Privacy Policy

The Young People's Alliance (“YPA”, “we”) is a nonprofit membership organisation. This policy covers three things we operate: the Assembly members' website at assembly.youngpeoplesalliance.org, the Assembly app for iOS and Android, and the YPA Student Discounts browser extension.

The mobile app displays the same Assembly website inside a native wrapper. Anything described below for the website applies equally in the app, plus the app-only items called out under “The mobile app”.

Your account

Name, email address, and the campus or chapter you belong to. You may optionally add a phone number, a profile photo, and the states you have lived in. We record your role (member, chapter leader, coach, staff) because it determines what you can see.

Membership and payments

Paid memberships are processed by Stripe. Stripe handles your card details; we never see or store them. We keep your Stripe customer and subscription identifiers, your subscription status and renewal date, and the email address used for payment.

Data Reclaim

If you use Data Reclaim, you give us the details needed to identify your records at data brokers: your full name and any variants, date of birth, and current and previous addresses. We store the results of each scan, every removal request we file for you, and the brokers' replies. We also issue you a dedicated email address on a domain we control so brokers' confirmations can be matched back to you.

Community and campus activity

Posts, comments, likes, reports you file, the communities you join, events at your chapter and your attendance at them.

Discounts and referrals

Which discounts you click, feedback you leave on them, your referral code and the referrals attributed to it. If you request a referral payout we collect the Venmo handle you give us for that purpose.

Usage data

We use Google Analytics, the Meta pixel, the TikTok pixel and Vercel Analytics to understand how the product is used and how people find us. These collect pages viewed, actions taken, approximate location derived from IP address, and device and browser information, and they set cookies or equivalent identifiers.

Notifications

If you turn notifications on, we store a push token for that device along with the platform, a device description, the app version and your time zone, so we can send notifications and respect your quiet hours. You can switch each category off, or all of them, under Notifications in My Account. Turning notifications off in your device settings also stops them.

Face ID, Touch ID and fingerprint unlock

This is optional. If you enable it, your sign-in details are stored in your device's own secure hardware — the iOS Keychain or the Android Keystore — and released only when your device confirms your face or fingerprint. Those details never leave your device and are never sent to us. We do not receive, store or have any access to your biometric data; the check happens entirely on your device and we are only told whether it passed. Signing out or deleting your account removes the stored details.

To run your membership and give you access to member benefits; to file and track data broker removal requests on your behalf; to show you your chapter, community and events; to send you transactional email such as invitations, verification and payment problems; to send notifications you have asked for; and to understand and improve how the product is used.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Data brokers. This one is central to how Data Reclaim works and deserves to be explicit: to have your records removed, we must send brokers enough information to identify you — typically your name, date of birth and address history. That is the mechanism of the service, not an incidental disclosure. We send it only to brokers who hold or may hold a record of you, and only to ask them to delete it.

Service providers who process data on our behalf: Supabase (database and authentication), Stripe (payments), Resend and our own mail servers (email), Google Firebase (push notification delivery), Google Analytics, Meta, TikTok and Vercel (analytics and attribution), and DigitalOcean (hosting).

We may also disclose information where the law requires it, or to protect the safety of our members.

You can delete your account at any time from My Account, in the app or on the web. This permanently removes your profile, posts and comments, community memberships, referral history, notification settings, saved devices, and your Data Reclaim information including scan results and removal requests. If you have an active paid membership it is cancelled as part of the deletion.

Two honest limitations. Removal requests already sent to a data broker cannot be recalled — the request exists at the broker, and we simply stop tracking its progress for you. And we may retain limited records where we are legally required to, such as financial records of payments.

You can also email hannah@youngpeoplesalliance.org to ask us to delete your account for you.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, obtain a copy of it, and to not be discriminated against for exercising those rights. Members in California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws have these rights by statute. Email hannah@youngpeoplesalliance.org and we will respond within the time the applicable law allows.

Data is encrypted in transit. Access to member data is restricted by row-level security in our database, so members can reach their own records and not each other's. Payment card details are handled by Stripe and never reach our servers. No system is perfectly secure, and we will tell you promptly if a breach affects your information.

Assembly is intended for students and young adults. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will remove it.

The YPA Student Discounts extension checks whether the site you are visiting has a student discount and shows it to you. It reads the domain of the page you are on to make that check. It signs in with your Assembly account and stores your session locally in the browser.

It does not read page contents, form fields, passwords or payment details, and it does not track your browsing history or build a profile of the sites you visit.

We will update this page as the product changes, and update the date at the top. If a change materially affects how we handle your information, we will tell members directly.

Questions about this policy or your information: hannah@youngpeoplesalliance.org.