The BeaconPrivacy policy
Private by default.
The Beacon exists to make sponsorship matching safer and easier. We keep the data model narrow and the sharing surface intentional.
What we collect
To facilitate meaningful sponsorship pairings, we collect specific data points during the intake process. This is limited to:
- Identity: Name, phone number, optional email address, and role (Sponsor or Sponsee).
- Matching: Life-experience tags, communication styles, and lane of recovery.
- Operational: Sponsor capacity, referral codes, and short profile notes.
How we use it
We use this information to calculate match recommendations, create connection requests, and let leaders review sponsor capacity and request status. We do not use this data for marketing or external tracking.
The Match Core
"Data is strictly used to ensure recovery participants find the right support at the right time."
What we avoid
The Beacon is not designed to store sensitive medical or pastoral records. We explicitly avoid:
Detailed Testimony
We don't need the full depth of your story stored in the database.
Medical History
No clinical notes or medical diagnoses are recorded here.
Encryption & Security
We employ modern zero-knowledge architectures to ensure that your sensitive recovery details are kept safe from database dumps, host compromises, or unauthorized eyes:
Zero-Knowledge Profile Storage
Your profile fields (including email, name, recovery tags, and cadence) are encrypted directly in the browser using AES-256-GCM symmetric encryption keys (DEKs) before they touch our database. The server stores only raw ciphertexts. Keys are cryptographically wrapped using your unique public key (RSA-OAEP-4096-SHA256) and are only decrypted locally on your device when you authenticate.
Encrypted Messaging and Recovery
Messages in participant threads are encrypted on participants’ devices. The server stores encrypted messages and encrypted keys. When account recovery is enabled, an unlocked participant’s app also encrypts conversation keys for restricted platform recovery. Authorized global administrators with the recovery key can restore access during audited account recovery; these keys can also decrypt covered conversations. Older conversations need an unlocked participant to add recovery coverage.
Offline Platform Recovery
To assist with lost keypairs and network admin recovery, the platform maintains a restricted offline recovery key. The platform recovery private key remains encrypted with an offline passphrase and is never decrypted on the host server. Recovery actions are highly restricted, heavily audited, and designed to preserve the privacy of all matching data.
Who can see it
Visibility is restricted based on operational necessity:
-
Network Leaders
Leaders operating the tool can view submitted profiles and requests within their local network to facilitate matches.
-
Prospective Partners
Contact details are only ever revealed when a real sponsor introduction is requested and accepted.
Feedback and support
Feature requests and bug reports are reviewed before publication. Accepted requests are public; requests awaiting review are available to their author and the Beacon team. When you use signed-in feedback or support, we connect your submission to your Beacon account identifier.
Support conversations are private to you and the Beacon support team and are stored in our Suggestion Box service and its backups. They are not end-to-end encrypted like Beacon recovery profiles. Please leave out sensitive recovery information. Website chat stores a private visitor token in your browser for up to 30 days so you can resume the conversation. “End this chat” revokes that browser access; it does not delete the conversation. Contact support to ask about removal.
Retention
Data remains in the system until an admin clears it or the ministry decides on a longer-term retention policy. Because The Beacon is in active development, these practices may be refined to further limit storage duration over time.