Privacy Policy

1. Introduction

Welcome to the Prize App ("App"). We value your trust and are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. It also covers our public website, prize.vet — see "Website Visitors, Analytics & Cookies" below for exactly what the website itself collects.

By using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

2. Information We Collect

We collect personal information you provide directly, including:

• Contact Information: Name, email address, phone number
• Account Information: Username, password, profile picture
• Military Service Records: Information such as DD-214 if you choose to upload it

We also collect usage data (device information, log information, IP address, location information with your permission) and may use cookies and similar tracking technologies.

3. Veteran Verification Through VA.gov

You may choose to verify your military service through VA.gov, using the U.S. Department of Veterans Affairs ("VA") Veteran Service History and Eligibility API.

• Your VA sign-in: You sign in directly with the VA (via VA.gov, ID.me, or Login.gov). Prize never sees or stores your VA.gov, ID.me, or Login.gov credentials.
• What we receive: With your authorization, the VA shares a confirmation of your veteran status, your service history (branch of service, service dates, character of discharge), and — only if you use eligibility pre-qualification features — your VA disability rating.
• How we use it: To verify your veteran status, pre-fill your military history, and, with your consent, determine whether you meet a resource organization's eligibility requirements.
• What we do not do: We do not request ongoing access to your VA records — the access token the VA issues is used once to retrieve the information above and is not stored. We do not receive your Social Security number through this process. We never share raw VA records with resource organizations: organizations see only your verification status, or whether you meet their eligibility requirements, unless you explicitly choose to share more.
• Disability rating: We treat your VA disability rating as sensitive information with heightened safeguards (encryption at rest and in transit, restricted access, and audit logging). It is never shared with any organization without your explicit consent.
• Your control: Verification through VA.gov is optional, and alternative verification methods are available. You can revoke Prize's access to your VA profile at any time at VA.gov, and you can request deletion of VA-derived information by deleting your account or contacting us.

Prize is an independent company and is not affiliated with, endorsed by, or sponsored by the U.S. Department of Veterans Affairs.

4. How We Use Your Information

We use collected information to:

• Provide and maintain the App
• Facilitate access to services by connecting you with resource organizations
• Communicate with you, send notifications, and provide updates
• Improve the App through usage analysis
• Ensure security and protect against fraud
• Comply with legal obligations

Future functionality may include eligibility pre-qualification with your consent.

5. How We Share Your Information

We do not sell your personal information to third parties.

We may share your information only in the following circumstances:

• With Resource Organizations (With Your Approval): Only when you explicitly authorize us, and limited to what you choose to share.
• With Service Providers: We rely on a limited set of vendors (such as cloud hosting, analytics, and communications) to operate the App. They may access personal data only to perform services for Prize, only on our documented instructions, and are bound by written contracts (including data processing agreements) that require them to: safeguard the data with protections at least as strong as those in this policy; use it solely to provide services to Prize and for no other purpose; not sell it, share it, or use it for their own advertising or profiling; and delete or return it when our engagement ends. We do not authorize any service provider to use your information for its own purposes.
• With Advertising Partners (Public Website Only): On prize.vet — never in the App — we use Meta's advertising pixel to measure our advertising and to reach people who may be interested in Prize. Meta is not a service provider: unlike the vendors above, it may use what it receives for its own advertising and profiling, which is why we name it separately here. This covers website activity only (pages viewed, buttons clicked, forms submitted) and never includes anything from the App, your VA-derived information, your intake or Identity Brief answers, or anything you share with a resource organization. Section 8 explains how to opt out.
• Aggregated and De-Identified Data: Anonymized insights that cannot identify you.
• For Legal Reasons: When required by law or to protect rights and security.
• Business Transfers: If Prize is involved in a merger, acquisition, financing, or sale of all or part of its assets, your information may be transferred as part of that transaction. If that happens: (1) we will notify you by email and/or in the App before your information becomes subject to a materially different privacy policy; (2) any successor will be required to honor the commitments in this Privacy Policy or give you advance notice of any change; and (3) you will have the opportunity to delete your account and data before the transfer takes effect. We will never sell your personal data as a standalone asset.

6. Data Governance & Security

We follow data minimization principles and implement strong security measures:

• Encryption at rest and in transit
• Strict access controls and audit logging
• Regular professional penetration testing
• Additional safeguards for sensitive data like your DD-214 or VA disability rating

We collect only necessary information and share only the minimum required with your approval.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data. On a verified request, we permanently erase everything you created with Prize — including all VA-derived information — within 45 days. If a partner organization served you using grant funding, a limited compliance record may be retained for its funder; see "Data Retention & Deletion" below
• Opt-Out: Withdraw consent for certain data processing
• Additional Rights: Under GDPR or CCPA/CPRA (data portability, restrict processing)

To exercise your rights, contact us at prize@prizeapp.io.

8. Website Visitors, Analytics & Cookies

This section covers our public website, prize.vet, including the Identity Brief worksheet and our contact and signup forms.

• Analytics: We use PostHog, a U.S.-based analytics provider, to understand how visitors use the site — pages viewed, buttons clicked, and general device and browser information. We also collect aggregate interaction patterns (where on a page visitors click, scroll, and move the pointer) to improve page layouts. These are screen coordinates analyzed in aggregate — never the text you type, and never used to identify you. PostHog acts strictly as our service provider under a data processing agreement and may not use this data for its own purposes. Values you type into forms are masked and never collected by analytics.
• No session recording: We do not use session-recording or session-replay technology on this website. Your visit is not recorded or watched back.
• Browser privacy signals: If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we disable website analytics for your visit entirely and automatically — no banner, no settings required.
• Form security (reCAPTCHA): Pages with forms are protected by Google reCAPTCHA Enterprise, which loads only after you begin interacting with the page and is subject to Google's Privacy Policy and Terms of Service.
• Form submissions: Information you submit through a form on this website — your name, email, phone number if you provide it, and anything you choose to write — is used only to respond to you and to send the updates you asked for. It is processed by our communications service providers on our behalf, and every email we send includes a working unsubscribe link.
• Cookies and similar technologies: The website sets a small number of first-party cookies and browser-storage entries so analytics can distinguish new from returning visits, and to remember, for up to 90 days, a short tag for how you first reached the site (for example, the campaign or site that linked you here). When you submit a form we include that tag so we can tell which outreach works; it is never your browsing history.
• Advertising and measurement: This website loads Meta's advertising pixel through Google Tag Manager so we can tell whether our advertising actually reaches transitioning veterans and the organizations that serve them, and so we can show follow-up advertising to people who have visited. It records pages viewed, clicks on our app-store and form buttons, and the fact that a form was submitted — never the values you type. Meta may use this for its own advertising and profiling. Three things limit it: if your browser sends Global Privacy Control or Do Not Track, the pixel never loads at all, exactly as with analytics; it runs only on this public website, and the Prize App itself contains no advertising pixel or advertising SDK of any kind; and you can opt out independently through your Meta ad preferences or by emailing prize@prizeapp.io.

9. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA, as amended by the CPRA) gives you specific rights, and this section is our notice at collection.

• Categories of personal information we collect on this website: identifiers (name, email address, and phone number if you provide it); internet or network activity (pages viewed and interactions with the site, as described in Section 8); professional information (your organization's name, if you submit our organizations form); and any information you choose to include in free-text fields.
• Sources: directly from you when you fill out a form, and automatically from your browser as described in Section 8.
• Purposes: responding to your inquiries, sending updates you request, operating, securing, and improving the website, measuring and improving our advertising, and preventing spam and fraud.
• Retention: form submissions are kept only as long as needed for the purpose you submitted them, and you may request deletion at any time; website analytics data is retained on a rolling basis in our analytics provider's settings.
• No sale; limited sharing for advertising: We do not sell your personal information, and we never share App data, VA-derived information, or anything you write in Prize for advertising. We do share limited public-website activity with Meta for cross-context behavioral advertising, as described in Section 8. Prize falls below every CCPA applicability threshold, so these obligations do not currently attach to us, but we treat that sharing as sharing regardless: we honor the Global Privacy Control signal automatically — if your browser sends it, neither analytics nor the advertising pixel loads at all — and you can opt out at any time by emailing prize@prizeapp.io, which we honor as a Do Not Sell or Share request.
• Your rights: to know what personal information we have collected about you, to access it, to correct it, to delete it, and to not be discriminated against for exercising any of these rights. To submit a request, email prize@prizeapp.io. You may use an authorized agent; we will verify any request before acting on it, and we will respond within the timeframes the law requires.

10. Data Retention & Deletion

We retain your personal information only as long as necessary to provide the App and our services, comply with legal obligations, resolve disputes, and enforce our agreements.

You can delete your account and data at any time from within the App or by emailing prize@prizeapp.io. When you request deletion, we permanently erase everything you created with Prize — your profile, goals, reflections, messages, military history, and all VA-derived information such as verification status, service history, and disability rating — within 45 days of the request. Deletion is accomplished through cryptographic erasure (destroying the per-user encryption keys that protect your data) in addition to record deletion, and we instruct our service providers to do the same. Backup copies are purged on our regular backup-rotation cycle. We will confirm to you when deletion is complete.

One exception, and we want to be specific about it. If a partner organization served you using grant funding, that organization is required by its funder to keep records showing who it served and that they were eligible. Where that applies, we keep a limited compliance record on the organization's behalf: your name and date of birth, the information used to determine your eligibility, the services provided, and the dates. It does not include anything you created in the App, your messages, or any VA-derived information — those are erased in every case.

That record is held encrypted, for a period the organization sets to match its funder's rules, up to a maximum of seven years. It is not visible in anyone's day-to-day view of the App or the partner portal. It can only be opened in response to a specific audit request from that organization, and every time it is opened we record who did so and why. We can decrypt it in order to produce it for that purpose. When the retention period ends, the encryption key is destroyed and the record becomes permanently unreadable.

11. Dormant Accounts

If your account remains inactive for 24 consecutive months, we treat it as dormant. Before taking any action, we will notify you at your registered email and give you at least 30 days to keep your account active. If you do not respond, we will delete or fully de-identify your account and associated personal data using the same process described above, so that we do not hold your information longer than it is useful to you.

12. Data Breach Notification

We maintain a written incident-response plan. If we discover a breach affecting your personal data, we will: (1) contain the incident and revoke or rotate affected credentials; (2) investigate the scope, cause, and data involved using our access and audit logs; (3) notify affected users and the appropriate authorities without undue delay and within the timeframes required by applicable law; (4) remediate the root cause and strengthen our safeguards; and (5) document the incident and the corrective actions taken. Where VA-sourced data is involved, we will also promptly notify the U.S. Department of Veterans Affairs.

13. Children's Privacy

The App is not intended for individuals under the age of 18. We do not knowingly collect personal data from children without parental consent. If we learn that we have done so, we will promptly delete such information.

14. Data Location

Prize stores and processes your personal data on infrastructure located in the United States (Google Cloud Platform and Neo4j Aura, U.S. regions). We do not transfer your personal data outside the United States. If this ever changes, we will update this policy and put appropriate legal safeguards in place before any such transfer occurs.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email before the changes take effect. Please review the policy periodically for updates.

Questions about privacy?

If you have any questions about this Privacy Policy, the practices of this App, or your dealings with this App, please contact us.