01Who we are
Heart Has No Limit Foundation, Inc. ("HHNL Foundation," "we," "us") is a Louisiana nonprofit corporation and a 501(c)(3) tax-exempt organization. We create free youth mindset curriculum, including our Optimism Training program, and deliver it through schools, clubs, teams and other youth organizations. This policy explains what information we collect through hearthasnolimitfoundation.com and our curriculum, surveys and related services (the "Services"), how we use it, and your choices.
02What this policy does not cover
HHNL Clothing (Heart Has No Limit, LLC) and the No Limit app are separate companies. They are not part of the Foundation and have their own privacy policies. We do not share participants', notify-list sign-ups' or donors' personal information with them. If you sign up for their emails or buy from them, you're on their lists under their own privacy policies, separate from ours. If we ever learn that information was shared with them by mistake, we will have it removed from their records, fix what caused it, and notify you if the law requires it.
03Information we collect
From everyone who visits the site (collected automatically): technical information such as IP address, browser and device type, pages visited, and the date and time of the visit. Our website host, Railway, receives this to deliver the site and keep it secure. Some parts of the site, such as our fonts and site code, load from outside services (unpkg.com and Google Fonts), which receive your IP address and browser information when the page loads.
From organizations: the contact's name and email, the organization's name and type, the grade level and number of students, and the group label you choose.
From organization facilitators: name, email and organization, so we can give you access to your group's materials and codes.
From students (participants): an access code, age, grade, state, and answers to the starting and ending surveys. The surveys also ask general demographic questions: gender, race or ethnicity, and type of community. The surveys don't ask for a parent or guardian's email. Students are never asked for their name. Survey answers are stored under the access code, not under the student's name.
From parents and guardians: answers to an optional observer survey about the child, which uses the child's access code, never a name. Participating organizations agree to collect and keep parent consent forms (Section 5).
From adults 18 and older using the curriculum for themselves: the same survey answers as students (the surveys don't ask for a name, email or phone).
From parents, guardians and adults who ask to be notified: an email address and/or phone number and the date you signed up, used only to tell you when the at-home version opens. We delete it after we send that notice, and in any case within 12 months of signing up, or sooner if you ask.
From children under 18 who ask us to tell a parent: only the parent or guardian's email address and/or phone number that the child types in. We don't ask for the child's name or the child's own contact information. We use it only to let that parent or guardian know when the at-home version opens. We never text that number unless the parent or guardian signs up themselves, and we delete it within 12 months, or sooner if asked.
From people who suggest an organization: the organization's name and city, the contact details you give us for its contact person, the size and type of the group, your name and, if you give it, your email. We use it only to reach out to that organization and let them know who suggested them. Suggestions we don't act on are deleted within 12 months.
From donors: donations are processed by WeGive and its payment processors. We receive your name, contact information and donation details so we can send tax receipts. We never receive or store full card numbers. WeGive's checkout uses its own cookies and tools, including Meta's advertising pixel, under WeGive's privacy policy. Donation pages are meant for adults.
When you contact us: your first and last name, email, phone number, organization, what you're interested in, and your message.
04How we use information
- To provide the curriculum, access codes and surveys
- To confirm, when needed, that a participating organization has the required permission
- To contact parents, facilitators and organizations about the program, including emails and texts sent by a staff member (Section 10)
- To send a one-time notice when the at-home version opens (email or text)
- To evaluate and improve the curriculum
- To report results to funders, research partners and the public, using only combined results
- To process donations and send tax receipts
- To keep the Services secure and follow the law
We do not sell personal information. We do not use children's information for advertising, we do not build profiles of children, and we do not let third parties advertise to children through our Services.
05Children's privacy
This section applies to anyone under 18. We treat every participant 17 and under the same way, whether or not a law requires it for their age.
- Age check. Before entering the curriculum section, visitors are asked their age. Students under 18 should take part using an access code from their school, club or team.
- Through a school. A school may authorize its students' use of the curriculum for educational purposes, in place of individual parent consent, as federal law allows. Information collected this way is used only for that educational purpose, under the school's direction.
- Through a club, team or other organization. These organizations agree to sign a Curriculum License Agreement with us and to handle parent or guardian permission (or school authorization), using our Parent Notice & Consent form, before a participant uses the curriculum or takes a survey, and to keep those forms and give us copies on request.
- Minimal collection. We collect only what the program needs. We never ask a minor for a full name, home address, photo or school ID.
- Technology on curriculum pages. The curriculum pages have no advertising trackers or analytics tools. Our website host (Railway), our survey provider (Tally), Google Fonts, unpkg.com and YouTube receive technical information such as IP address and browser type when the pages load. It is used only to run and secure the site, never for advertising or to build a profile of a child. A student's progress through the program is saved in their own browser on that device. Curriculum videos play through YouTube's privacy-enhanced mode, which may store data in your browser once a video plays.
- Parent rights. A parent or guardian can see the information we have about their child, have it deleted, or tell us to stop collecting it at any time by contacting us (Section 14). Families in an organization's program can also go through the organization.
- If we find a mistake. If we learn we collected information from a child without the required consent, we delete it.
06Coded data and research
Each participant gets a random access code from their organization. We don't ask students for their names. Survey answers are collected by Tally and copied into our own secured database on Railway. Answers are stored with the access code, and with any parent email entered, until we delete the whole record. Tally also keeps a copy until we delete it there. The organization running the program may keep its own list of which student has which code; we don't receive it.
"Combined" (aggregate) means results are reported for groups, not individuals. We never report results for a group of fewer than 5 participants.
We use this data to measure whether the curriculum works, improve it, report to funders and share combined results publicly. We never publish codes or contact details, or information about an individual participant. Research partners (Section 7) may receive coded answers only under a written agreement and IRB review.
07Who we share information with, and why
We share information only with the service providers below, only as needed to provide the Services, and they may not use it for anything else.
| Who | Why |
|---|---|
| Google (Workspace, Fonts) | Our email, and the fonts on our site |
| unpkg.com | Delivers part of our site's code |
| Railway | Hosts our website and our program database (organization sign-ups, access codes, coded survey answers and the at-home notify list) |
| Microsoft Clarity | Shows how visitors use our general pages for adults, with all text hidden. Never used on the student program pages |
| Tally | Runs our surveys and contact form |
| YouTube (privacy-enhanced mode) | Plays our curriculum videos |
| WeGive and its payment processors | Processes donations and sends receipts |
| University research partners (planned: Louisiana State University, once a research agreement is signed) | Evaluates the curriculum using coded answers, only under a written agreement and IRB review |
| Partner organizations | Receive their own participants' access codes so they can run the program. Coaches and facilitators see combined results only, never an individual's answers. |
Partner organizations are independent. They run the program at their own sites and handle any information they collect, including signed consent forms, under their own policies and our license agreement.
We may also share information when the law requires it, or to protect the safety of a child or someone else. We do not sell, rent or trade personal information.
08Cookies, tracking and Do Not Track
On our general pages for adults (home, about, donate, contact and request access) we use Microsoft Clarity to see how visitors use the site, such as where people click, scroll or leave, so we can make it easier to use. Clarity hides all text on the page and everything typed into forms, and it uses its own cookies on those pages. We never put Clarity or any other analytics or advertising tool on the program pages students use (curriculum, get started, videos and surveys). The WeGive donation checkout is covered in Section 3. The embedded YouTube player and Tally forms may store data in your browser to work. Your browser also saves your progress through the program on your device. If someone answers that they are under 18, the browser remembers that answer for 24 hours so the age question can't simply be answered again. You can clear these at any time. We don't respond to browser "Do Not Track" signals because we don't track visitors across other websites. You can block or delete cookies in your browser, but some features may not work without them.
09Public posting
The Services don't let participants post public comments, photos or messages. Photos taken at in-person events are covered by the organization's agreement and a separate signed media release.
10Text messages
Other than one text to people who asked to be told when the at-home version opens, we don't send automated text messages. A member of our team may text a parent, guardian or facilitator by hand about the program. Message and data rates may apply. Reply STOP, or tell us, and we will stop texting you.
We never share your phone number or your permission to text with anyone, except service providers who handle it for us.
11How long we keep information
We keep children's personal information only as long as needed for the purpose it was collected, then delete it. We never keep it indefinitely.
| Information | Why we keep it | How long |
|---|---|---|
| Access codes, organization contacts, survey answers and any parent email entered on a survey (in our database) | To run and measure the program | Until 5 years after the participant finishes the program. Then we delete the whole record (sooner if a parent asks) |
| Copies of survey answers in Tally | Tally collects the surveys for us | Until we delete them in Tally, on the same schedule |
| Notify-list email or phone (at-home version) | To tell you when the at-home version opens | Deleted after we send that notice, and in any case within 12 months of signing up, or sooner if you ask |
| Combined results (group totals, with no codes or contact details) | To report results and improve the curriculum | Kept |
12How we protect information
Our program database is hosted on Railway. The admin area is password-protected, and access is limited to our team. Survey answers are stored under codes rather than names, and we require our service providers to protect the information they handle. No system is perfectly secure, and we can't guarantee absolute security.
If a security breach exposes your personal information, we will tell you as the law requires.
13Changes to this policy
If we change this policy, we'll post the new version here with a new effective date. If a change affects how we handle children's information, we'll get any new consent the law requires.
14Your choices and contact us
Anyone can ask to see, correct or delete their information, or to stop getting emails from us. Parents have the added rights in Section 5. Contact us below.
Heart Has No Limit Foundation, Inc. · Attention: Privacy · PO Box 54, Mandeville, LA 70470 · (985) 778-7102 · cole@hearthasnolimit.org