Privacy Policy

PikMi, operated by Sourcery DAO (“PikMi,” “we,” “us”), provides a free curbside donation pickup service in NW Austin, TX. Privacy is the core of how PikMi is built. This policy explains what we collect, how we use it, and the choices you have.

Information we collect

• Mobile phone number — so we can send you transactional text messages about your pickup.
• Pickup address — so a runner can collect your donation.
• Donation details — what you are donating, how many items, their estimated weight, and optionally their estimated value.
• Email address (optional) — to confirm your request, tell you when your pickup is complete or has expired, and send your donation acknowledgment if you ask for one.
• Your consent to text messages and when you gave it.

How we use your information

We use your information solely to coordinate and complete your donation pickup, to send you text messages and emails about that pickup, and — if you request one — to issue a donation acknowledgment for your records.

SMS / text messaging

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. The mobile phone number you provide is used only to deliver transactional pickup messages through our messaging provider (Twilio). We do not sell, rent, or share your mobile number or SMS opt-in data with any third party for marketing. See our SMS Terms & Conditions for opt-out details (reply STOP at any time).

What runners see

When you schedule a pickup, our volunteer runners get a text with the general area — your neighborhood, or “NW Austin 78750” — the number of items and your description of them. Please don’t put personal details in the description. Runners never see your phone number or email. Only the runner who claims your pickup sees your address, in the PikMi app, and they may open it in Google Maps for directions.

How we protect your address

• Your address is encrypted (AES-256-GCM) the moment you submit it.
• Only the runner assigned to your pickup can ever see it. Our admin dashboard never shows it.
• It is permanently deleted within 60 seconds of your pickup being finalized.
• It never appears in our logs or backups, and is never written to the blockchain.

Service providers

We share information only with the service providers we need to run PikMi:

• Twilio sends our text messages. It receives your phone number and the messages.
• Resend sends our emails. It receives your email address and the messages, including your donation acknowledgment.
• Google Maps Platform suggests addresses as you type. What you type in the address field is sent to Google and handled under Google’s Privacy Policy. The map runners see may also come from Google.
• OpenStreetMap places the general area on the runners’ map. It receives only the area and zip code, never your address.
• Slack carries alerts to our team about pickups that need attention: the reference number, the general area and, if a pickup could not be completed, the reason. Never your address, phone number or email.
• Our hosting provider runs the servers that store PikMi’s data. Your address, phone number and email are encrypted there.

Twilio, Resend, Slack and our hosting provider may use your information only to provide their services to PikMi, not for their own marketing.

How long we keep it

• Your address: permanently deleted within 60 seconds of your pickup being finalized.
• Your phone number and email: kept, encrypted, with your pickup record, so we can answer questions about it and reissue your acknowledgment. You can ask us to delete them at any time (see below).
• Server logs: our web servers record the IP address, page and time of each request, for security. They are kept for about two weeks and never contain your address, phone number or email.
• Backups: encrypted, kept for 30 days, and never contain your address.
• Visit statistics: kept on our own server and not backed up. They hold no IP address, contact details or anything you type (see below).

Blockchain audit trail

To prove that pickups happened and that addresses were deleted, we write a one-way cryptographic hash to the Base L2 blockchain. This record contains no personal information — no name, phone number, or address — only an anonymized hash.

Visit statistics

To learn how neighbors find PikMi and where our pickup form gets in their way, we count visits to our public pages with Umami, which runs on our own server: no outside company receives this information. For each visit we record:

• the page, the website you came from (its address only), and the campaign tag of the link you followed, such as a flyer’s;
• your browser, device type, screen size and language, and your approximate location (country, region and city);
• a few steps, such as starting or submitting the pickup form, the kind of error it showed, or installing the app.

We never record what you type into a form. Your IP address is used to estimate your location and to tell visits apart for one day, and is not stored. We never count runner or admin pages, receipts or pickup verification pages. If your browser sends Global Privacy Control or Do Not Track, we don’t count your visit at all.

Cookies

PikMi sets cookies only for our runners and admins: one keeps them signed in, and scripts on the page can’t read it. We use no tracking or advertising cookies, and our visit statistics store nothing on your device.

Your choices

You can opt out of text messages at any time by replying STOP. To request deletion of any information we hold, or for any privacy question, contact us at info@pikmi.xyz.

Contact

Questions about this policy? Email info@pikmi.xyz.