Privacy Policy

Last updated August 2026

Draft pending attorney review. This document is a working draft prepared for the BDAP platform. It must be reviewed and finalized by a licensed attorney before launch. It is not legal advice.

This policy explains what the Borrower Defense Accountability Project collects, why, who can see it, and what control you have. The data here is unusually sensitive, so the defaults are restrictive.

1. What we collect

Account information: your full legal name, email address, and — if you choose to provide it — a phone number. If you sign in with Google, we receive your name and email address from Google.

Affidavit content: every structured answer you enter, your personal narrative, your typed signature, and the timestamp and account identifier recorded with it.

Uploaded documents: any supporting evidence or notarized statements you upload.

Community activity: your forum threads, replies, and likes, which display your name to other logged-in members.

Agreement and review records: confidentiality agreement signatures with timestamp and IP address, and a log of affidavit approvals, rejections, and access revocations.

2. Who can see what

Only you and administrators can see your affidavit while it is pending or rejected, and your uploaded documents at any stage.
Verified affiants — members with their own approved affidavit and a signed confidentiality agreement — can read approved affidavits inside the vault. They cannot download or export them from the vault view.
All logged-in members can see your name on your forum posts and your school in aggregate statistics.
Prospective law firms receive only the anonymized case package, which is compiled and released by administrators and excludes names, contact details, and other direct identifiers.
The public sees nothing. Everything beyond the landing page and legal pages requires a verified account.

3. How data is stored

Affidavit content is stored in an access-controlled database with row-level access rules enforced at the database itself, not only in the interface. Uploaded documents live in private storage with no public URLs; access is granted through short-lived links to you and to administrators only.

4. What we ask you not to submit

Do not enter or upload Social Security numbers, full bank or loan account numbers, credit card numbers, driver's licence numbers, or dates of birth. Approximate loan figures are sufficient. Redact documents before uploading them.

5. Sharing and disclosure

We do not sell data, and we do not share it with advertisers or data brokers. We use service providers for hosting, database, storage, and email delivery, who process data only on our instructions. We may disclose information where legally required, such as a valid subpoena or court order. Because BDAP is not a law firm, nothing you submit here is privileged.

6. Your choices

You can update your profile at any time, edit your affidavit (which returns it to review), and delete your account from your profile page. Deletion removes your account, affidavit, uploaded documents, and forum history. Anonymized aggregate counts already compiled into a released case package cannot be retracted from copies already delivered.

7. Retention

We keep affidavit content while your account exists and while the organizing effort it supports is active. Audit records of approvals, revocations, and confidentiality signatures are retained for accountability even after related content is removed, in a minimized form.

8. Contact

Questions about this policy can be sent to the contact address in the footer of every page.