Blue Skies Mutual Aid is a registered 501(c)(3) nonprofit organization (EIN 88-3239129) serving Gaines, Yoakum, Terry, Dawson, and Andrews counties in West Texas.

This policy applies to blueskiesma.com, our Android app, our phone calls and text messages, and information we collect in person while providing services.

From people we assist: name, phone number, email, address and delivery directions, county, preferred language, and household details needed to coordinate help (such as who lives with you and their ages). Depending on the help you ask for, this can also include health and medical equipment needs, documents for vital records help, and notes our staff record about your case.

From volunteers and staff: name, contact details, coverage areas, training records, time entries, and signed forms, including signatures.

From donors and supporters: name, email, and details needed to record a contribution. Card numbers are handled by our payment processor and never stored by us.

Mobile information: your mobile phone number, your text message consent (including the date, method, and wording you agreed to), and the texts and photos exchanged with us.

Things you choose to give us: a resume you build with our resume builder, what you type into our website chat assistant, and a short voice recording when you search by voice.

Automatically: basic technical information such as browser, device, and error details used to keep the site working and secure. We use browser storage only to keep you signed in and remember settings like your language. We don't use advertising cookies or trackers.

We use information only to:

• Coordinate assistance, deliveries, appointments, and case follow-up
• Communicate with you by phone, email, or text about your request or account
• Schedule and support volunteers
• Acknowledge donations and meet grant, tax, and legal reporting duties
• Keep accounts and systems secure and prevent misuse

We do not sell personal information, do not use it for targeted advertising, and do not share it for cross-context behavioral advertising. Reports we publish use totals, never anything that identifies a person.

If you agree to receive texts, or text us first, we use your mobile number only to text you about your request, deliveries, appointments, wishlist donations, account notices, verification codes for privacy requests, and replies from our staff. Volunteers who turn on text alerts also get alerts about their volunteer work. Contacts at Blue Skies Alliance partner organizations and people registered for Alliance conferences (including guests) can also get texts about Alliance updates, COAD callouts, weather alerts if they sign up for them, and their conference registration. If you haven't agreed yet, we text you once to ask, and automated texts start only after you reply YES. We never send marketing, promotions, or donation appeals by text.

Message frequency varies. Message and data rates may apply. Reply STOP (or PARAR) to opt out at any time, or HELP (or AYUDA) for help. For help you can also call (432) 201-4598 or email operations@blueskiesma.com. Agreeing to texts is never required to receive our services.

See our SMS Terms & Conditions and how we collect text consent.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Mobile phone numbers and text messaging opt-in data and consent will never be sold, rented, leased, traded, or shared with any third party or affiliate for any purpose, including marketing or promotional purposes.

We share personal information only:

• With staff and volunteers whose role requires it
• With partner organizations when you have authorized a referral
• With the companies that help us operate, named below under Services We Use, which may use it only to provide their service to us
• When required by law, court order, or to protect someone's safety

All of the categories above exclude text messaging originator opt-in data and consent. That information is never shared with any third party.

We don't send client case records, health records, or donor records to AI providers. Our AI tools receive only what you or our staff put into them:

• The chat assistant on our website answers from our public pages. Please don't type health details or other private information into it.
• The resume builder sends what you write to improve the wording.
• Voice search turns a short recording into text. The recording isn't saved.

We keep records only as long as we need them or the law and our funders require. When a period ends, we delete the record or remove everything that identifies you.

• Client records, including health and medical equipment records

  6 years after the last help we provided

• Signed forms

  6 years

• Donation and financial records

  7 years

• Security audit logs

  2 years

• Proof of text message consent and opt-outs

  6 years from the newest consent record

We use encryption, role-based access controls, MFA for staff who handle sensitive records, and activity logging. Sensitive client and health information is treated with HIPAA-aligned safeguards and is visible only to staff who need it. No system is perfectly secure, but we work to protect your information. See Security below.

If a data breach affects your information, we will tell you without unreasonable delay and within 60 days, and notify the Texas Attorney General when the law requires it.

You can ask for a copy of your information, ask us to correct or delete it, and opt out of texts at any time. Where a request conflicts with a legal retention duty, we will explain what we must keep and why. We confirm your identity before acting and respond within 30 days.

Submit a privacy request or delete your account.

We assist households that include children, and a parent or guardian provides that information. Accounts are for people 18 and older. We do not knowingly collect information directly from children under 13 online. If you believe a child has given us information, contact us and we will delete it.

We may update this policy from time to time. The date at the top shows the latest version. If we make significant changes, we will post a notice on our website. We will never change how SMS opt-in data is handled without first asking for your consent.

Blue Skies Mutual Aid
Phone: (432) 201-4598
Email: operations@blueskiesma.com
Website: blueskiesma.com

Every page and form is served over HTTPS only, with strict transport security and a content security policy. There is no unencrypted version of the site.

Sensitive client information (case notes, location notes, closure reasons, referral and assistance notes), text messages and staff notes on them, and volunteer phone numbers are encrypted in the database with a key held outside it. Bank-link credentials for our accounting integration are encrypted the same way. Anything deliberately kept readable (for example a name used for search) is recorded internally with the reason.

Every record is protected by access rules that our server checks on every request, never the browser. Admin permissions are stored separately. Sensitive actions ask you to confirm with MFA again.

Reads and changes to protected information are written to a tamper-evident audit log recording who accessed what and why. Entries are kept for two years and then deleted.

We follow HIPAA-aligned practices: written policies, annual workforce training, signed business associate agreements with the providers that store health information (Lovable Cloud, Quo and Google Workspace), a disclosure log, periodic access reviews, and a breach-response process. HIPAA has no certificate. These are self-attested practices.

Email operations@blueskiesma.com with the details and steps to reproduce. Please give us a reasonable chance to investigate and fix before any public disclosure.

We will acknowledge your report, keep you updated, and credit you if you would like. We do not offer a paid bounty.

• Lovable Cloud

  Our database, file storage, and sign-in (signed business associate agreement)

  Information handled: All app data, encrypted in transit and at rest

• Cloudflare

  Runs the website and checks public forms for bots

  Information handled: Page requests, IP address, and form submissions as they pass through

• Quo

  Our phone line, text messages, and voicemail (signed business associate agreement)

  Information handled: Phone numbers, call records, voicemails, and message contents

• Google Workspace

  Staff email, calendar, documents, and our phone book for partners and donors (signed business associate agreement). Client contacts are never synced to Google.

  Information handled: Staff email and calendar contents, partner and donor contact details

• Google Firebase

  Sends app notifications to phones

  Information handled: A device ID and the notification text (never client details)

• Resend

  Sends our emails: notifications, support replies, and receipts

  Information handled: Name, email address, message contents

• Lovable AI (Google Gemini and OpenAI models)

  Our website chat assistant, resume builder, voice search, staff assistant, and translating our pages

  Information handled: Only what is typed or said into those tools. No client case, health, or donor records are sent.

• Stripe

  Processes card donations and shop purchases

  Information handled: Name, email, payment details (card numbers never reach us)

• PayPal, Venmo, Cash App, and DonateStock

  Other ways to give, used only if you choose them. Their own privacy policies apply.

  Information handled: What you give them; we receive your name, email, and gift amount

• Printful

  Prints and ships shop orders

  Information handled: Name and shipping address for the order

• Plaid and Wave

  Import bank transactions and keep our books

  Information handled: Organization finances, including donor names on recorded gifts (no client data)

• OpenStreetMap

  Shows maps on our resource pages

  Information handled: Your IP address when a map loads

When we add or remove a provider that handles personal information, we update this page. Providers that store health information sign a business associate agreement with us first.

Tell us what you would like us to do with the information we hold about you. We check who you are before acting on a request, and we reply within 30 days. Some records must be kept for a required period by law. If that affects your request, we will explain it.