The Direct Action Village logo, which is a raised solidarity fist with a star on the wrist.
Direct Action Village
About
Capital Area Commons
New Trajectories
Village Fund
Resources
Contact
Data Policy

Data Policy

Last updated August 19, 2026

This is a description of what data our website and forms collect, who sees that data, and what eventually happens to that data. We don't have any lawyers, so this isn't a legal privacy policy. If something looks wrong, tell us and we'll try to fix it!

Our website

Our website doesn't run any JavaScript and doesn't create or store any cookies. Verify this yourself with right-click + Inspect or with uBlock Origin.

Our mailing list

We only collect a name and an email address. Any name will do; it doesn't have to be your real legal name. Any email address will do, but we prefer a relatively anonymized address (ideally not firstname.lastname@provider.com) and that you use a privacy-respecting provider like Tuta, RiseUp, or Proton. If all you have is firstname.lastname@gmail.com, we'll still work with it and do our best to protect you, just be aware that some things will be out of our control at that point (like data leakage to your provider). We also don't store the IP address you signed up from. We don't even write any access logs, so your IP address can't be logged or stored anywhere on our side. Our newsletter emails have no tracking, so we don't log opens, clicks, tracking pixels, etc.

Grant applications

The questions about your project proposal are required. Everything about you is optional: name, email, phone, and Signal username. You can even apply with no contact details at all (we just won't be able to tell you if you win)! Grant applications are, by default, deleted 7 days after we announce that cycle's decisions (this can happen sooner if you ask).

Where your data lives

Everything is stored (at-rest) on servers we own and manage (on-prem, not a cloud service). The disks are encrypted, so they're unreadable if someone walks off with them. The mailing list and the grant applications live in separate databases (the part that sends the newsletter can't read applications). Our backups are on our own machines too! That means a copy of your records sits in a backup for a while until that backup gets refreshed (yes, even if you request data deletion, we're being honest that data deletion won't happen instantly). For recovery purposes, we retain daily backups for 14 days and weekly backups for 28 days, so the maximum amount of time between deletion request and your data truly being 100% gone from our machines for good is 28 days.

Who sees your data

We fully local-host and send out our own newsletter! We don't use any company or third-party service to deliver or route the mail. Only one machine in the server stack isn't strictly owned by us (it's a server we rent in a non-USA country that respects GDPR). That rented server:

Leaving, unsubscribing, and data deletion

Every newsletter has a one-click unsubscribe link. That same link opens a page where you can see what we hold, download it, and delete it yourself (without needing to ask anyone). If you would rather talk to a person, email us at directactionvillage@proton.me. As mentioned above, grant applications are deleted 7 days after we announce that cycle's decisions by default, but can be deleted sooner upon request.

Stuff we can and can't prove to you

Our code is public and you can read it on our GitHub, but realistically you won't be able to check that the published code is the same code actually running on our machines. Nobody who hosts centralized online services for you can prove that! We're asking you to trust us, but also being honest that nothing we've said above or shown you is a guarantee. At the end of the day, you still need to make your own privacy and safety decisions with your own data.