CF Cornerman Privacy Policy

This page covers the CF Cornerman app. See also the app’s Terms of Use.

CF Cornerman is a free web app that suggests small, everyday ways to support the cystic fibrosis (CF) community. It is operated by Directive LLC, an Ohio limited liability company (“CF Cornerman,” “we,” “us,” or “our”).

This Privacy Policy explains what information we collect, how we use it, who can see it, and the choices and rights you have. It applies to the CF Cornerman web app at app.cfcornerman.com (including the version you can add to your phone’s home screen), our emails, and any other place that links to this policy (together, the “App”). The CF Cornerman website at cfcornerman.com, including the book information there, is a separate site and is not covered by this policy.

We have tried to write this in plain language. If anything is unclear, email us at privacy@cfcornerman.com.

CF Cornerman is an independent community project. It is not managed, sponsored, endorsed, or operated by the Cystic Fibrosis Foundation (CFF). When you follow a link from the App to a CFF website or any other website, that site’s own privacy policy applies, not this one.

The short version

• We collect only what we need to run the App: your email address, the name you choose to show, a few preferences, your ZIP code, and the actions you mark as done.
• We do not collect health or medical information. We never ask whether you, or anyone you know, has CF.
• We do not sell your personal information, and we do not share it for targeted advertising. There are no ads in the App.
• You choose how visible you are: Public, My Corner only, or Completely private.
• Analytics are off until you agree, and we honor Global Privacy Control (GPC) browser signals.
• You can delete your account at any time in Settings.
• The App is only for adults 18 and older.

1. Information we collect

1.1 Information you give us

1.2 Information created when you use the App

• Invitations and referrals. When you share your personal invite link or QR code and someone signs up through it, we record that they joined your Corner. We also record how a person first arrived (for example, an invite link, a QR code, or directly), so we can count your Corner correctly.
• Badges, ranks, and milestones you earn, and the milestone messages the App creates for the Community feed.
• Email history, such as when we last sent you a reminder, so we don’t send too many.
• Account and security records, such as when you signed up, signed in, and changed your settings.

1.3 Information collected automatically

• Technical information. Like most websites, our hosting and database providers automatically receive information such as your IP address, browser and device type, operating system, and the date and time of your requests. We use this to deliver the App, keep it secure, prevent abuse, and fix problems.
• Product analytics (only with your permission). If you turn analytics on, we use PostHog to record how the App is used, for example when an action is completed, when a share button is tapped (and which service it opened), or when an invite link is first created. This helps us understand what is working and improve the App. We do not use session recording (screen replay). See Section 8.

1.4 Information we do NOT collect

• Health, medical, or genetic information, or any diagnosis
• Whether you, your child, or anyone you know has CF or any other condition
• Passwords (we use email sign-in links and codes instead)
• Payment, bank, or credit card information. The App does not take payments or donations.
• Your precise location (GPS)
• Your phone contacts or email address book
• Your birth date

Please don’t enter health or medical information anywhere in the App, including your display name or photo. The App is not designed to hold that kind of information, and we may remove it if we see it.

2. Before you create an account

When you first try the App, you can answer a few setup questions (like your identity label, available time, and ZIP code) before entering your email. Those answers are kept only in your own browser (in “local storage”), not on our servers. When you enter your email to create an account, those answers, and the invite link that brought you to the App (if any), are saved to your new account. If you never sign up, they stay only on your device, and you can clear them by clearing your browser’s site data.

3. How we use your information

We use your information to:

• Provide the App: create and secure your account, sign you in, suggest daily actions, show nearby events, track your progress, and award badges and ranks.
• Run your Corner and the Community feed, according to your privacy settings.
• Send you emails: sign-in links and codes, account and service notices, and the reminders, summaries, and milestone emails you choose to receive (see Section 7).
• Improve the App, using analytics if you allow it, and feedback you send us.
• Keep the App safe and fair: prevent spam, fake accounts, and misuse of invite links; enforce our Terms of Use; and protect our users and the public.
• Follow the law, and respond to lawful requests.

We do not use your information for advertising, we do not build advertising profiles, and we do not use it to make decisions that have legal or similarly significant effects on you. The App’s suggestions come from simple rules (such as your available time, interests, and ZIP code), not from artificial intelligence.

4. Your profile photo

Adding a photo is optional. If you add one:

• It is resized and stored with our database provider.
• It is shown next to your name where your privacy settings allow.
• Please know: profile photos are stored at a web address that someone could open if they had that exact link. If you choose “Completely private,” we stop showing your photo inside the App and move it to private storage, so the old link stops working. If you are concerned about who can see your photo, the safest choice is not to add one.
• You can remove your photo at any time in Settings. When you remove it or delete your account, we delete the file from storage.

Please only upload a photo that you have the right to use. Our Terms of Use include the photo rules.

5. Who can see your information

5.1 Your privacy level

You choose one of three privacy levels in Settings, and you can change it at any time:

Your email address and ZIP code are never shown to other users. Your state may be shown with your milestones, as described below.

5.2 The Community feed

The Community feed shows only automatic milestone messages that the App creates, such as “Jordan R. from Ohio earned a new badge.” Each milestone includes the person’s US state, which we take from their ZIP code. We never show a ZIP code, city, or anything more precise than the state. If you are Completely private, or you are outside the US, no state is shown. There are no user posts, comments, or messages. Your name in the feed is filled in each time the feed is shown, so if you change your name, switch to anonymous or private, or delete your account, the feed updates to match.

5.3 Your Corner

• People you directly invite, and the person who directly invited you, can see each other’s display name and rank (subject to your privacy level).
• People further out (people invited by the people you invited, and so on) are only counted. We don’t show their names to you, or yours to them.
• If you share a personal summary or report, you choose who receives it. Reports you download are created on your own device.

5.4 Service providers

We use a small number of companies to run the App. They handle information only on our behalf and under contracts that limit how they can use it.

We do not use any other service providers to process your personal information. Our providers store and process information in the United States.

5.5 Other times we may share information

• To follow the law, such as in response to a valid subpoena, court order, or other legal process.
• To protect people, including to prevent fraud, abuse, or threats to anyone’s safety, or to protect our rights.
• If the App changes hands. If the App is transferred to another person or organization (for example, a nonprofit), your information may be transferred with it. The new operator would have to honor this policy, and we would tell you before your information becomes subject to a different policy.
• With your direction, for example when you use a share button (see Section 6).

5.6 What we never do

• We do not sell your personal information.
• We do not “share” your personal information for cross-context behavioral (targeted) advertising.
• We do not use advertising cookies or ad trackers.
• We do not share your information with the Cystic Fibrosis Foundation or any other charity.

6. Share buttons and links to other sites

The App has share buttons for text message, email, WhatsApp, X, LinkedIn, Facebook, and your device’s own share menu. When you tap one, it opens that app or site with a message you can read and edit first. You decide whether to send it and to whom. We never send messages for you, and we never see or upload your contacts.

The App also links to other websites, such as CFF event, advocacy, and donation pages. Once you leave the App, the other service’s privacy policy applies. We are not responsible for how other sites handle your information.

7. Emails

• Sign-in emails contain a one-time link and a 6-digit code. They are sent only when you ask to sign in.
• Service emails tell you about important changes to your account, this policy, or our Terms.
• Reminder and summary emails (such as summaries, milestone notes, or a single “we miss you” note after a quiet period) are sent based on the frequency you choose: every two weeks (the default), weekly, milestones only, or never. If you haven’t completed an action in about a month, we pause these emails automatically and start them again when you come back. Every one includes a one-click unsubscribe link that works without signing in, and our mailing address. We honor unsubscribe requests promptly, and within 10 business days at most.

We never send guilt-based emails, such as “you lost your streak.” We do not send text messages.

8. Cookies, local storage, and analytics

Do Not Track and Global Privacy Control. We honor both. If your browser sends a “Do Not Track” signal or a Global Privacy Control (GPC) signal, we treat it as a request to opt out, and we keep analytics turned off for that browser, even if analytics were turned on before. You can also turn analytics on or off at any time with the switch in Settings. We do not allow other companies to track you across websites through the App.

9. How long we keep information

10. Deleting your account

You can delete your account at any time in Settings > Account > Delete account, or by emailing privacy@cfcornerman.com from the email address on your account. You can also request deletion without signing in at app.cfcornerman.com/delete-account. When you delete your account:

• Your email address, preferences, ZIP code, actions, badges, ranks, invite link, and photo are permanently deleted.
• Your sign-in account is deleted, so you will no longer receive any emails from us.
• Your profile is replaced with an anonymous placeholder labeled “Former Corner Supporter.” It contains no name, email, or photo. We keep it only so that invite counts for other people stay accurate.
• Your name is removed from every Corner and from the Community feed.
• Copies in backups are erased as the backups roll over, within about 7 days and never more than 6 months after your request (see Section 9).
• If you had turned analytics on, we also ask PostHog to delete the analytics data linked to you.

Deleting your account can’t be undone.

11. Your privacy rights and choices

11.1 Choices you can make in the App

• Change or correct your display name, how your name is shown, identity label, photo, ZIP code, and preferences in Settings.
• Change your privacy level at any time.
• Change how often we email you, or turn off reminder emails.
• Turn analytics on or off.
• Delete your account.

11.2 Your rights

We offer the following rights to all users, wherever they live. Some US state privacy laws (for example, in California, Colorado, Connecticut, Virginia, Oregon, Texas, and others) give these rights to their residents. Because of CF Cornerman’s small size and because it does not sell data, these laws do not currently apply to us, but we choose to give these rights to everyone. You can ask us to:

• Know and access what personal information we have about you, and get a copy in a portable format.
• Correct information that is inaccurate.
• Delete your information.
• Opt out of the sale of your personal information, targeted advertising, and profiling. (We don’t do any of these, but you can still ask, and we’ll confirm.)
• Limit the use of sensitive personal information. (We don’t collect it on purpose. See Section 12.)
• Not be treated differently for using any of these rights.

How to make a request. Email privacy@cfcornerman.com with the subject line “Privacy request.” To protect your account, we will confirm your identity, usually by checking that you control the email address on your account. You may use an authorized agent to make a request for you. We may ask the agent for proof that you gave them permission, and ask you to confirm your identity directly.

Timing. We will confirm your request within 10 business days and respond within 45 days. If we need more time (up to another 45 days), we’ll tell you why within the first 45 days.

Appeals. If we deny your request, you may appeal by replying to our decision or emailing privacy@cfcornerman.com with the subject line “Privacy appeal.” We will respond to your appeal in writing within 45 days, explaining what we did and why. If you are not satisfied, you may contact your state’s Attorney General.

11.3 Washington and Nevada residents

Washington’s My Health My Data Act and Nevada’s consumer health data law give residents specific rights over consumer health data. We do not collect consumer health data (see Section 12), but if you live in Washington or Nevada you may still ask us to:

• Confirm whether we collect, share, or sell your consumer health data, and get a copy of it along with a list of every third party it was shared with and how to contact them. Our service providers are listed in Section 5.4.
• Withdraw any consent you gave.
• Delete your consumer health data, including from backups.

Make these requests the same way as other privacy requests (Section 11.2). You don’t need to create an account to make a request. If we deny your request, you can appeal as described above, and if your appeal is denied you can file a complaint with your state’s Attorney General (in Washington, at https://www.atg.wa.gov/file-complaint).

11.4 California residents

California’s “Shine the Light” law lets California residents ask which personal information a business shared with third parties for their own direct marketing. We do not share personal information with third parties for their direct marketing.

12. Health information and consumer health data

The App is designed so that we do not collect, infer, or use consumer health data. We never ask about anyone’s health, diagnosis, treatment, medications, or genetics. The App has no free-text fields where you write about yourself, other than your display name.

We do not treat your use of the App, your choice of identity label, or the volunteer actions you complete as information about anyone’s health, and we do not use them to draw conclusions about anyone’s health. Supporting the CF community is open to everyone, whether or not CF is part of their own life.

Some states, such as Washington (My Health My Data Act), Nevada, and Connecticut, have special laws about consumer health data. If you think we have received health information about you (for example, if you put it in your display name or sent it to us by email), contact us at privacy@cfcornerman.com and we will delete it. We will never sell health information, and we will not collect or share it without your separate, express consent.

Because we do not collect consumer health data, we do not need, and do not post, a separate Consumer Health Data Privacy Policy.

13. Age requirement

• The App is only for adults 18 and older. Everyone confirms their age when creating an account. We record only the date you confirmed, never your birth date.
• We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect any information from children under 13.
• If we learn that someone under 18 has created an account, we will delete the account and its information. If you believe a minor has signed up, please contact us at privacy@cfcornerman.com.

14. How we protect your information

We use reasonable administrative, technical, and physical safeguards to protect your information. These include encrypted connections (HTTPS), encryption of stored data by our providers, sign-in without passwords, database rules that let each person see only what they are allowed to see, and limiting administrator access to the people who run the App. Today, a single administrator at Directive LLC manages the App’s event listings and can access account information when needed to run the App, answer requests, or prevent misuse.

No system is completely secure. Because your email inbox is how you sign in, please keep your email account secure. If we learn of a security breach that affects your personal information, we will notify you and any required authorities as the law requires, and in any case without unreasonable delay.

15. Users outside the United States

The App is designed for people in the United States. If you use it from another country, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may be different from those in your country.

16. Changes to this policy

We may update this policy as the App changes or the law changes. When we do, we will update the “Last updated” date at the top. If we make a material change in how we collect, use, or share your personal information, we will tell you by email or in the App before the change takes effect, and where the law requires it, we will ask for your consent. Past versions of this policy are available on request.

17. Contact us

Questions, requests, or concerns? We’re happy to help.

Directive LLC
Attn: Privacy
952 Winchester Rd, Unit #308, Lexington, KY 40505
Email: privacy@cfcornerman.com
Website: https://app.cfcornerman.com