Privacy policy
What this site collects
Effective September 10, 2026. Short version: almost nothing, nothing about your child, and nothing that goes to anybody else.
The short version
- Nothing on these pages reports your visit to anyone else. No advertising, no analytics, no tracking pixels, no social buttons, no outside fonts.
- One cookie, and only on the contact page, only to make that form's security check work.
- If you write to me, I keep what you typed so I can reply. Nothing else.
- Nothing is sold, shared, or handed to any agency, provider, or advertiser. Ever.
- Please do not send medical details or a Medicaid number. This is an ordinary website, not a secure health portal, and it is not covered by HIPAA.
- You can ask to see or delete anything you sent me. Just ask.
If you only read the pages
Reading Tu-Via requires nothing from you. No account, no email address, no cookie banner, because there is nothing to consent to.
Every file a page needs comes from tu-via.org itself: the stylesheet, one small script, the little icon in your browser tab, and the artwork, which is drawn inside the page rather than loaded as images. Every request your browser makes for a page here goes to this site and nowhere else. Nothing loads from Google, a font service, a content delivery network, or an advertising network, and the site's security rules block such a request even if one were ever added by mistake.
The practical effect: no other company learns that you visited, or which pages you read. That matters more than usual here. What a parent reads on a page about waivers, guardianship, or crisis supports says something private about their family, and it is nobody else's business.
Cookies
One, and it is not for tracking.
| Name | Set when | What it does | How long |
|---|---|---|---|
tuvia_sid |
You open the contact page | Holds a random session identifier so the form can prove your submission came from the form and not from somewhere else. It carries no name, no address, and no record of what you read. | Deleted when you close your browser |
There are no advertising, analytics, or preference cookies, so there is nothing to opt out of. If you never open the contact page, no cookie is ever set.
If you use the contact form
The form asks for a name to call you by, an email address or phone number so I can reply, an optional topic, and your message. That is all it asks for and all it stores, plus which page you were on when you wrote.
Deliberately not collected: your child's name, diagnosis, Medicaid or Social Security number, case number, or any medical record. The form does not ask, and please do not volunteer them. If you send them anyway I will delete them, but the safe move is not to send them at all.
Your address is not stored with your message. To keep spam robots from flooding the form, the site turns your network address into a one-way scrambled value, keeps only that, and counts how many messages it has seen recently. The original address is never written down and the scrambled value cannot be turned back into it.
How long things are kept
| What | Kept for |
|---|---|
| Your contact message and reply details | Until you ask me to delete it, or until it is clearly finished with. There is no fixed clock on this and I would rather you ask than guess. |
| The scrambled spam-limit value | 24 hours, then deleted automatically |
| Web server request logs (which include network addresses, as every web server's do) | 14 days, then overwritten automatically |
| Encrypted database backups (encrypted to a key held off the server) | 30 days on a rolling basis. A message you asked me to delete is gone from the live site immediately, and gone from the last backup copy within 30 days. |
Who else is involved
A short list, because the answer is nearly nobody.
- Studio Balke (opens an outside website) builds and operates this site and its server. It can reach the database in the course of running the thing.
- IONOS provides the physical server, in the United States. Like any hosting company it holds the machine the data sits on. It is not given the data for any purpose of its own.
- Nobody else. No analytics company, no advertising network, no mailing-list service, no artificial-intelligence service, no payment processor, because the site does none of those things.
One thing to know if you email instead of using the form: mail to tuviaorg@tu-via.org is handled by Google Workspace, so Google processes that message the way it processes any email, under its own terms. Messages sent through the form on this site are stored here and do not touch Google.
This site is not covered by HIPAA
Worth saying plainly, because a site about waivers and services can look like it would be.
HIPAA covers health plans, health care providers, and the companies working for them. Tu-Via is none of those. It is a parent with a website. There is no HIPAA protection here, no patient portal, and no secure channel.
So: anything genuinely confidential about your child belongs in a conversation with your case manager, your consultant, or your child's doctor, not in a web form. That is not me avoiding it, it is the honest limit of what a page like this can hold safely.
Children
Tu-Via is written for parents, guardians, and other adults supporting a child or adult with a disability. It is not directed to children, and it does not knowingly collect anything from a child under 13.
If you believe a child sent something through the form, tell me and I will delete it.
What you can ask for
You do not need to cite a law and you do not need a reason:
- See it. Ask what I hold from you and I will tell you.
- Fix it. Ask me to correct something you sent.
- Delete it. Ask me to delete your message and I will, from the live site straight away and from backups within 30 days.
Ask through the contact form or by email to tuviaorg@tu-via.org. I may need to reply to the address you originally wrote from, so I am not handing your messages to somebody claiming to be you.
Security, and its limits
The site is served only over an encrypted connection, the database sits outside the public web directory where no visitor can request it, the form is protected against cross-site submission and rate-limited against robots, and the daily backup is integrity-checked and encrypted before it is written, to a key whose private half is not kept on the server at all.
None of that is a promise of perfect security, and you should not trust any website with that promise. It means reasonable care has been taken with a small amount of data that was deliberately kept small.
Changes to this policy
If this changes in a way that affects what is collected or who sees it, the effective date at the top of the page changes with it, and the change will be described here rather than slipped in.
Tu-Via is not yet an incorporated organization. Two entities are planned, a nonprofit and an LLC, and that structure is still being worked out; see how Tu-Via is organized. If the site is ever transferred to one of them, or to anyone else, this policy carries over as it stands, and messages you sent are not part of any transfer without telling you first.
Questions about any of this go to the contact form or tuviaorg@tu-via.org. See also the terms of use.