Privacy Policy

1. Scope and operator

ConexBoxes is operated by the Oregon Chinese Coalition, an Oregon nonprofit organization (the “Coalition,” “we,” “us,” or “our”). This policy applies to the ConexBoxes website, mobile application, application programming interface, and related services (collectively, the “Service”).

The Service is an invitation-only inventory system for participating community organizations. It is not an advertising platform or a public social network.

2. Information we collect

We collect information that users, sponsoring organizations, and devices provide, together with records created while the Service is used.

• Account and profile information. This includes a name, email address, profile image, account status, organization membership, assigned role, and box or location assignments.
• Authentication and security information. This may include a password hash, email-verification and password-reset records, multi-factor authentication settings and protected secrets, recovery codes, sign-in provider identifiers, session tokens, device name or identifier, IP address, browser or device information, and sign-in activity. We do not store a plain-text account password.
• Organization and inventory information. This includes organization names and settings; supply locations and boxes; product names, descriptions, categories, quantities, barcodes, QR codes, serial or asset numbers, and item attributes; receipts, reservations, checkouts, transfers, stock counts, reports, notes, and transaction history.
• Files and images. Users may upload item images and related files. We store the file, filename, media type, size, checksum, upload time, and the organization, user, or inventory record associated with it.
• Location information entered by an organization. The Service can store supply-location names, street addresses, directions, latitude, and longitude. The mobile app does not request a device’s location. An organization can designate certain supply locations and emergency information for public display.
• Camera and barcode information. The mobile app requests camera access so a user can scan inventory barcodes. It does not request microphone access for this feature. A barcode value is used to find or update an inventory record. Camera images are not retained unless a user deliberately uploads an image through an available upload feature.
• Activity, audit, and technical information. We record inventory actions and administrative changes, including who performed an action and when. Server logs and security records may also contain request identifiers, route and response information, timestamps, IP addresses, device or browser details, and diagnostic data.
• Information from connected services. If Google sign-in is available and selected, Google may provide an account identifier, name, email address, profile image, and authentication tokens or related account information. Google handles its own processing under its privacy terms.

We do not collect payment-card information through ConexBoxes. We do not use third-party advertising trackers, consumer analytics, or crash-reporting services at this time.

3. How we use information

We use information to:

• create accounts, authenticate users, maintain sessions, and provide appropriate organization and inventory access;
• operate inventory workflows, maintain accurate balances and custody records, display item images, and preserve an accountable history of changes;
• send invitations, verification messages, password-recovery messages, security notices, and other transactional email;
• protect the Service, investigate suspected misuse, enforce permissions, prevent duplicate operations, and respond to incidents;
• maintain, troubleshoot, test, and improve reliability and accessibility;
• comply with legal obligations and protect users, participating organizations, the Coalition, and the public; and
• create aggregated or de-identified information that does not reasonably identify a person.

We do not sell personal information. We do not use it for targeted advertising or for profiling that produces legal or similarly significant effects.

4. How we disclose information

We disclose information only as needed for the Service and the purposes described here:

• Within a participating organization. Authorized users can see account, inventory, image, location, and activity information according to their assigned permissions. Designated operators can administer member access.
• Service providers. Vendors may process limited information for hosting, network security, email delivery, authentication, data storage, backup, and technical support. They may use the information only to provide their services to us, subject to their agreements and applicable law.
• Google sign-in. If enabled and selected by a user, we exchange authentication information with Google to complete sign-in and protect the account.
• Public information chosen by an organization. A participating organization may publish a supply location’s name, address, directions, coordinates, box information, or emergency notice. Account credentials, member contact details, private inventory activity, and audit history are not part of these public location records.
• Legal, safety, and organizational reasons. We may disclose information when reasonably necessary to comply with law or legal process; protect rights, safety, and security; investigate fraud or misuse; or complete a merger, reorganization, or transfer of the Service subject to appropriate protections.

We do not allow service providers to sell personal information or use it for their own targeted advertising.

5. Organization access and responsibility

Participating organizations control their inventory data and decide which invited staff and volunteers may work with it. Within the Oregon Chinese Coalition, designated operators, including the system operator and the organization’s president, control member accounts and permissions. Ordinary members cannot administer other members unless their role is changed.

An organization may enter information about its members, supply locations, borrowers, custodians, or inventory activity. Organizations and users should enter only information they are authorized to provide and that is reasonably needed for community-supply operations.

6. Your privacy choices and rights

Depending on where you live and subject to legal exceptions, you may ask us to:

• confirm whether we process personal information about you and provide access to it;
• correct inaccurate personal information;
• delete personal information;
• provide a portable copy of information you supplied;
• explain the categories of information we process and the categories of third parties to which it was disclosed; or
• review a decision we made about a privacy request.

To make a request, email info@pdxchinese.org. Describe the request and identify the ConexBoxes account or participating organization involved. We may need to verify your identity and authority before acting. An authorized agent may submit a request when permitted by law, but we may ask for proof of authorization.

If we deny a request, you may appeal by replying to our decision or emailing the same address with “Privacy Appeal” in the subject line. We will not discriminate against you for exercising a privacy right.

There is currently no need to opt out of sale, targeted advertising, or significant automated profiling because we do not engage in those practices.

7. Children and teens

ConexBoxes may be used by invited volunteers of different ages, but the Service is not directed to children under 13 and is not intended for a child under 13 to use independently. Before a child under 13 is given an account, a parent or legal guardian and the sponsoring organization must be involved, and the Coalition must be contacted so that any notice and verifiable consent required by law can be completed.

A parent or legal guardian may contact us to ask what personal information we maintain about their child, request correction or deletion, or refuse further collection or use. We will verify the requester’s identity and relationship to the child. If we learn that we collected personal information from a child under 13 without required permission, we will delete it or seek appropriate consent.

We do not sell the personal information of children or teens, use it for targeted advertising, or make their account information publicly available.

8. Retention, cookies, and security

We keep account information while an account remains active and as needed to operate the Service. Inventory records, audit history, security records, and uploaded content may remain after an individual account is disabled because a participating organization may need an accurate operational history. We delete or anonymize information when it is no longer reasonably needed for service, audit, security, backup, dispute-resolution, or legal purposes. We do not currently use one fixed retention period for every category of information.

Deletion from active systems may not immediately remove information from protected backups. Backup copies are isolated from ordinary use and are deleted or overwritten through the backup lifecycle unless preservation is legally required.

The website uses an essential session cookie and may use local browser storage to support sign-in, security, and user-interface preferences. The mobile app uses protected device storage for authentication information. We do not currently use advertising cookies.

We use administrative, technical, and physical safeguards appropriate to the nature of the information. These include role-based access controls, password hashing, protected authentication secrets, multi-factor authentication options, short-lived file links, audit records, restricted infrastructure access, and security monitoring. No storage or transmission method can be guaranteed completely secure.

9. Changes and contact

We may update this policy as the Service or legal requirements change. The effective date at the top will change when we do. If a change materially affects how we use personal information, we will provide additional notice and obtain consent when required.

Questions, privacy requests, and requests concerning a child’s information can be sent to: