Privacy

The RFP Hub is an open index of funding opportunities. No account is required to read the directory; like any web service, it still processes request metadata, described below. This page says what the Hub stores, what leaves its servers, what is public forever, and how to leave. Effective 31 August 2026.

What we store when you sign in

Your email address is your account’s identity: it delivers your sign-in codes, is read whenever your session is checked and shown back to you on your account page, matches your Google account if you later link one, and is how an operator finds an account when granting a role. If a sign-in email fails to deliver, the failure log carries a short hashed fingerprint derived from the address — a stable identifier, not the address itself. One-time codes are stored hashed and expire in five minutes.

Signing in creates a session: an opaque token stored as a database row, valid for 90 days and refreshed at most daily. Your browser keeps that token in localStorage until you sign out or clear site data. Signing out deletes the server row; if that request fails, this browser forgets the token but the server row can remain until it expires. Session rows deliberately store neither your IP address nor your browser’s user-agent — no raw IP address is persisted in any application table. Transient operational and access logs at the hosting layer exist, as with any web service.

Google sign-in, if you choose it, requests only your name, email and profile photo (the openid email profile scopes). Starting it sets a five-minute anti-forgery cookie backed by a ten-minute verification record. The tokens Google returns for the sign-in (access and ID token, their scope and expiry) are stored with the linked account; the Hub requests no offline access, so a refresh token is normally absent and is stored only if Google returns one. Sign-in exchanges tokens with Google’s endpoints; beyond that, the Hub does not read your Google data.

An account also carries what you create on it: an optional public handle (the byline shown on listings), roles and organization memberships, API-key records (name, prefix, a hash of the key, scopes, last-use — never the secret itself), your submissions, and an append-only history of changes and decisions.

Analytics without addresses

Publishers see event counts for their listings — recorded API list and detail reads, and clicks out to a listing’s application page or source — not page views and not counts of distinct people. To record an event without keeping who made it, each event stores two truncated keyed hashes (HMACs): one over the address, user-agent and the current UTC date, one over the address and the date. The key is fixed, but because the date is part of the input, the stored identifiers change every day — rows from different days are not directly linkable without the key and a candidate address. Referrers are reduced to their host. Raw events are deleted after 180 days by a nightly job; aggregated daily counts remain.

Separately from those publisher counts, the hosted site uses Google Analytics to measure overall site usage — pages visited and the coarse device and region information Google derives from a request. It is a standard third-party tool: when a page loads, your browser talks to Google’s servers, which see your IP address, subject to Google’s privacy policy. It runs only on deployments explicitly configured for it; the open-source code ships with it off, so a self-hosted Hub carries no Google Analytics unless its operator turns it on.

What is public forever

Published listings are open data: the RFP Hub Standard and the dataset exports are released under CC0. Unpublishing stops a listing from appearing going forward, but snapshots already released remain in the repository’s history and in copies others have made. Submit only what you intend to make public — including any contact names or details inside listing content, which become part of the public dataset.

If you choose a public handle, submissions you make outside an organization carry it as their submittedBy attribution — displayed on the listing and included in the exports. Without a handle, they are attributed to “community”. For listings that are currently public, a coarsened change history is also publicly readable: which fields changed and when, with reviewers shown only as “reviewer”. Other audit records are kept internally, append-only, and are not publicly served. The latest source check for a public listing (the URLs fetched, status, an extracted snapshot and differences) is publicly readable too.

What leaves our servers

The Hub runs on infrastructure providers that process data to provide the service: the site is hosted on Vercel, the API and database on AWS, and public dataset snapshots are published to GitHub. The email delivery provider sees your address in order to carry your sign-in codes, the way any mail carrier does. Google is involved if you choose Google sign-in, and through Google Analytics as described above.

Listing text is processed for duplicate detection entirely on the Hub’s own servers — no AI vendor, no third party, nothing sent anywhere. Submitting a listing with an application URL normally triggers a server-side check of that URL: the destination site sees a request from the Hub’s servers with a Hub user-agent, carrying no cookies and no referrer.

The Hub does not sell personal data and shows no advertising. Google Analytics, described above, is the only third-party measurement it runs.

How to leave

Signing out revokes this browser’s session as described above. There is no self-serve account deletion yet: removal is a manual request to the maintainers through the project repository (note that its issue tracker is public). Maintainers can remove identity records — email, name, photo — and revoke sessions and keys. What cannot be removed: the append-only audit history, and public attribution already released in CC0 snapshots or copied by others.

Changes to this policy

If this policy changes, the new version is published on this page with a new effective date.