Legal

Privacy Policy

Last updated: September 2, 2026

The Greater Lowell Area Science-based Skeptics (GLASS) respects your privacy. This policy explains what personal data we collect through this website, why, how long we keep it, and the rights you have over it under the UK/EU General Data Protection Regulation (GDPR) and similar laws.

Who we are

GLASS is an informal community group based in the Greater Lowell area of Massachusetts, USA. For any question about this policy or your data, contact us at info@sciencebasedskeptics.com.

What we collect

• Account data — email address, display name, and a securely hashed password (we never store or have access to your password in plain text) when you register for an account.
• Event reminder preferences — which reminder timings (e.g. 7 days before, 2 days before, the day of) you've opted into for upcoming GLASS events, and whether you've confirmed that opt-in via the link we email you. None by default; only set if you check the box at signup or choose timings from your account page, and reminder emails don't start until you confirm.
• Session cookie — a single strictly-necessary cookie (sid) that keeps you logged in. It is not used for tracking or advertising, and no consent banner is required for it under ePrivacy rules. We do not use analytics or advertising cookies.
• Contact form submissions — if you use the contact form, your name, email, and message are sent directly to our form processor, Web3Forms, and forwarded to us by email. We don't store these submissions in our own database.
• Event RSVPs — if you mark yourself attending or not attending an event, and any optional note you add. This is only recorded if you use the RSVP buttons on an event.

Why we process it, and on what basis

• Providing your account (email, name, password) — necessary to perform our contract with you as a registered member (Art. 6(1)(b) GDPR).
• Event reminder emails — your explicit consent, given by checking the opt-in box and then confirming via the emailed link (double opt-in) (Art. 6(1)(a) GDPR). You can withdraw it any time from your account page.
• Keeping you logged in / account security — our legitimate interest in running a functioning, secure website (Art. 6(1)(f) GDPR).
• Responding to contact form messages — your consent, given by submitting the form.
• Event RSVPs — our legitimate interest in running the RSVP feature you choose to use, so members can coordinate around who's attending (Art. 6(1)(f) GDPR).

Who else sees it

If you RSVP to an event, your display name, avatar, RSVP status, and any note you add are visible to other logged-in members on that event's listing — that's the point of RSVPing, so people can see who's coming. They are not visible to signed-out visitors.

We also use a small number of third-party processors to run the site. Data may be processed on servers located in the United States.

• Namecheap Private Email — sends account verification, password-reset, and event reminder (including confirmation) emails.
• Web3Forms — delivers contact form submissions to us by email.
• Turso — hosts our database (account records, sessions, tokens).

We do not sell your data, and we don't share it with anyone for marketing purposes.

How long we keep it

• Account data is kept until you delete your account or ask us to.
• Login sessions expire automatically after 30 days.
• Email verification and reminder-confirmation links expire after 24 hours; password reset links after 1 hour. Expired or used tokens are purged automatically.
• An account that never verifies its email is automatically deleted after 30 days.
• RSVPs are kept until you change or clear your response, the event is deleted, or you delete your account.

Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Export your data in a portable format.
• Withdraw consent (e.g. event reminders) at any time.
• Object to processing based on legitimate interest.
• Lodge a complaint with your local data protection supervisory authority.

You can exercise most of these yourself, any time, from your account page: download a copy of your data, or permanently delete your account. For anything else, email us at info@sciencebasedskeptics.com and we'll respond within 30 days.

Children

This site is not directed at children, and we don't knowingly collect data from anyone under 16.

Changes to this policy

If we make material changes to how we handle your data, we'll update this page and change the "last updated" date above.