Privacy Policy
Last updated October 2, 2026
StayAwhile is a letter-writing project: volunteers write letters to residents of care communities, and the community's staff print them, hand them over and type in the replies. This page explains what information the site holds, who can see it, and what you can do about it. We have tried to say it in plain words.
What we collect
From volunteers
- Your display name, email address and password (the password is stored scrambled, so nobody, including us, can read it).
- Your birth year. We never show it to anyone; it only tells us whether you are under 18.
- Your interests and short bio, if you add them, which help match you with residents.
- A security question and your answer (also stored scrambled), which is how you reset a forgotten password.
- A parent or guardian's name and email, only if you choose to give them.
- Your letters and drafts, the stationery you chose, and any reports you file.
- Your email choices and, for safety and to keep the site working, sign-in records: when you signed in, the IP address and kind of browser, and failed sign-in attempts.
From facility staff and site administrators
Name, email, password, and (for two-factor sign-in) an encrypted authenticator secret. The site keeps an audit log of actions staff and administrators take, such as approving a letter or changing a setting, with who did it and when.
About residents
Facility staff add the residents. They enter a preferred name and may also record a full name, an email, and get-to-know-you details such as hobbies and favorite memories. Volunteers only ever see the preferred name and the details staff choose to share. A resident's full name, email and facility are never shown to volunteers.
How we use it
- To let volunteers and residents exchange letters, and to let staff read and review them first.
- To keep everyone safe: automatic checks hold letters that appear to contain contact details, and administrators look into reports.
- To email you that something is waiting (see Email below).
- To protect the site from abuse and fix problems.
We do not sell your information, show advertising, or share it with advertisers.
Who can see your letters
A letter is seen by the staff of the resident's care community (who read it before it is printed, depending on that community's policy), by the resident it is printed for, and by site administrators when needed for safety, reports or support. Staff can stop a letter. Letters are not shown to other volunteers or to the public. Please never put phone numbers, email addresses, home addresses or last names in a letter; the site is built so that personal contact details are not exchanged.
Who else handles the information
The site runs on Cloudflare, which hosts it, stores its database, sends its emails and provides the bot check on some forms. Cloudflare handles that information on our behalf. We do not use analytics or advertising services.
Cookies
The site uses one cookie, to keep you signed in and protect forms from forgery. It is needed for the site to work. There are no tracking or advertising cookies.
Emails only tell you that something is waiting, with a link to sign in; they never contain a letter. You choose how often to receive them (once a day, once a week, or not at all) in My Profile. We still send messages you ask for, such as a password reset link.
How long we keep things
- Letters and conversations are kept, so that a resident's side of a conversation stays whole.
- Accounts are kept until they are deleted.
- The audit log is kept, as a record of what happened if a concern is raised.
- Technical logs are removed automatically: sign-in attempts after a week, error and email logs after about three months, and read notifications after a year.
Your choices
- See your information: My Profile, then My data, downloads everything the site holds about you, except your scrambled password and security answer and private notes staff made about letters.
- Change it: edit your details any time in My Profile.
- Delete your account: My Profile, then My data. Your name, email, birth year, interests, bio, guardian details, security question, drafts and notifications are erased, you are signed out everywhere, and your name in the audit log is replaced. The letters you already sent stay, shown as from "Former volunteer", so that residents keep their side of the conversation.
- Email: turn it off or reduce it in My Profile.
- Questions or requests (including from a parent or guardian): use the Contact page.
Young volunteers
Volunteers under 18 are welcome. For them we collect only what is listed above, and a birth year rather than a date of birth. Every letter goes through the care community's staff. If you are a parent or guardian and want to see, correct or delete your child's information, contact us and we will help.
Security
The site is served over an encrypted connection, passwords and security answers are stored scrambled, administrators must use two-factor sign-in, and what staff and administrators do is recorded. No system is perfectly secure; if we learn that your information has been exposed, we will tell the people affected.
Changes
If this page changes, the date at the top changes. If a change matters to you, such as collecting something new, we will tell volunteers on the site or by email.