Privacy Policy

Who we are

The Chagrin Valley Astronomical Society (“CVAS,” “we,” “us”) is an Ohio non-profit corporation founded in 1963 and recognized as a 501(c)(3) tax-exempt educational organization. We host monthly meetings, public observing nights, and outreach programs across northeast Ohio.

This page explains what information we collect through our website at cvas.space, why we collect it, and what choices you have. If anything here is unclear, please reach out via the Contact Us menu in the header.

What we collect

• Account registration: your email address, full name, and a salted bcrypt-hashed password. We never store your password in plain text.
• Member profile: phone number, mailing address, and an optional short bio. These are voluntary additions to your profile.
• Payment data: dues and donations are processed by Stripe. Card numbers are entered directly on Stripe’s servers; we never see them and we do not store them. We retain only Stripe’s opaque customer/subscription identifiers and metadata about successful charges.
• Session and security: a session cookie to keep you signed in and a CSRF token to protect form submissions. We log basic security events (sign-in attempts, password resets, two-factor changes).
• Communication preferences: opt-in flags for observing-night announcements, meeting reminders, and other notifications.

How we use it

• To run the society — member roster, dues processing, and event coordination.
• To staff the member directory and to send meeting and observing-night announcements that members opt into.
• To verify accounts (an emailed link confirms ownership of your address before activation) and to recover access (password reset, optional TOTP two-factor).
• To respond when you contact an officer.

We do not sell, rent, or trade member information. We do not use your data for advertising.

Member directory visibility

The directory is only visible to signed-in active members. Within it:

• Your name, email, and phone number are visible to other active members.
• Your mailing address is visible only to officers and admins.
• Pending users (those who have registered but not yet been approved) cannot see the directory at all.
• You can edit any of these fields, including phone and address, on your profile page.

Third-party services

We rely on a handful of outside services to run the site. Each is used for a specific, narrow purpose:

• Stripe — processes dues and donations. Subject to Stripe’s privacy policy.
• Google — we sync our public events with a CVAS Google Calendar and store officer-uploaded documents in Google Drive. Members are not asked to authenticate with Google to use the site.
• Astrospheric, ipgeolocation.io, sunrise-sunset.org, Open-Meteo, USNO — sky-condition and astronomy-data providers used by the public Sky page. We send only the observatory’s coordinates, never your personal data.
• Cloudflare — serves the site over its CDN; sees normal request metadata (IP, user-agent) for caching and abuse mitigation.

Data retention

We keep your account data while your membership is active and for a reasonable period afterwards for finance and records. You may at any time request:

• An export of the data we hold about you,
• Correction of inaccurate fields, or
• Deletion of your account.

Email any officer (see the Contact Us menu) and we’ll handle it. Note that some payment records must be retained for accounting purposes even after an account is deleted.

Security

• Passwords are stored as bcrypt hashes; we cannot read them and won’t ever ask you for them.
• Optional time-based one-time-password (TOTP) two-factor authentication is available on every account.
• The site is served over HTTPS.
• Account creation requires email verification.

No system is perfectly secure. If you suspect your account has been compromised, contact an officer immediately.

Children

CVAS welcomes families and young observers at our public events, but we do not knowingly create online accounts for children under 13 without parental consent. If you believe a child has registered, contact an officer and we’ll remove the account.

Contact

For privacy questions, data export or deletion requests, or anything else, reach an officer through the Contact Us menu in the header.

Changes to this policy

We’ll update this page when our practices change. The effective date below reflects the most recent revision. Material changes will be announced to members through the usual channels.