Privacy

Only volunteers who have signed a confidentiality agreement read the messages people leave. Anything in a relay that could identify someone is deleted from VOICE's records 30 days after it closes, unless a volunteer extends that by 30 days at a time while it is still needed.

Access to Messages

Messages can be read only by volunteers who sign in to the Switchboard with their own accounts, and each of them signs a confidentiality agreement before beginning. Information a person shares is used only to do what they asked, and none of it is disclosed to anyone outside VOICE without their permission, including the organizations where some volunteers work. Volunteers do not confirm to anyone whether a particular person uses VOICE.

Email, Faxes, and Accounts

Email sent to a wildcard address arrives in one shared inbox, which only the volunteers who monitor it can open. They can see who sends each email and its subject line without opening it, and they open an email only to deliver something time-sensitive, such as a verification code. They tell the person about other email before opening it. A private VOICE email account can be opened only by its holder. Email is deleted from the shared inbox once the person has received it or once their instructions for it have been carried out. A fax is kept in a restricted folder that only the same volunteers can open, and it is deleted once the person has received it.

If a person stores backup codes with VOICE, the codes are kept in a sealed envelope, and VOICE records only which accounts have stored codes, never the codes themselves. During an identity check, the volunteer steps away while the service takes a picture or video of the person's face.

Alerts

When you turn on alerts, your phone or computer gives the Alerts site a delivery address that works only for sending notifications to that device. The Alerts site keeps it with the topics and language you chose and a few details that keep delivery working. These are the kind of device, when you signed up and last changed your choices, and when the delivery service last accepted an alert for it. The site also keeps how many deliveries in a row have failed and the label of the flyer from which you signed up, if it had one. The Alerts site does not ask for your name, phone number, email address, or location, and nothing it stores names you.

When an alert arrives on a phone that reports arrivals, the Alerts site adds one to that alert's count and keeps nothing about the phone. Each alert waits on the Alerts site, listed with the delivery address of each phone it is going to, only until it is delivered or the alert ends. It is sealed as it is sent, and Google, Apple, Microsoft, or Mozilla transmits each sealed alert to your phone. Although they cannot read it, they can see that it was sent.

If you turn alerts off or clear your browser's data, the delivery address stops working, and the Alerts site usually removes it the next time an alert is sent. A phone that refuses 10 alerts in a row and has received nothing for 30 days is removed as well.

A Missing Person alert names a person only with the family's or the agency's consent. Once it is taken down, the person's details are erased from the Alerts site's records, and its page says only that it was taken down. The site's daily copies of its database keep those details only until they are replaced.

Switchboard

Every message goes to the Switchboard, where volunteers record each one, whether it was left as a voicemail, sent from this site, emailed to one of VOICE's addresses, or given to a volunteer in person, by post, or by fax. Each message is given a number, called a relay number, and a volunteer takes responsibility for it and works to deliver it. VOICE keeps what the message said and how to reach its sender until the relay's information is deleted.

A relay closes automatically after 30 days with no activity. 30 days after it closes, VOICE deletes everything in it that could identify anyone from its own records. That means each of these.

the sender's name, phone number, and email address
who the message was for, and any organization named for either of them
what was said
any replies, notes, and files

A reminder is written in the relay, and sent to the volunteers working on it, 7 days before each step. When a relay is still needed, a volunteer can keep it for 30 more days, and can do so again, writing the reason in the relay each time.

After that, what stays is a numbered record that says only these things.

whether the message was from and for an individual, an organization, or the VOICE Team
how it arrived, how urgent it was, and how it ended
whether it asked for an alert, led to an alert, or was shown on Beacon
the months in which it came in and was deleted

VOICE also keeps monthly counts of messages by each of these.

the same kinds of sender and recipient
whether each individual belonged to an organization
the Organization Type of the organization on each side, such as Health Care, and never its name
whether the recipient was marked as the sender's family or friend
whether each was reached through VOICE
which request it was, for a message to the VOICE Team
how the messages arrived, how urgent they were, and how they ended
how many asked for an alert, led to an alert, or were shown on Beacon

The team's activity log, which is never deleted, also keeps each step a volunteer took on the relay, such as assigning or closing it, under the relay number alone. None of it says who sent a message or what it said.

Messages from this site that look like spam are held for a volunteer to check, and are deleted after 7 days if nobody releases them.

Email reaches VOICE through an email account, where each email stays until 67 days after the last message in its conversation, when it is moved to the trash, which the email service empties after 30 days.

Replies that volunteers send by email go out through a Gmail account, which keeps a copy of each in its Sent Mail until a volunteer deletes it.

The phone service behind VOICE's number for messages records each voicemail and emails VOICE a transcript. The recording stays in VOICE's account with that service until a volunteer deletes it there.

VOICE's daily copies of its database keep a relay's information for up to 7 days after it is deleted. Replies name only the relay number in the subject line, so VOICE's email log keeps nothing more about the message.

Wiki

For each saved version of a page on the main site, VOICE keeps the name of the team member who saved it and when, which only the team can see in the page's history. A page that someone on the team has edited shows who last edited it and on what date, and a page the team created shows who created it. Each credit names the team member, their organization, or one of their workgroups, as chosen when the page was saved. The pages keep nothing about the people who read them, and searching the site is not recorded.

Team members can leave internal notes on a page. Only the team can read them, and they never appear on the main site, in print, or on Beacon. Each note keeps its writer's name, and a note is deleted 90 days after someone marks it resolved. While someone edits a page, the editor keeps their unsaved changes on the server for at most a day, so a lost connection loses nothing.

Beacon

Beacon screens and sheets show current alerts, custom information that the team writes, short messages from relays, and parts of this site's public pages. They read those parts from the pages each time they are shown, so they keep no copy of them. Each Beacon screen and sheet has a public page, because what it shows is posted where anyone can read it, unless the team requires a key for it. With a key, it opens only in browsers given that key. A new Beacon screen or sheet made by someone without permission to manage every Beacon screen and sheet shows nothing at its address until someone with that permission publishes it. A Beacon screen or sheet does not record who looks at it, and for a screen VOICE keeps only the time it was last opened.

A relay appears on a Beacon screen or sheet only when a volunteer chooses that screen or sheet and writes the text to show, which is never copied from the relay itself. The screen or sheet shows that text with the relay's number, and never a phone number or an email address. Text that contains one is sent back to be rewritten, and any that remains is left out, along with the sentence around it. The text comes off every screen, and VOICE deletes it, when its end date passes or the relay's details are deleted, whichever comes first. A printed sheet keeps it until the sheet is replaced. Its end date is 14 days after it was written, unless the volunteer chose a date up to 60 days away.

VOICE deletes custom information 30 days after its end date, when it has one. Who created each screen or sheet and who last changed it are shown only to the team, never on the screen or sheet itself.

Copies, Logs, and Translation

Daily copies of the site's records, kept for 7 days in case something goes wrong, still contain deleted information until they are replaced. Copies made just before a software update are deleted 14 days after it. Backups that the site's administrators download and keep elsewhere also contain deleted information, because each is a copy of everything that was in the site's records on the day it was made.

The site's email log keeps the address and subject line of each email the site sends for 90 days. The addresses of emails about a relay are removed when its information is deleted. To limit misuse, such as someone guessing passwords, the site counts requests from each internet address for a day, in scrambled form. It also keeps each attempt to sign in to Operations, with its internet address and the username typed, for 30 days. For 90 days, the team's activity log keeps the internet address used for each change. After that, it keeps only what was done, by whom, and when.

Every translation on this site is written by a person, so no text is sent to a translation service.

If you choose a language, Larger Text, or High Contrast in the header of this site or the Alerts site, the site saves each choice in a small cookie on your device. The cookie contains only that choice and is used for nothing else.

Records Kept by Outside Services

VOICE relies on outside services, and each keeps records of its own that VOICE cannot fully control. The company that hosts this website keeps records of visits, which can include each visitor's internet address and kind of device. The phone service behind the message line keeps its own call records, along with each voicemail until volunteers delete it, and the email service keeps each email until it is deleted. The fax service keeps its own record of each fax.

Questions About Privacy

Questions about how VOICE keeps and uses information can be sent to info@voicestl.org, or asked at an in-person session.