← Back

What We Keep

Our privacy practice, in plain language.

Privacy means very little if it exists only as a promise.

So this page is meant to say, plainly, what we actually keep, why we keep it, how long we keep it, and what happens when it is no longer needed.

Our guiding principle is simple:
keep only what is needed to do the work.

If something can be used and discarded instead of stored, we discard it. If something must remain, it is named here.

Removing yourself

You may ask to leave the fellowship and have your information removed.

That request is handled by a steward rather than an automated form because something this final should involve a person.

When your removal is completed, we remove:

• your membership;
• your name and correspondence address;
• the records you created;
• every earlier build of those records;
• finished and unfinished answers;
• emblems and uploaded image files;
• your portrait, if you added one;
• your activity history here; and
• your affirmation record, including the network address and browser information recorded with it.

There are a few things that cannot disappear immediately, and it would be misleading not to say so.

Contribution records remain as an accounting record, but your name and correspondence address are removed from them. What remains is limited to the amount, the rail used, the standing of the contribution, and the relevant dates.

The ledger of marks also remains. It contains no person's name, document title, or document content.

Existing backups remain until they naturally age out.

And correspondence already delivered through email is beyond our ability to retrieve from the systems that received it.

Anything removed from the live system cannot be restored.

There is no hidden archive, recovery folder, or steward override.

When you join

When you join, we record the name and correspondence address you provide.

Your password is stored only as a one-way hash. That means nobody here can recover or read your password. If you forget it, it must be replaced.

If you later add a portrait in your settings, it is cropped square and saved again as a plain image, so nothing your camera recorded — including where the photo was taken — is kept. Only you can see it, and you can remove it at any time.

We also record your affirmation of the two covenants: which covenants you affirmed, when you affirmed them, the network address from which the affirmation was made, and the browser's self-description — commonly called its user-agent string.

Those details are kept as part of the affirmation record because they help establish the circumstances in which the affirmation was made.

The affirmation record is the only place where a network address is deliberately retained as part of a permanent member record.

When you prepare a record

While you are working, a draft stores the answers you enter.

That is what allows your work to survive a closed browser, an interrupted evening, or a return another day.

Those answers may include deeply private things: names, property, family relationships, beneficiaries, and other matters you choose to place into your records.

An unfinished draft remains for thirty days from the day it was begun.

Its date is shown beside it.

We write to you seven days before its answers are cleared.

From the same screen, you may extend that period or discard the draft entirely. Discarding it removes its answers immediately.

Once you submit the draft, those answers become part of the completed record and follow the retention schedule for completed records instead.

When a record is finished

A completed record consists of two things:
the document itself, and the answers used to create it.

Both are removed thirty days after the record is made.

We write to you seven days before that happens.

If you need more time, you may extend the retention period from the record's own page, up to the limit provided there. The extension has a limit because indefinite storage would contradict the privacy practice described on this page.

When the retention period ends, the built document is deleted from the server and the underlying answers are emptied.

A small shell of the record remains so your history can still show that something was created and when. That shell contains only basic information such as the title, relevant dates, and page count.

Two additional values are kept permanently:
the record's mark and the fingerprint of the finished document.

They are retained so that a copy you printed or saved years earlier can still be checked against the association's record of what was originally created.

Those values do not contain your name or the contents of the document. They are identifiers derived from the record, not copies of the record itself.

You may also remove a record yourself at any time.

That removal is immediate and final.

The finished document, earlier builds, answers, and associated draft are removed together. There is no recycle bin and no archive from which a steward can recover them.

Once a record has been removed, we cannot rebuild it for you.

What we see when you visit

We keep a short activity record for a small number of member events, including:

• applying;
• signing in;
• a failed sign-in attempt;
• creating a record; and
• downloading a record.

Each event records the date, the country from which it occurred, and the membership it belongs to when a membership is known.

For a failed sign-in, where there may be no authenticated membership yet, the attempted email address may be recorded instead.

The country is determined locally on our own server using a lookup file stored here.

Your network address is used momentarily to determine the country and is not retained as part of the activity event. No outside service is asked to identify your location.

These activity events are erased after thirty days.

There is one exception.

A steward may deliberately place a particular membership under closer review. When that happens, activity events for that membership may be retained beyond thirty days until the review is lifted.

This exists so unusual patterns or unusually heavy use can be examined when necessary.

The decision is made by a person and the date the review began is recorded.

Contributions

When you make a contribution, we record the name and correspondence address you provided, the amount or value received, the rail used, and the date a steward affirmed it.

If a contribution arrives through a public ledger, the relevant addresses and transaction reference are also recorded as part of that contribution record.

Contribution records are retained.

They form part of the account between you and the fellowship, and an account that cannot later be reconciled is not much of an account.

If you later ask to be removed, the identifying information described above is removed from those records while the accounting history remains.

What we do not do

We do not use:

• advertising networks;
• tracking pixels;
• behavioral trackers;
• analytics services; or
• third-party scripts for observing visitors.

Even the typefaces used on this site are served from our own server.

Reading these pages therefore does not require your browser to contact a separate company simply to display them.

Messages sent through the inquiry form are delivered as correspondence and are not stored in a site database.

There is no separate table of inquiry names and messages waiting to be managed or purged later.

Nothing about the records you download is tied to a stored network address.

Email is delivered through the association's mail provider, which necessarily handles the messages it sends on our behalf.

Technical logs

The application keeps a technical log of its own operation.

Its purpose is to help identify faults, diagnose failed operations, and keep the system working properly.

Those logs are rotated daily and removed after thirty days.

Some entries contain an internal membership number where knowing which membership encountered an operation is necessary to understand what happened. They do not need a person's name, email address, or network address to serve that purpose, and those details are not intentionally written to the technical log.

The one exception is the stewards' own sign-in screen. Attempts there are logged with the email address and network address used, because protecting the stewards' accounts protects everything else held here.

A technical fault can usually be understood without recording more about the person who encountered it than the fault itself requires.

Backups

A backup of the system is made once each day.

We retain the seven most recent backups.

When a new backup is created, the oldest of those seven is destroyed.

That means nothing remains in backup storage for longer than seven days.

A backup is simply a snapshot of the system at the moment it was taken. Because of that, something you remove today may still exist inside a backup created before the removal.

This is the one place where deletion is not instantaneous.

Removal affects the live system immediately. Any remaining backup copy disappears as those backups cycle out, within seven days.

After that, it is gone from both.

Asking us

If you would like to know what we hold about you, or you would like to ask for your information to be removed, write to us through the inquiries page.

Last checked against the running system on 20 September 2026.