Privacy Policy

1. What we collect

1.1 Account information: your full legal name, your email address, an optional phone number, and account timestamps. If you sign up with Google, Google gives us your name and email address; we do not send Google anything beyond the sign-in request itself.

1.2 Affidavit content: everything in the affidavit form, including your school, program, dates attended, what was said to you and by whom, coaching and repetition allegations, your narrative, your reliance statement, your outcomes and figures, witness information, your typed signature, and the timestamp of that signature.

1.3 Uploaded documents: supporting evidence and, if you choose, a scanned notarized copy of your statement.

1.4 Vault agreement records: your typed signature, the date and time you signed, and the IP address you signed from.

1.5 Community activity: your forum posts and threads, likes, Live Lounge messages, which categories and threads you watch, and any school tags you suggest.

1.6 Moderation and standing records: reports you file or that are filed about you, moderation actions taken and the stated reason, and your membership standing (active, muted, or suspended).

1.7 Notifications: the notifications we send you inside the platform and their read state.

1.8 Bug reports: if you file one, your name and email, the page you were on, basic browser information, and your description of the issue.

1.9 Login and security information: your password (stored as a hash, not in readable form) or your Google account link, whether your email is verified, and whether you have enrolled two-factor authentication. This is held by our authentication provider, not directly by BDAP staff.

2. Who can see what

2.1 You and BDAP administrators can see your pending or rejected affidavit, and all of your uploaded documents at every stage. No other member can.

2.2 Other verified members can see your approved affidavit inside the vault, but only if they themselves have an approved affidavit and have signed the Vault Confidentiality Agreement. They cannot download, print, or copy it from inside the vault interface.

2.3 All logged-in members can see your name on your forum posts, and can see aggregate statistics that include your school.

2.4 Prospective law firms can see only the anonymized case package described in Section 5 of the Terms of Service. They do not get vault access and do not get raw affidavits.

2.5 The general public can see the landing page and the legal pages, and nothing else. The forum, the Live Lounge, and the vault all require a member login.

2.6 Our service providers can see what is necessary to do their job for us. See Section 5.

3. How we store your data

3.1 Database access rules are enforced at the database level, using row-level security policies, not only inside the website's interface. This means a member cannot reach another member's pending affidavit or private information just by manipulating the application in their browser.

3.2 Uploaded documents live in a private storage location with no public web addresses. They are only ever accessible through links that expire after 60 seconds.

3.3 Two-factor authentication is available to every member who wants it, using an authenticator app.

3.4 Administrator actions taken against member content or standing are logged with who did it, why, and when.

3.5 We do not claim any particular encryption standard, security certification, or compliance framework, such as SOC 2, ISO, HIPAA, or GDPR certification. None of those has been independently established for this platform.

4. What we ask you not to submit

4.1 Please do not put the following into any text field or uploaded document: your Social Security number, bank account numbers, loan account numbers, credit card numbers, your driver's license number, or your date of birth.

4.2 Use approximate loan and income figures rather than exact numbers pulled from an account statement.

4.3 If you upload a document, black out or remove this kind of information before uploading it.

4.4 If you accidentally submit something you should not have, email hello@bdaproject.org and we will help remove it.

5. Third parties we work with

We do not sell your information, and we do not share it with advertisers or data brokers. The only outside organizations that receive information are the ones who help us run the platform, and prospective law firms as described in Section 5 of the Terms of Service.

We ask each of these providers to use your information only to provide their service to us, not for their own separate purposes.

6. Cookies and tracking

6.1 We do not run any analytics or advertising tools. There is no Google Analytics, no Meta or advertising pixel, no PostHog, no Segment, no Mixpanel, and no third-party tracker of any kind on this site.

6.2 The only cookies and browser storage we use are the ones needed to keep you logged in and to remember basic interface preferences, like whether a menu is open. None of this is used to track you across other websites.

7. Sharing and disclosure

7.1 We do not sell your data, and we do not share it with advertisers or data brokers.

7.2 Our service providers, listed in Section 5, process your information only on our instructions, to run the platform.

7.3 We may disclose information if we are legally required to, for example in response to a valid subpoena or court order. Because BDAP is not a law firm, nothing you submit here is protected by attorney-client privilege, and a court could potentially compel us to produce it.

7.4 We may disclose information if we believe in good faith it is necessary to protect the safety of a member or the public, or to prevent fraud, such as someone falsely claiming to represent BDAP and asking members for money.

7.5 The anonymized case package described in Section 5 of the Terms of Service is the only way member information is shared with an outside organization for the purpose of pursuing legal accountability.

8. Your choices

8.1 You can update your profile information at any time.

8.2 You can edit your affidavit. This sends it back to administrator review and takes it out of the vault until it is re-approved.

8.3 You can withdraw your affidavit, which removes it from the vault.

8.4 You can delete your account. See Section 10 for exactly what that does and does not remove.

8.5 If an anonymized case package that included information about you has already been delivered to a law firm, we cannot retract it from the copy that firm already holds, even if you later edit, withdraw, or delete.

8.6 Email preferences. We do not currently have a way to turn off individual categories of notification email short of leaving the platform. We consider account, affidavit, and moderation emails essential to your membership. If you want to stop receiving email from us entirely, email hello@bdaproject.org or delete your account.

9. State privacy rights

9.1 Depending on where you live, you may have rights under state privacy laws, such as those in California, Colorado, and Virginia, including the right to know what we have collected about you, the right to request deletion, and the right to correct inaccurate information.

9.2 How to make a request. Email hello@bdaproject.org and tell us what you would like to know, correct, or delete. We will ask you to confirm your identity before acting on the request, to make sure we are not handing your affidavit to someone impersonating you.

9.3 Response time. We aim to respond within 45 days of receiving your request and confirming your identity. If your request is complex or we have received a large number of requests, we may extend that period by up to an additional 45 days, and we will tell you by email before the first 45 days are up.

9.4 United States only. BDAP membership is limited to people located in the United States, and this platform is designed and operated under United States law. We do not offer the platform to, and do not knowingly accept members in, the European Union, the United Kingdom, or other jurisdictions outside the United States, and we make no commitments under the GDPR, the UK GDPR, or similar non-US privacy laws. We handle privacy requests the same way for every member, regardless of which state they live in.

10. Account deletion: what is and is not removed

10.1 When you delete your account, this removes: your affidavit from the vault, your forum threads and posts, and your profile.

10.2 This does not currently remove: your uploaded documents and files, your Vault Confidentiality Agreement signature record, your Live Lounge messages, your notifications, your moderation and standing history, reports you filed or that were filed about you, threads you were watching, your role assignment, or your underlying login credentials with our authentication provider.

10.3 We keep these because they support the vault's audit trail and our ability to show that approvals, revocations, and signatures happened the way we say they did, and because some of it, like reports and moderation history, may still concern other members.

10.4 If you want more removed than account deletion automatically handles, email hello@bdaproject.org and we will remove what we reasonably can on a case-by-case basis.

11. Retention

11.1 Affidavit and vault agreement content: kept while your account exists and while the organizing effort connected to your school or claim remains active, and in any event no longer than seven years after your account is closed or your affidavit is withdrawn, whichever comes first. The one exception is a legal hold: if we are on notice of an actual or reasonably anticipated lawsuit, subpoena, or government investigation that relates to the records, we must preserve them until that matter is resolved, even if the seven years have run.

11.2 Uploaded documents: kept in private storage under the same timeline as your affidavit, unless you ask us to remove them sooner.

11.3 Audit records of approvals, revocations, and signatures: kept in minimized form (who, what, when) even after the related content is otherwise removed, so we can show the history of the vault is trustworthy.

11.4 Moderation, standing, and report records: kept for as long as needed to maintain a fair, consistent moderation history. Routine records, such as a removed post, a warning, or a spam report, are kept no longer than three years after the action. Records involving safety, such as threats, harassment, doxxing, impersonation, or suspected fraud, are kept no longer than seven years after the action, because they can become part of a police report or a legal claim. If we are on notice of an actual or reasonably anticipated legal matter involving those records, we preserve them until it is resolved. If you ask us to delete your data, we may decline for records that concern another member's safety or an unresolved dispute, which state privacy laws permit.

11.5 Bug reports: kept until resolved and for a reasonable period after, for reference.

11.6 Confidential section: kept while your account is open and your consent to share it with counsel is switched on. If you withdraw that consent, or you delete your account, we remove it from the legal vault immediately and delete it within thirty days. Everything remaining in the legal vault is deleted no later than twelve months after the organizing effort connected to your school or claim concludes. The only exception is a legal hold, as described in Section 11.1. See Section 16 for the full description of this data.

12. Automated summarization

12.1 There is a field in our system reserved for an automated summary of your affidavit. As of the date of this policy, nothing in our software currently writes to or reads that field. No automated summarization is happening today.

12.2 If we turn this on in the future, we will use it only to help administrators and, where applicable, verified members review the volume of material in the vault, not to make decisions about your statement's truthfulness or approval on its own.

12.3 If we ever send member statement text to an outside AI provider for this purpose, we will not permit that provider to use your statement to train their own general-purpose models, and we will update this policy before turning the feature on.

13. Data breach notification

If we discover a breach that is reasonably likely to have exposed your personal information, we will notify affected members by email and, where required, notify the appropriate state regulators, without unreasonable delay and consistent with applicable law. We may take a reasonable amount of time first to determine the scope of the breach, identify who was affected, and restore the security of the platform, and we may delay notice if law enforcement tells us in writing that notifying members would interfere with an investigation. Where the law of your state sets a specific deadline for notice, we follow that deadline.

14. Children's privacy

BDAP is intended for adults only. You must be 18 or older to create an account, and we ask you to confirm this at sign-up. We do not knowingly collect information from anyone under 18. If we learn that someone under 18 has created an account, we will remove it.

15. Changes to this policy

If we make a material change to this policy, we will announce it on the forum and update the date at the top of this page.

16. The confidential section and the legal vault

16.1 What this is. Part of the affidavit form is a separate confidential section, labeled as such on the form. It is never shown in the member vault, never shown to other members, and never included in the public or anonymized case package. It is stored apart from your public statement, in what we call the legal vault.

16.2 What it contains. Information a lawyer would need if they were considering a matter like yours: your date of birth and age at enrollment, the states you lived in then and now, exact enrollment, withdrawal, and graduation dates, the specific representations made to you and who made them, your loan servicers, loan types, and loan status, out-of-pocket and other costs, whether you have experienced credit damage, wage garnishment, or tax offset, lost income, retraining costs, any health impact you choose to describe, prior complaints or filings you have made, witnesses, other students, and the evidence you hold.

16.3 Who can read it. Only two categories of people. First, the site owner, who administers the vault. Second, attorneys who have been individually admitted to the legal vault and who have signed a counsel confidentiality agreement. Being an administrator or a moderator does not grant access, and access is not tied to any role in the community. Every attorney is admitted one at a time and can be removed at any time.

16.4 What those attorneys may and may not do. They may read your record while considering whether to offer representation. They may not disclose it outside their firm without your written permission, may not use it for marketing or solicitation, may not sell it, and may not contact you directly unless you ticked the box consenting to contact. If you did not, they see a case number instead of your name and must request an introduction through us.

16.5 Every view is recorded. We log each record an attorney opens, each search they export, and each packet they print, along with the date and time. Exported spreadsheets and printed packets carry a unique tracking number tied to the account that produced them.

16.6 No attorney-client relationship. An attorney reading your record does not become your lawyer. That happens only if you and that attorney sign a separate engagement, directly with each other. BDAP is not a party to it. Because BDAP is not a law firm and no attorney-client relationship exists at this stage, what you write in this section is not protected by attorney-client privilege, and a court could potentially compel its disclosure.

16.7 You can withdraw at any time. There is a button on the affidavit page that removes your confidential section from the legal vault. It takes effect immediately for every attorney, and we delete the record within thirty days. Withdrawing does not affect your membership or your public statement. Copies an attorney printed before you withdrew remain subject to their confidentiality agreement, which requires them to destroy every copy within thirty days of the end of their access or evaluation.

16.8 We are not paid for this. BDAP receives no fee, referral payment, or share of any recovery from any lawyer or law firm for access to the legal vault or for any introduction. We do not recommend, endorse, or vouch for any particular lawyer, and choosing a lawyer is always your decision.

17. Governance information

17.1 What we collect. When you take part in governance we record your display name, your proposals, which proposals you endorsed, any volunteer statement you submit, and, if you are a representative, each vote you cast with your written reason and a timestamp.

17.2 Who can see it. Proposals, endorsement counts, panel rosters, votes, and voting reasons are visible to signed-in members with an approved affidavit. Volunteer nominations are visible only to you and to administrators until a seat is granted.

17.3 How long we keep it. Governance records are permanent. Because the value of the process depends on an unaltered record, votes, proposals, and voting reasons are not deleted on request and are retained even if you later close your account, though we will detach your account from the record where we can and leave your display name as it appeared at the time.

17.4 What we never publish. Nothing from your affidavit, confidential section, contact details, or legal vault records is exposed through governance. Endorsements are stored individually so the system can prevent duplicates, but only the total count is shown to members.

17.5 Your choices. Governance participation is optional. You can withdraw an endorsement while a proposal is still gathering support, step down from the panel at any time, and simply not submit proposals or volunteer statements.

18. Contact

Questions about this policy, requests about your data, and privacy concerns of any kind go to hello@bdaproject.org.