Privacy policy
Effective 4 October 2026. By accessing or using k9nightwatch.org or k9nightwatch.com you consent to the collection, use, retention and disclosure of information described in this policy, which forms part of the Terms & Conditions. The short version: we collect almost nothing, we never sell anything, a handler’s identity is never published, and anyone who wants it from us will need a court to say so — and the handler will hear about it first.
-
What the site does not do
No analytics. No advertising. No tracking pixels. No third-party scripts. No cookies set by us. No fingerprinting. The lookup on Verify a team runs entirely in your browser; the team number you type is hashed on your device and compared against a published file of hashes. We do not see what you look up.
-
What we collect, and only when you send it
Contact form: name, email, optional phone, country, who you are, what you want, and your message. Report form: country, what happened, the business or agency, city, date, the person who refused you, what was said, your name and email, optional phone and witnesses. Server logs: the IP address and timestamp of a form submission, kept for abuse prevention and rate limiting. We ask you not to include medical details in any form, and we do not ask for them.
-
Team records
A published record contains the dog’s name, team number, graduation date, status, breed, colour and trained tasks. It never contains the handler’s name, image, location, contact details, service history, diagnosis or any medical information. The roster from which records are built is held off-line, outside the web server, and the published lookup file contains only cryptographic fingerprints of team numbers, so valid numbers cannot be read out of it.
-
What we use it for
To reply to you. To place, train and support teams. To help you file with the regulator that has jurisdiction. To track businesses and agencies that refuse teams. To produce statistics that cannot identify anyone. To defend the program and its teams. Nothing else.
-
Who we share it with
Never sold. Never rented. Never traded. Never given to advertisers, data brokers or “partners.” We share a handler’s information only: (a) with the handler’s consent; (b) with a regulator or tribunal, in the handler’s interest, to pursue a refusal the handler has asked us to pursue; (c) with counsel acting for the handler or the program; (d) with the veterinary or training providers needed to support the team; or (e) when compelled by valid legal process, as set out in section 7.
-
Requests from businesses, landlords, carriers and agencies
We do not confirm, deny or discuss whether any person is a handler, to anyone, for any reason, without the handler’s written instruction. A business, landlord or carrier asking us to “verify” a handler is asking for something the law forbids it to require, and we will tell it so and tell the handler it asked.
-
Requests from governments and courts
We disclose personal information to a government or court only under legal process that is valid, specific and binding in the jurisdiction where the data is held. We review every request. We narrow or challenge requests that are overbroad or unlawful. Unless we are legally barred from doing so, we notify the affected handler before disclosure, so that they can object. We keep a record of every request received.
-
How long we keep it
Contact-form submissions: until the matter is closed, then no longer than two years. Refusal reports: for as long as the report may be needed to pursue, prove or defend a claim, which may be the full limitation period in the relevant jurisdiction, plus one year. Team records: for the life of the team and seven years after. Server logs: thirty days.
-
Your rights
You may ask what we hold about you, ask us to correct it, ask us to delete it, and object to any use of it, by writing through the contact page. We answer within thirty days. Residents of Canada have these rights under PIPEDA; residents of México under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (ARCO rights); residents of U.S. states with privacy statutes under those statutes; residents of the European Economic Area and the United Kingdom under the GDPR and UK GDPR. We apply the most protective of these to everyone, regardless of where they live.
-
Where the data is
The site and its form intake run on a server operated by the program in New York, United States. Rosters and form data are stored outside the public web directory. Access is limited to the people who need it to run the program.
-
Security
The site is served over TLS. Form submissions are rate-limited and screened for automation. Team numbers are unguessable by design and are published only as hashes. No system is perfect; if we learn of a breach affecting you we will tell you without undue delay and tell the regulator where the law requires.
-
Children
The site is for adults. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.
-
Changes
We may revise this policy. The effective date at the top changes when we do. We will never revise it to permit the sale of personal information or the publication of a handler’s identity.