by Public Emergency Codes.

Because there is no uniform standard for browser “Do Not Track” signals, the site does not respond differently to them. We do not sell personal information or use it for cross-context behavioral advertising, so a Global Privacy Control signal does not change those practices. PayPal and other independent third parties may provide separate privacy controls.

6. Retention and security

6.1 How long information is kept

• Form emails and operational records. Contact messages, suggestions, document requests, poster requests, and uploaded poster attachments are retained in organizational email and records until they are handled and for as long as reasonably needed for follow-up, nonprofit administration, disputes, security, legal obligations, or recordkeeping. The website does not currently implement an automatic deletion schedule for those emails.
• Donation records. PayPal retains payment information under its policy. We may retain transaction, donor, acknowledgement, accounting, and tax records for the period required or permitted by law and sound nonprofit recordkeeping.
• County corrections. Automatically verified directory data remains public until corrected, replaced, or removed. Unverified corrections may remain in a private review queue and email until reviewed or no longer needed; the queue does not currently have automatic time-based deletion. The browser’s pending copy remains until the public number matches it, the entry is cleared by the site, or you clear browser data.
• Form tokens and rate limits. One-use token claim files and rate-limit files are subject to periodic cleanup after they are more than approximately 48 hours old. Rate-limit files contain timestamps; identity-specific file names are derived from one-way hashes.
• Abuse events. The application keeps a current, size-limited abuse-event log and rotates it when it exceeds approximately 2 MB, retaining at most the current and previous log by design. Rotation is size-based rather than tied to a fixed number of days.
• Provider logs. Hosting, email, Cloudflare, PayPal, and DuckDuckGo retention is controlled by the applicable provider and its policies.

We may preserve information longer when reasonably necessary for an unresolved request, legal hold, investigation, dispute, safety matter, fraud prevention, or legal obligation. We may also delete information earlier when it is no longer needed.

6.2 Security

Safeguards in the application include HTTPS deployment expectations, input and upload limits, same-origin checks, honeypot fields, signed one-use form tokens, minimum submission timing, Turnstile validation, rate limiting, restricted server-side configuration, keyed hashing of IP addresses in abuse and county-review records, authenticated encrypted SMTP, and validation of customized PNG attachments. Sensitive configuration is kept outside the public website directory in the intended deployment.

No internet transmission, email system, third-party service, or storage method can be guaranteed completely secure. Please use the forms only for information appropriate to ordinary email.

7. Your choices and privacy rights

• You may browse most site content without submitting a form or creating an account.
• The county directory opens to Washington, D.C. (District of Columbia) by default. You may select a different state and county manually; the map does not request your location.
• You may view the Site and the on-site donation disclosure without contacting PayPal. PayPal is contacted only after you choose “Continue to PayPal.”
• You may clear cookies and local storage through browser settings, subject to the functional effects described above.

Depending on where you live and whether a particular law applies to AID, you may have rights to request access to or a copy of personal information; correction; deletion; restriction; portability; withdrawal of consent; objection to certain processing; information about disclosures; or review of a denied request. You may also have the right to complain to a privacy or data-protection authority. We will not unlawfully discriminate against you for making a privacy request.

To make a request, email requests@emergency.codes or use the website contact form. Describe the feature you used, the approximate date, and the email address or phone number involved. We may request information reasonably necessary to verify identity, authority, and the records at issue. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity. Some information may be exempt from a request or retained where legally permitted, including records needed for security, accounting, legal compliance, fraud prevention, free expression, or legal claims.

For a question or appeal concerning our response, reply to our decision or contact us again with “Privacy Appeal” in the subject line and explain why you believe the decision should be reconsidered.

8. Children, international visitors, and changes

8.1 Children

The website provides general public-safety education but is not directed to children under 13, and we do not knowingly collect personal information online from a child under 13. Children under 13 should not submit forms, request posters or documents, submit county corrections, or donate. If you believe a child under 13 submitted personal information, contact us so we can investigate and delete it where appropriate. Users under the age of majority should use interactive features only with permission and supervision from a parent or legal guardian.

8.2 International visitors

Public Emergency Codes and its primary operations are in the United States. If you access the site from another country, information may be processed and stored in the United States or another country where a service provider operates. Those places may have different privacy laws. Where required, we use an applicable legal basis and safeguards for cross-border processing.

8.3 External services and links

Telephone and SMS links open your device’s phone or messaging software. Public Emergency Codes does not receive the content of calls or texts made through those links, but your carrier, device provider, emergency service, crisis line, or messaging application may process them. Links to government sources, GitHub, GitLab, PayPal, and other sites are governed by those sites’ policies once you leave Public Emergency Codes.

8.4 Changes to this Policy

We may update this Policy when the website, providers, or legal requirements change. We will post the revised Policy at this location and change the effective or last-updated date. If a change materially affects information already collected, we will provide any additional notice or choice required by applicable law.

9. Contact us

For privacy questions, requests, or concerns about a child’s information, contact: