Privacy Policy

1. Who this applies to

This policy explains how the Harvard Commons Homeowners Association (the "Association," "we," "us") handles information in connection with the Harvard Commons HOA resident website (the "Site"). It covers the Site only. It does not cover information the Association collects offline, through the county recorder, or through a management company, if one is engaged.

2. Information we collect

Information you give us

• Access requests. If you request resident access, we collect your name, address, email address, and phone number, so the board can confirm you are a current member before creating an account.
• Your account. Your resident account holds your email address and your access level (resident, board member, document manager, or administrator). Accounts are created by the board; nobody can create one for themselves.
• Sign-in records. When you sign in, we email a one-time code to your address. Our account provider (see section 7) records when you signed in and the IP address you signed in from, for security.
• Documents. When a board member posts a community document, we store the file and a record of which account uploaded it and who last changed its settings.
• Messages. If you contact the board or submit a support request, we collect what you send us — typically your name, email address, and the content of your message.
• Payment context. When you pay dues, you select your property address on the payment page. That selection is returned to us so the payment can be credited to the right account.

Information we do not collect

We want to be specific here, because it is the part residents most often ask about:

• We never receive your bank account or routing numbers. Those are entered on Stripe's own payment page and are never transmitted to, stored by, or visible to the Association or anyone on the board.
• We do not use advertising networks, marketing pixels, session recording, or third-party analytics.
• We do not track your activity across other websites.
• We do not collect location data.

Information collected automatically

Like nearly all websites, the server that hosts the Site records standard technical information when a page is requested — such as your IP address, browser type, the page requested, and the time of the request. These logs are used for security and troubleshooting, not to build a profile of you.

3. Cookies and browser storage

The Site does not use advertising or tracking cookies.

When you sign in, the Site keeps a sign-in token in your browser's local storage, so you stay signed in on that device, even after closing the browser, until you choose Logout. Logging out removes it. If you use a shared or public computer, always log out when you finish. Blocking local storage will prevent you from staying signed in.

4. How we use information

We use the information described above only to:

• Verify that you are a current owner or resident and grant appropriate access;
• Credit dues payments to the correct property;
• Respond to your questions, requests, and reports;
• Send notices relating to the community, your account, or your assessments;
• Maintain the security and integrity of the Site;
• Meet obligations under the Association's governing documents and Colorado law.

We do not use your information for advertising, and we do not sell it.

5. When information is shared

We share information only in these circumstances:

• Service providers. Companies that operate parts of the Site on our behalf — described in section 7 — receive only what they need to perform their function.
• The board and its advisors. Board members, and where appropriate the Association's management, accountant, or legal counsel, may access resident information in the ordinary course of running the Association.
• Within the Site, by access level. Some community documents are marked board only. Board members, document managers, and administrators can see those documents; residents cannot see them or their names. Administrators can also see the list of accounts (email address and access level). Residents cannot see anyone else's account.
• When required by law, or in response to a valid legal request, subpoena, or court order.
• To protect people or property, where we reasonably believe disclosure is necessary to prevent harm, fraud, or a violation of law.
• Association records requests. Colorado law gives owners the right to inspect certain Association records. Information you provide may fall within that right and may be disclosed to another owner in response to a proper request.

We do not sell, rent, or trade resident information, and we do not provide it to marketers, political campaigns, solicitors, or data brokers.

6. How long we keep information

Your resident account is kept while you are an owner or resident. When you are no longer a member, the board deletes the account; information from your access request may be kept for a reasonable period afterward as part of the Association's records. Payment records are retained as required for the Association's accounting and legal obligations. Messages to the board and access requests are kept as long as needed to address the matter and maintain a record of it.

Community documents stay on the Site for as long as the board chooses to post them. A document removed from the Site is deleted permanently from it; the Association keeps its official records separately. Sign-in records and server logs are retained only briefly for security and troubleshooting.

7. Third-party services

The Site depends on the following outside services. Each has its own privacy policy governing what it collects:

• Stripe — processes dues payments. When you click through to pay, you are on Stripe's page, not ours. Stripe collects your name, email, bank details, and payment information directly, and returns to us only the confirmation and the property address you selected.
• Supabase — runs resident accounts, sign-in, and the storage for community documents. It holds your email address, access level, and sign-in records, and stores the documents the board posts.
• Google — supplies the community calendar data and the web fonts the Site uses. Loading a page causes your browser to request fonts from Google's servers, which means Google receives your IP address as part of that request. Messages, support requests, and access requests you send through the Site's forms are recorded in the Association's Google spreadsheets and delivered by Google's email service, and the email carrying your sign-in code is also sent through Google's email service.
• Cloudflare — provides Turnstile, the check on the Site's forms that confirms a person, not an automated program, is sending them. To make that check, Cloudflare receives technical information about your browser and device. It is used to stop spam, not to advertise to you.
• Tailwind CSS CDN — supplies a styling library. As with fonts, your browser requests this file directly from the provider.
• Our web host — stores and serves the Site's files and maintains the server logs described in section 2.

These providers act on our behalf or as independent processors of the data they collect directly. We do not control their practices and are not responsible for them.

8. Security

We take reasonable measures to protect resident information, including limiting access to those who need it and relying on established providers such as Stripe for payment handling. Member-only areas require you to sign in, and who can see each document is enforced by our storage provider for every request, not just by what the page displays.

That said, no website or method of transmission is completely secure, and we cannot guarantee absolute security. Your account has no password: you sign in with a one-time code sent to your email, so anyone who can read your email could sign in as you. Keep your email account secure, never share a sign-in code, and log out on shared devices. Do not send Social Security numbers, financial account credentials, or similarly sensitive information through the Site's forms.

9. Your choices and rights

You may:

• Ask what information we hold about you;
• Ask us to correct information that is inaccurate;
• Ask us to delete information, subject to records the Association is required or reasonably needs to keep;
• Ask to stop receiving non-essential email. Notices required by the governing documents or Colorado law will still be sent.

To make a request, contact the board using the information in section 12. We may need to verify that you are the person the information concerns before acting.

10. Children

The Site is intended for adult owners and residents. It is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will remove it.

11. Changes to this policy

We may update this policy as the Site changes. The "Last updated" date above will reflect any revision, and material changes will be communicated through the Site or the Association's usual means of notice. We encourage you to review this page periodically.

12. Contact

Questions or requests about this policy may be directed to the board at [email protected], or through the Contact page.