Privacy Policy

When you create an account, we collect your authentication email and account identifiers. Email/password sign-in is handled by our authentication provider; passwords are not published or shown to stewards. If you choose Google sign-in, Google and the sign-in service exchange the information needed to authenticate you, such as your email, name and account identifier.

Your profile can include a name or nickname, date of birth, city, county, photos, headline, biography, optional interests, connection preferences and other fields you choose to complete. We derive age from your date of birth. Profile settings and account status are also stored.

We store messages and their delivery/read status, community posts and replies, blocks, reports, moderation notes and actions, and gift-credit activity. Optional private verification collects submitted documents, consent, review findings and outcome records. Sponsorship, billing and contact details are described below.

Magazine stories, public bylines, local listings and disclosed sponsorships are public. Approved members can see permitted portions of other approved members’ profiles and community content. Member-facing profiles show derived age, not exact date of birth, and respect supported hidden-field settings. Private contact details and operational records are not included in the member-facing profile.

Unapproved profiles are not available in member browsing. Blocks restrict shared profile and messaging access. Your own account tools allow you to view and correct your profile; authorized stewards have additional access for review, reports and service administration.

Messages are intended for conversation participants, but authorized staff may access information for moderation, safety or service operations under access controls. Messages are not end-to-end encrypted. Do not post information you would not want recipients to keep: they may copy or photograph what they see.

We use information to authenticate accounts, review eligibility, display the magazine and community, enable conversations, process payments and gifts, respond to inquiries, investigate reports, prevent abuse and maintain the service.

We do not sell member data or use it for behavioral advertising. Sponsorship does not give sponsors access to members’ private profiles, messages or authentication emails. A sponsor’s own contact and business information is used to administer their relationship and payments; only designated public listing or story information is published. Business listings can include an optional supplied public phone number; phone verification for members is not implemented.

Members may choose to submit an ID photo and, if needed, Michigan residency evidence for human review. Consent is requested first. Redact identification numbers, barcodes and unrelated information; never submit a Social Security number. The service does not perform biometric identification or AI document scanning in this process.

Documents are held in private storage. Authorized stewards can open them through controlled, audited access, not public document links. Members see submission status and evidence metadata. A check confirms only the finding recorded; it is not a background check, a guarantee of identity in every circumstance or a guarantee of safety.

Pending evidence expires after 30 days. Final review, withdrawal and account deletion initiate document cleanup. Removal may take time when cleanup needs to be retried. Minimal outcomes, consent/review metadata and audit information may remain after documents are removed. Identity, age and Michigan residency must all be checked for the full “Verified Michigan Member” badge; partial checks are labelled separately.

Stripe processes payment information through hosted payment pages. The site retains payment identifiers, amounts, statuses, plan information and related bookkeeping; it does not collect full card details in its own forms. Sponsorship records may retain organization names, contact names/emails, supplied links and notes, and provider references.

The contact form stores your name, reply email, selected topic, message and processing status in a private steward inbox. No email is sent automatically by that form. A steward may use your reply email to respond manually. Do not include IDs, passwords or full payment details. An inquiry does not subscribe you to marketing. Contact inquiries are retained only as needed to handle the matter, related disputes or recordkeeping.

A separate optional newsletter/launch list collects an email when you explicitly sign up for it; a contact inquiry is not that signup.

Lovable hosts and supports the website; Lovable Cloud uses Supabase for authentication, application data and storage. Stripe handles payments. Google is involved when you choose Google sign-in. These providers process information needed for their services under their own terms and privacy practices, including technical information.

Browser local storage is used to maintain authentication sessions, and cookies or other session mechanisms may be used by hosting, sign-in or payment services. Blocking or clearing them may sign you out or disrupt those services. We do not use behavioral advertising trackers. Hosting and service providers may collect technical and usage information to operate and improve their services.

Technical logs and error reports may include request, browser, device, error and network information. They help operate and diagnose the service. We use temporary counters to help limit repeated contact submissions.

We use access restrictions and private storage for sensitive records. No website can promise absolute security. Please use a strong password, protect your sign-in account and avoid sending sensitive information through ordinary messages or the contact form.

Information is kept for operation, moderation, payments, resolving disputes and applicable recordkeeping obligations. Account deletion removes account/private data through the deletion workflow, but published editorial material, necessary financial records, fraud/safety records and minimal audits may be retained, with identity links minimized where practical. Sponsorship contact details and payment-provider references can remain for bookkeeping and handling the relationship.

Different records need different retention periods; this policy does not promise a universal deadline. Deleted information may remain temporarily in backups, logs or retry queues, or with independent payment/authentication providers. We may disclose information when necessary to operate the service, address safety or fraud, comply with applicable legal obligations or respond to valid legal process.

You can edit supported profile fields in your account. For access, correction, deletion or privacy questions, use Contact Rock — Privacy/deletion. It is available without signing in, including after an account is deleted.

We confirm identity manually before releasing private information or making account changes. A form submission does not automatically delete an account. We may need additional information through a suitable private process; do not attach identification to a contact message. Some records may need to be retained for legitimate financial, safety, dispute or legal reasons.

Contact Michigan Over Fifty through the website inbox. This page will show the date of updates. We will provide notice of material changes to how we handle your information as required by applicable law.