What we keep, and what we never see.

You can read every page without an account or a form. We receive details about you only when you do one of these:

• Give online. Stripe takes your payment, and we get a note of the gift without your name or email. See Giving.
• Request a Lantern. We keep what you write in the form. See Requesting a Lantern.
• Write to us. Your email reaches our inbox, like any letter.

While you read, we count visits without cookies, and we hear about errors. See Analytics and cookies and Errors.

Some things stay on your device and never reach us:

• Your progress in the sample lessons and Challenge Tests on Learning is saved in this browser only. PostHog may hear that a lesson was finished or a question was right, never what you chose or wrote.
• A name or logo you try on a Lantern, on Give or on a Lantern’s own page, is drawn in your browser. Nothing is uploaded.
• The card on our contact page, a pledge by email and the request form’s email fallback all open your own email app. The website sends and stores nothing.
• Your answer to the analytics question, and the country you pick on the curriculum map, are remembered in this browser so we don’t ask again.

The website asks for no children’s details. How a Lantern will look after children’s data is set out in our draft safeguarding and data-protection policy, summarised on Care and accountability.

When you give online, you leave this website for Stripe Checkout, Stripe’s own payment page. You enter your card and contact details there, so they never touch this website.

Stripe tells our server when a gift goes through. We keep a short note of it: Stripe’s reference numbers, the amount and currency, once or monthly, the way of giving and the Lantern you chose, whether the payment went through, and when. No name, email or address.

To thank you, our server reads your email address and first name from Stripe’s message once and hands them to Resend, which sends the thank-you email. We don’t store them or write them into our logs.

Stripe sends your payment receipt by email, and Stripe keeps the details of your payment. After checkout, our server asks Stripe about your gift and passes the thank-you page only the amount, how often and where it goes. Your name and email never reach the page.

Monthly donors can change or stop their gift at any time on Stripe’s secure page, signing in with the email they gave, or by replying to the thank-you email.

We keep these gift notes while we need them to keep track of gifts, and delete them when you ask. Questions about a gift go to give@villagelantern.org.

The form asks for your name and email, and a phone number if you’d like; how you know the village, and whether its leaders know about your request; where the village is; your answers about it (children, schools, the road, land, a public building nearby, water); and anything else you want to tell us.

We save your request in our database at Cloudflare and add our own notes as we look into it. Resend sends two emails: your answers to our team, and a confirmation to you.

Before it sends, Cloudflare Turnstile checks that you are a person, not a robot. The check runs in your browser, and our server passes Cloudflare your IP address to confirm it.

So the form can’t be flooded, we keep a scrambled code made from your IP address with a secret key we hold (a salted hash; we never turn it back into the address) and allow about five requests an hour from one connection. A daily job clears the code once a request is more than a day old, so it is gone within two days.

We use your answers to look into the village and to follow up with you about it. No mailing list, and we never sell them. We never publish a location more precisely than the village name, and we don’t ask for map pins, GPS or photographs.

We keep your request while we need it to look into the village and stay in touch with you about it, and delete it when you ask. Write to hello@villagelantern.org, or reply to your confirmation email.

We use PostHog to learn which pages help. By default it runs without cookies: PostHog stores nothing in your browser, and its servers count visits with a one-way code instead of an id. Like any web service, PostHog receives your IP address with each count. It makes that code from it and your browser’s details, uses it to estimate the country and city a visit comes from, and keeps it with the visit record.

A small slip at the foot of the window asks whether PostHog may also remember this browser between visits. Choose Accept, and PostHog keeps an anonymous id in a cookie and in your browser’s storage, both for this website only. Choose No thanks, or nothing, and it doesn’t. Change your mind later, and PostHog clears what it stored.

If your browser sends Do Not Track or Global Privacy Control, PostHog doesn’t load at all and the slip never appears.

Cloudflare, which hosts the website, also counts visits with its Web Analytics: page views, the site that sent you, your country, your kind of browser and device, and how quickly pages load. It uses no cookies and stores nothing in your browser. Its small script loads on every page, whatever you choose on the slip.

PostHog receives the pages you visit, the links and buttons you click, the site that sent you, and your kind of browser and device, plus a few moments we name ourselves, such as a lesson finished or a gift amount chosen. These carry codes, choices and counts: never your name, your email or what you type.

Before a web address is sent, we strip it down to a few settings: the way of giving and amount, the Lantern, the contact topic, the curriculum country, and campaign tags. Anything else, such as a checkout reference, is removed.

Session replay records how a page is used (scrolling, clicks, what is on screen) so we can see where the site confuses people. It runs only after Accept, never on Learning or Request a Lantern, and every field you type into is hidden, as is a name or logo you try on a Lantern.

On this website’s own pages, PostHog’s cookie is the only one, and only after Accept. Stripe’s checkout and Cloudflare’s robot check are their own services, with their own rules.

We use Sentry to hear about errors, in your browser and on our server, so we can fix them. A report says what went wrong, on which page and in which browser.

We have switched off the parts that would record your IP address, cookies, request contents (such as form answers) or user details, and checkout references are removed from web addresses. Sentry also times about one visit in twenty, to show us where the site is slow. It records no screen replays.

Error reporting runs whatever you choose on the analytics slip, so the site keeps working for everyone.

Cloudflare also keeps our server’s working logs. We write reference numbers, amounts and choices into them, never names, email addresses or form answers.

• Change your analytics answer whenever you like, from the setting below.
• Turn on Do Not Track or Global Privacy Control in your browser, and PostHog won’t load.
• Clear this website’s data in your browser to forget your lesson progress, your choices and PostHog’s id.
• To see, correct or delete anything we hold about you, write to hello@villagelantern.org and we will do it. Gift questions go to give@villagelantern.org.

Here is what each one does for us, and what passes to it.

• Cloudflare

  Does

  Hosts the website and our server, keeps our database and our server’s logs, counts visits without cookies (Web Analytics), runs the robot check on Request a Lantern, and forwards mail for hello@ and give@ to our team’s inbox.

  Sees

  Your IP address as it delivers each page; pages viewed and how fast they load; Lantern requests and gift notes; the emails you send us.

• Stripe

  Does

  Takes card payments on its own checkout page, sends your payment receipt, and lets monthly donors manage their gift.

  Sees

  Your card, name, email and billing details, and the gift itself.

• Resend

  Does

  Sends our emails: a Lantern request to our team, its confirmation to you, and the thank-you after a gift.

  Sees

  Each email’s address and contents.

• PostHog

  Does

  Counts visits without cookies; after Accept, remembers this browser and may record sessions.

  Sees

  Your IP address with each count; pages, clicks and events with codes and choices, never your name or what you type.

• Sentry

  Does

  Tells us about errors and slow pages.

  Sees

  What went wrong, the page and the browser. Set up not to record your IP address, cookies or form answers.

Questions about this page, or a request to see, correct or delete your details: hello@villagelantern.org.

Questions about a gift: give@villagelantern.org.