Version 2026-10-20 · October 20, 2026
Al-Ihsan operates IhsanBaraka. Hanna Meyer is privacy lead; contact finances@ihsan.ca.
Feedback you send
We store your account ID, category, feature, description, optional steps, severity, submission reference, creation/expiry time, status and revision. You and assigned reviewers can read reports. Database operators are a separate privileged boundary. Use examples without private financial, learner, donor or staff details. No screenshots, attachments or page contents are automatically included.
Optional account-linked usage
Collection is off until you explicitly opt in. The separate checkbox is initially unchecked; required Terms acceptance and Privacy acknowledgement do not opt you in. We count fixed features, broad response outcomes and duration ranges by staff account and day. These are personal, account-linked records, not anonymous statistics. No form text, payment details, names/emails, URLs/query strings, raw errors, tokens, screenshots, replay, keystrokes, browser history or fingerprinting is added to diagnostics.
Withdraw in Usage & feedback to stop future counts immediately after saving. Core bookkeeping and feedback remain available. Necessary authentication/security processing remains separate. Existing choices without evidence of this explicit consent do not enable collection. Limits remain 5,000 counts/account/day (500 in isolated QA) and bounded storage.
Exactly 180 days
Each new feedback report and diagnostic count bucket expires exactly 180 days after creation. A later count or status change does not extend expiry. Daily aggregation means later events in a bucket share its original expiry. Expired reports/counts are excluded from app reads; the existing daily operations job removes expired rows in bounded batches, with backlog/failure recorded for operations review. Existing legacy diagnostic buckets lack event timestamps: expiry is conservatively calculated from the start of their recorded day in UTC, retaining them no longer than 180 days after collection.
Feedback text is deleted by cleanup. A minimal account/submission-ID receipt remains to prevent an old retry recreating removed content; it contains no text or content hash and follows the separate necessary security-record review. Versioned acceptance and consent/security audits, bookkeeping/enrollment records and recording access rules have separate schedules.
Records live in the hosted Neon database and protected backups processed by Render/Neon and the approved Google Drive recovery arrangement. The app sends no optional diagnostics to an analytics, advertising or AI provider. Automated backups keep 35 daily copies; the existing verified recovery copy is preserved separately. Backups, exports and provider technical logs do not disappear on the live database's 180-day expiry. Isolated restoration must rerun expiry cleanup before returning to service.
Browser and access
Necessary session and CSRF cookies support sign-in and request protection; optional collection adds no tracking cookie or browser storage. The feedback panel keeps an unsent draft only in the current page. Closing/reloading can lose it. Public Privacy notice, Use terms and request instructions remain available before login. You may request access, correction or retention review at the privacy address.
Usage & feedback settings