Privacy Policy
Last updated: August 16, 2026
The Greater Lowell Area Science-based Skeptics (GLASS) respects your privacy. This policy explains what personal data we collect through this website, why, how long we keep it, and the rights you have over it under the UK/EU General Data Protection Regulation (GDPR) and similar laws.
Who we are
GLASS is an informal community group based in the Greater Lowell area of Massachusetts, USA. For any question about this policy or your data, contact us at info@sciencebasedskeptics.com.
What we collect
- Account data — email address, display name, and a securely hashed password (we never store or have access to your password in plain text) when you register for an account.
- Event reminder preference — whether you've opted in to reminder emails about upcoming GLASS events. Off by default; only set if you check the box at signup.
- Session cookie — a single strictly-necessary cookie (
sid) that keeps you logged in. It is not used for tracking or advertising, and no consent banner is required for it under ePrivacy rules. We do not use analytics or advertising cookies. - Contact form submissions — if you use the contact form, your name, email, and message are sent directly to our form processor, Web3Forms, and forwarded to us by email. We don't store these submissions in our own database.
Why we process it, and on what basis
- Providing your account (email, name, password) — necessary to perform our contract with you as a registered member (Art. 6(1)(b) GDPR).
- Event reminder emails — your explicit consent, given by checking the opt-in box (Art. 6(1)(a) GDPR). You can withdraw it any time from your account page.
- Keeping you logged in / account security — our legitimate interest in running a functioning, secure website (Art. 6(1)(f) GDPR).
- Responding to contact form messages — your consent, given by submitting the form.
Who else sees it
We use a small number of third-party processors to run the site. Data may be processed on servers located in the United States.
- Resend — sends account verification and password-reset emails.
- Web3Forms — delivers contact form submissions to us by email.
- Turso — hosts our database (account records, sessions, tokens).
We do not sell your data, and we don't share it with anyone for marketing purposes.
How long we keep it
- Account data is kept until you delete your account or ask us to.
- Login sessions expire automatically after 30 days.
- Email verification links expire after 24 hours; password reset links after 1 hour. Expired or used tokens are purged automatically.
- An account that never verifies its email is automatically deleted after 30 days.
Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Erase your data ("right to be forgotten").
- Export your data in a portable format.
- Withdraw consent (e.g. event reminders) at any time.
- Object to processing based on legitimate interest.
- Lodge a complaint with your local data protection supervisory authority.
You can exercise most of these yourself, any time, from your account page: download a copy of your data, or permanently delete your account. For anything else, email us at info@sciencebasedskeptics.com and we'll respond within 30 days.
Children
This site is not directed at children, and we don't knowingly collect data from anyone under 16.
Changes to this policy
If we make material changes to how we handle your data, we'll update this page and change the "last updated" date above.