Privacy Policy

1. Who we are

NearRoots is run by BridgeWell Strategies LLC, a Virginia limited liability company ("BridgeWell," "we" or "us"). We are responsible for the personal information described here.

Privacy contact (person in charge of personal information): Privacy Officer, BridgeWell Strategies LLC · contact@nearroots.com · mailing address available on request at contact@nearroots.com

2. The short version

• You are hidden from people search until you choose to appear.
• Other members see your city, never your exact location, address or email.
• We never ask about immigration status, citizenship or visa type.
• We don't sell your information or show ads.
• We use Google Analytics and Microsoft Clarity only if you accept them, and never on messages, member profiles, people search or account pages. You can change your choice any time with "Analytics choices".
• You can delete your account at any time, and it happens immediately.

3. What we collect, why, and who sees it

4. What we never collect

• Immigration status, visa type, citizenship or identity documents.
• Your precise location or GPS position.
• Your date of birth. You only confirm that you are 18 or older; we record when you confirmed it.

5. Country of origin and other sensitive information

Your country of origin, hometown and languages can say something about your background. Some laws may treat this as sensitive information.

• Country of origin is optional. If you share it, it is used only so members can find people from their community. You can add, change or remove it at any time.
• Hometown and languages are optional.
• We don't use this information to guess or label anyone's ethnicity, religion, nationality or citizenship, and we don't share it outside NearRoots.
• You can change these fields or hide your profile at any time.

6. Who can see what

• Visitors without an account can see approved business listings only. They can't see members.
• Members can see your profile only if you turn on "Show me in people search." They never see your email.
• Blocking: if you block someone, or they block you, neither of you can find or message the other.
• Searching another city is never shown to anyone. Your profile always shows your home city.
• Business listings are public once approved. A business with a storefront shows its address. A business without one shows only the area it serves. Owner community appears only if the owner reports it, and it is labeled that way.

7. Messages and moderation

Messages are private between the two people in the conversation. They are encrypted in transit but not end-to-end encrypted. We don't read messages, with one exception: if a member reports a conversation, a moderator may read it to handle the report, and every such review is logged. When a report is filed, a copy of up to the 50 latest messages between the two members is saved with the report, so the report can still be handled if an account is deleted.

8. Service providers and where your information is processed

We use these providers to run NearRoots. They process information for us and only to provide their service:

If you live in Canada or Australia, your information is transferred to and stored in the United States [TO CONFIRM: and any other countries above]. While there, it may be accessible to courts, law enforcement and national-security authorities under the laws of those countries.

9. When we share information

• We don't sell personal information, and we don't share it for advertising. In Google Analytics, Google signals and ad personalization are turned off, and we never send names, emails, profile details, messages, search terms or member identifiers to Google or Microsoft.
• We may share information when the law requires it, to respond to valid legal requests, or to protect someone's safety.
• If NearRoots is ever transferred to another company, your information would move with it under this policy. We would tell you first.

10. Cookies and device storage

NearRoots uses what it needs to work, and analytics cookies only if you accept them. There are no advertising cookies.

• Login cookies: keep you signed in.
• Theme cookie (nr-theme): remembers light or dark mode for up to one year.
• Language cookie (nr-lang): remembers the language you chose for NearRoots, for up to one year.
• City search cookie: remembers the city you chose to explore, on this device only.
• Browser storage (nr-intro-seen): remembers that you've seen the welcome slides.
• Cloudflare Turnstile may set its own cookie or similar technology during a CAPTCHA check.
• Analytics choice cookie (nr-analytics): remembers whether you accepted or rejected analytics, for about 6 months. Then we ask again.

Analytics (only if you accept). When you first visit, we ask whether NearRoots may use analytics. Nothing loads unless you choose Accept, and only on nearroots.com.

• Google Analytics 4 sets the cookies _ga and _ga_Z198FZ39VH [TO CONFIRM: kept for up to 2 years]. Before anything is sent, we remove search terms and every other part of the web address after the page name, replace member and conversation identifiers with a generic label (for example, a member profile is sent as "Member profile"), and send a generic page title instead of the page's own.
• Microsoft Clarity runs only on our home page, legal pages and public business directory, and only when you're not signed in. It records clicks, taps, scrolling and mouse movement so we can see where pages are confusing. Text, business listing details and anything you type are hidden in recordings. Clarity sets the cookies _clck and _clsk, and may also use cookies on Microsoft's own domains (such as MUID) [TO CONFIRM: how long each is kept]. If you go from a recorded page to any other page, the page reloads so the recording stops.
• Change your mind any time: choose "Analytics choices" at the bottom of the home page or any legal page. If you reject after accepting, collection stops, we delete the _ga, _ga_Z198FZ39VH, _clck and _clsk cookies, and the page reloads. Cookies on Microsoft's own domains can only be removed in your browser settings.

11. How long we keep information

• Account and profile information: until you delete your account.
• Search and profile-view counts: one day.
• Google Analytics data linked to cookies: 2 months, the shortest setting Google offers. Reports that only contain totals, such as visits per page, can be kept longer. Microsoft Clarity recordings: [TO CONFIRM: about 30 days, Microsoft's standard period].
• Safety reports and their saved messages: 12 months after closing if no action was taken, and 3 years if action was taken. For the most serious cases (threats, scams, sexual exploitation or attempts to harm someone), up to 5 years, with access limited to administrators.
• Feedback: 24 months. Feedback is kept without your name after account deletion.
• Backups: we keep encrypted backup copies of the database for up to about 5 weeks, then delete them. Hosting logs are kept for about 1 day [TO CONFIRM]. Removed business listings: deleted after 12 months, keeping only a short record (business name, city and the reason) so they aren't added again by mistake. If you haven't logged in for 3 years, we'll email you a reminder; we don't delete inactive accounts automatically.
• We may keep information longer if the law requires it or for an active legal claim.

12. Deleting your account

When you delete your account from your profile, we immediately delete:

• your login and profile;
• your photo, languages and blocks;
• your message notification devices;
• your conversations and messages, for both people. The other person in each conversation will no longer see it. If they reported the conversation before you deleted your account, the copy saved with that report is kept for the report's retention period (section 11).

What remains:

• reports you were part of, with their saved copy of messages, until the retention period ends;
• feedback you sent, without your name;
• business listings you submitted, which stay public as business information, no longer linked to you;
• copies in backups, until the backups expire.

13. Your choices and rights

Everyone can:

• Access a copy of your information.
• Correct your profile in the app, or ask us to.
• Delete your account in the app.
• Withdraw consent by hiding your profile, removing optional details, rejecting analytics under "Analytics choices", or deleting your account.
• Complain to us, and to a regulator where you live.

To make a request, email contact@nearroots.com from your account email. We may ask you to confirm your identity. We will reply within 30 days. If we need more time, we will tell you why. If we refuse a request, we will explain why and how to appeal.

14. Regional information

United States. Depending on your state, you may have rights to confirm, access, correct, delete or get a portable copy of your information, and to appeal our decision on a request. We honor these rights for all US members. To appeal, reply to our decision email with "Appeal." If you are not satisfied with the appeal, you may contact your state Attorney General. We don't sell personal information or use it for targeted advertising or profiling.

Canada. We handle personal information in line with PIPEDA. You can ask us questions or complain at the contact above. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Quebec. Our person in charge of personal information is named in section 1. Your information may be communicated outside Quebec, to the providers and countries in section 8. You can withdraw consent, ask us to stop disseminating your information, and complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Australia. We aim to handle personal information in line with the Australian Privacy Principles. Your information is disclosed to the overseas providers listed in section 8, mainly in the United States. You can ask for access or correction, and complain to us first. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

15. Age

NearRoots is only for people 18 and older. If we learn that someone under 18 has an account, we will close it and delete their information.

16. Security

Access to information is limited by rules enforced in our database. Connections are encrypted, administrator access requires two-step login, and administrator actions are logged. No service can be perfectly secure. If a breach affects your information, we will notify you and the relevant regulators as the law requires.

17. Changes to this policy

If we change this policy in an important way, we will tell members in the app or by email before the change takes effect.

18. Contact

BridgeWell Strategies LLC · contact@nearroots.com · mailing address available on request at contact@nearroots.com