Privacy Policy

Last updated July 26, 2026

Rooted Forward (“Rooted Forward,” “we,” “us” or “our”) is a nonprofit organization in Chicago, Illinois. We operate the website at rooted-forward.org and the Walk Hyde Park application for iPhone and iPad. This Privacy Policy describes the personal information we collect, how we use and disclose it, how long we retain it, and the rights and choices available to you.

The Walk Hyde Park application collects no personal information of any kind. It contains no account, no sign-in, no analytics and no tracking technology. The provisions below concerning accounts, stored records and disclosure apply to the website only.

1. Scope of This Policy

This Privacy Policy applies to the Rooted Forward website at rooted-forward.org and to the Walk Hyde Park application for iPhone and iPad, which we refer to together as the Services.

It does not apply to any third-party website, application or service that we link to. Those are governed by their own policies, and we describe them further in Section 10.

By using the Services you agree to this Privacy Policy. If you do not agree with it, please do not use the Services.

2. Information We Collect

2.1 Information You Provide to Us

You can read every page of the website, including the full text of the walking tour and the research archive, without an account and without providing any information about yourself. We collect the following only when you choose to give it.

Account information: Your name, your email address and a password, provided when you register an account on the website. Passwords are hashed by our authentication provider and are never stored or visible to us in readable form.
Google account information: If you register using Google, Google provides us with your name and email address in order to create the account. We receive nothing else from Google.
Content you submit: Comments, policy campaign signatures, proposal submissions and any other material you post through the website, together with the account that posted it.
Correspondence: Your email address and the contents of your message when you write to us. The website has no contact form, so this reaches us only as ordinary email.

2.2 Information We Collect Automatically

Authentication cookie: A single cookie that keeps you signed in as you move between pages. It is set only while you are signed in, and it is the only cookie the website places on your device. We use no advertising, analytics or third-party cookies.
Server log data: Our hosting provider records ordinary web server logs, including your IP address, the pages requested, the date and time, and your browser type. These are generated by the act of serving a web page and are used to operate the site and to prevent abuse.
Research archive activity: When you download a file from the research archive we record which file was requested, when, and by which account. We use this to understand how the archive is used and to detect scraping.

2.3 Information Collected Through the Mobile Application

None. The Walk Hyde Park application collects no personal information of any kind.

The entire tour, including every stop, photograph and audio file, is contained in the application when you install it, so it operates offline. The application contains no account system, no sign-in screen, no registration, no analytics library, no crash-reporting library, no advertising identifier and no tracking technology.

Two categories of information exist while you use the application, and both remain on your device. Neither is transmitted to us or to any other party.

Tour progress: Which stops you have completed and where you stopped, stored locally so that the walk resumes where you left it. Removing the application removes it.
Device location: If you grant permission, your location is used on the device to display your position on the tour map and to indicate when you are near a stop. It is processed entirely on the device and is never transmitted. Section 7.4 describes the permission and how to withdraw it.

2.4 Information We Do Not Collect

We do not collect payment information, government identifiers, biometric information, health information, precise location on our servers, or any special category of personal data. We do not purchase personal information from data brokers.

3. How We Use Information

Because the application collects nothing, this section concerns the website only. We use the information described in Section 2 for the following purposes.

To create your account, authenticate you, and keep you signed in.
To display your comments, submissions and campaign signatures where you posted them, attributed to your account.
To respond to your correspondence and to provide support.
To understand which research datasets are used and to prevent bulk scraping of the archive.
To operate, maintain and secure the Services, and to detect and prevent fraud, abuse and technical problems.
To comply with applicable law and to enforce our terms.

We do not use your information for advertising, we do not build advertising or behavioral profiles, and we do not use anything you provide to train machine learning models, whether our own or a third party's.

4. How We Disclose Information

4.1 Service Providers

We disclose information to a small number of service providers that process it on our behalf, on our instructions, and under contractual confidentiality and security obligations. They are not permitted to use it for their own purposes.

Supabase: Database and authentication provider. Holds accounts, authentication records, comments, campaign signatures, submissions and research download records.
Vercel: Hosting provider for the website. Generates and retains the server logs described in Section 2.2.
Google: Identity provider, and only if you choose to register or sign in using Google. Google provides your name and email address to us for that purpose.
Apple: Distributes the application through the App Store and provides us with anonymous, aggregate download statistics through its own dashboard. Apple does not identify you to us, and the application transmits nothing to Apple on our behalf.

4.2 Legal and Safety Disclosures

We may disclose information if we are required to do so by law, subpoena or other legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of Rooted Forward, our users or the public. Where we are legally permitted to notify you of such a request, we will.

4.3 Business Transfers

Rooted Forward is a nonprofit and is not for sale. If it were ever to merge with or transfer its programs to another organization, we would notify you before any personal information became subject to a different privacy policy, and you would have the opportunity to delete your account first.

4.4 No Sale or Sharing of Personal Information

We do not sell personal information, we do not rent or trade it, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. We have never done so.

5. Data Retention

We retain personal information only for as long as it serves the purposes described in Section 3, after which it is deleted.

Account information: Retained until you delete your account. Deletion is described in Section 7.2.
Content you submit: Retained until you delete it or delete your account, which removes it.
Research archive activity: Retained for two years, then deleted.
Server log data: Retained by our hosting provider for approximately thirty days.
Application data: Never held by us at all. Tour progress and location remain on your device and are removed when you remove the application.

6. How We Secure Information

All traffic to and from the Services is encrypted in transit using HTTPS. Passwords are hashed by our authentication provider using industry-standard algorithms and are never stored or seen by us in readable form. Access to the production database is limited to the individuals who administer the organization. The application stores no credentials of any kind.

No method of transmission or storage is completely secure, and we do not claim otherwise. In the event of a data breach affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.

7. Your Privacy Rights and Choices

7.1 Rights Available to You

Depending on where you live, you may have some or all of the rights below under applicable law. As a matter of policy we extend all of them to every user regardless of location.

The right to know what personal information we hold about you and how we use and disclose it.
The right to access a copy of that information in a portable format.
The right to correct information that is inaccurate.
The right to delete your personal information.
The right to withdraw consent you previously gave, at any time.
The right to opt out of the sale or sharing of personal information, which we note we do not do.
The right not to receive discriminatory treatment for exercising any of these rights.

7.2 Exercising Your Rights

To exercise any right above, email contact@rooted-forward.org from the address associated with your account. We will respond within thirty days and we do not charge a fee. We may ask you to confirm your identity before acting on a request, in order to protect your account. An authorized agent may submit a request on your behalf with written proof of authorization.

To delete your account, email contact@rooted-forward.org from the address on the account. Deletion is permanent and takes effect within seven days. It removes your profile, your authentication record, your comments, your submissions and your campaign signatures. It cannot be reversed, and we are unable to restore an account once it has been deleted.

The application has no account and no sign-in, so there is nothing in it to delete. Removing the application from your device removes everything it held.

7.3 Cookies

The only cookie we set is the authentication cookie described in Section 2.2. Because it is strictly necessary to keep you signed in, there is no consent banner and nothing to opt out of. If you sign out or clear your browser's cookies, it is removed. We use no advertising, analytics or third-party cookies, so there is no cross-site tracking to disable.

7.4 Location Permission in the Application

The application requests location access once, when you tap Find me on the tour map, and it requests access only while the application is in use. It never requests background location. If you decline, every part of the tour continues to work.

You may withdraw the permission at any time by opening the iOS Settings application and selecting Privacy and Security, then Location Services, then Walk Hyde Park. Because your location is processed on your device and is never transmitted, withdrawing permission leaves nothing behind on our side to delete.

8. Children's Privacy

The Services are intended for a general audience, including students, and the walking tour is written to be used by secondary school classes. We do not knowingly collect personal information from children under 13 years of age. No account is required to read, listen to or walk any part of the Services, so a child may use all of it without providing anything to us.

If you believe that a child under 13 has provided us with personal information, please email contact@rooted-forward.org and we will delete it promptly.

9. International Users and Data Transfers

Rooted Forward is based in Chicago, Illinois, in the United States, and our service providers store data in the United States. If you access the Services from outside the United States, your information is transferred to and processed in the United States, where data protection law may differ from that of your country.

Where we transfer personal data from the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses as incorporated into our agreements with our service providers.

10. Third-Party Links and Services

The Services link to external websites, including archives, libraries, newspapers and the sources cited on every tour stop. We do not control those sites and this Privacy Policy does not apply to them. We encourage you to read the privacy policy of any site you visit.

Tapping Directions in the application opens your device's own maps application. What that application does with the request is governed by its own privacy policy and by your device settings.

11. Jurisdiction-Specific Disclosures

11.1 California Residents

Under the California Consumer Privacy Act, as amended, California residents are entitled to the disclosures in this section and to the rights listed in Section 7. In the twelve months preceding the date of this policy, we collected the categories of personal information marked below. We disclosed the marked categories to the service providers listed in Section 4.1 for the business purposes described in Section 3. We sold no personal information and shared none for cross-context behavioral advertising.

Category	Examples	Collected
A. Identifiers	Real name, email address, IP address, account identifier	Yes, website only
B. Categories in Cal. Civ. Code 1798.80(e)	Name and email address	Yes, website only
C. Protected classification characteristics	Race, age, sex, national origin, disability	No
D. Commercial information	Records of products or services purchased	No
E. Biometric information	Fingerprints, faceprints, voiceprints	No
F. Internet or other network activity	Pages requested, research files downloaded, server logs	Yes, website only
G. Geolocation data	Physical location or movements	No. Processed on your device and never transmitted
H. Sensory data	Audio, electronic, visual or similar information	No
I. Professional or employment information	Job history, performance evaluations	No
J. Non-public education information	Student records under FERPA	No
K. Inferences drawn from other personal information	Profiles reflecting preferences or behavior	No

11.2 EEA and United Kingdom Residents

Rooted Forward is the controller of the personal data described in this policy. We rely on the following legal bases under the General Data Protection Regulation and the UK GDPR.

Consent: Creating an account, posting content, and granting location permission. You may withdraw consent at any time, as described in Section 7.
Legitimate interests: Operating and securing the Services, preventing abuse of the research archive, and responding to correspondence. We have assessed that these interests are not overridden by your rights.
Legal obligation: Retaining or disclosing information where the law requires it.

You have the right to lodge a complaint with your local supervisory authority. In the United Kingdom this is the Information Commissioner's Office. We would appreciate the chance to address your concern first, at contact@rooted-forward.org.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page. If a change materially affects what we collect or how we use it, we will state that plainly at the top of this page rather than rely on you to notice the new date.

Your continued use of the Services after a revision takes effect constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise a right described in Section 7, or believe we hold information about you that should be corrected or removed, please contact us. A person reads every message.

Rooted Forward

Chicago, Illinois, United States

contact@rooted-forward.org

This Privacy Policy is effective as of July 26, 2026 and supersedes all prior versions.