Trust and policy disclosure
What the current build protects, and what an approved privacy notice still needs.
The current architecture separates public content from private configuration, protected records, sessions, logs, and uploads. Sensitive donor, member, recipient, and support data must not become public evidence.
This is not a jurisdictional privacy policy. Controller contact, purposes, retention schedules, request handling, effective date, and qualified legal review remain pending.
This page records current strict non-production behavior. It is not an approved production policy, certification, legal opinion, or owner acceptance.
Private configuration and protected records stay outside the public document root. Public evidence must exclude secrets, personal data, identity documents, donor identity, and care-sensitive content.
Implementation rules require purpose-limited collection, nearby form notices, explicit visibility choices, least privilege, safe audit metadata, and no consent inferred from silence.
The owner and qualified advisors must approve controller contact, jurisdictional scope, purposes, lawful bases where applicable, retention, access and deletion workflow, version, and effective date.