Privacy Policy

We only collect information that you actively choose to give us. Specifically:

• Contact details— your name and email address when you subscribe to updates, register for an event, apply as a volunteer or mentor, download a publication, or submit a “Join the Movement” form.
• Account information — if you create a member account: your name, email, a username, and any optional profile details you add (title, organization, short bio, photo, skills, and social links). Passwords are stored only as a securely hashed value — never in plain text, and never visible to us.
• Event registration details — answers to any questions an event organizer asks on its registration or application form. For volunteer and mentor applications this usually includes a contact number, your availability, and relevant experience, and for on-site volunteer roles an emergency contact. These answers are visible to the organizers of that event.
• Content you upload — images or files you submit through your account or an admin role.
• Basic technical data — your IP address is used for security only: rate-limiting and spam prevention, where it is held briefly in memory and not written to the database. Separately, if you take an administrative action on the platform, that action is recorded in an audit log along with your account and IP address, and those entries are retained for accountability. We do not use third-party advertising or analytics trackers.

We use the information you provide only to:

• send you the updates, event details, and publications you asked for;
• manage your event registrations, applications, and member account;
• send account emails you have asked for or that are needed to keep your account secure — confirming your email address when you register, and password reset links when you request one;
• respond to your enquiries and follow up on submissions;
• keep the platform secure and prevent abuse or spam.

We do not use your information for automated decision-making, profiling, or targeted advertising.

We use a single essential cookie to keep you signed in to your account. It expires after seven days, or immediately when you sign out. It is not used for tracking or advertising, and because it is strictly necessary for the site to function, no consent banner is required for it. We do not set third-party marketing or analytics cookies.

When you verify your email address or reset your password, we store a single-use, time-limited token so the link in that email can be checked. Only a hashed form of the token is kept, and it is discarded once used or expired.

We do not sell or rent your personal information to anyone. We share it only where necessary to operate the platform:

• Service providers — our hosting and email-delivery providers process data on our behalf, under agreements that limit their use of it to providing those services.
• Public profiles — if you choose to make your member or contributor profile public, the details you mark as public (such as your name, photo, and bio) will be visible on the site. This is optional and under your control.
• Legal requirements — we may disclose information if required by law or to protect the rights and safety of our community.

We keep your information only as long as needed for the purpose it was collected — for as long as you remain subscribed, hold an account, or while it is relevant to an event you took part in. When it is no longer needed, or when you ask us to remove it, we delete it.

Two things outlast a deleted account, and we would rather say so plainly. Content published on the site that you created in an administrative role — an article, an event, an uploaded image — stays published, with its authorship transferred to another team member. And audit log entries recording administrative actions are kept for security and accountability. If you want published content removed as well, ask us and we will take it down.

All traffic to this site is encrypted in transit using HTTPS. Passwords are stored using strong one-way hashing. Access to personal information is restricted to authorized team members through a role-based permission system, and administrative actions are logged. While no online service can guarantee absolute security, we take reasonable technical and organizational measures to protect your data.

You can, at any time:

• ask what personal information we hold about you;
• ask us to correct or update it;
• ask us to delete it;
• unsubscribe from our emails using the link in any message, or by contacting us directly.

To exercise any of these, email us at info@millionxbangladesh.org. We will respond within a reasonable time.

Our programs welcome young learners, and some participants may be minors. Where a participant is a child, we ask that a parent, guardian, or supervising institution provide and manage their information. We do not knowingly collect personal information directly from children without such involvement. If you believe a child has provided us information without appropriate consent, contact us and we will remove it.

We may update this policy from time to time as our programs and practices evolve. Significant changes will be communicated through our usual channels.

If you have any questions about this policy or how we handle your information, reach us at info@millionxbangladesh.org or through our contact page.