Lake CherokeeHistoric District · Est. 1887
Join
ENES
Lake Cherokee

Privacy

This is a neighborhood website. It’s run by volunteers on near-free infrastructure, and the operating goal is to publish facts about Lake Cherokee, not to gather information about the people who read them. This page is a plain-English account of what that means in practice.

What this site counts

The site uses Umami to count how often each page is visited and to see the path visitors take through the site (for example: “10 visitors arrived on /history, and 4 of them clicked through to the heritage map”). Knowing which pages are useful, and where readers lose interest, is how the volunteer maintainers decide what to write next.

Every count is aggregate and anonymous. The site never sees who you are, and Umami’s design (described below) means it doesn’t either.

In addition to pageviews, the site fires a small set of named events so the maintainers can see which parts of the site are actually being used — not just visited. Each event is a short name plus, in some cases, a small property (the name of an official, the slug of a section, a destination domain, a filename). No identifying information is attached, and the cookieless session model below still applies.

The complete list of events the site fires:

What this site does not do

When you use the contact form

The contact form lets you send a suggestion, agenda request, or neighborhood issue report to the LCNA board. All fields except type, topic, and details are optional.

What you submit. The type of submission you chose, your topic, your description, and — if you chose to provide them — your name and email address.

What we store. Everything above is stored in a Cloudflare-hosted database so the board can review it. Your name and email address, if you provided them, are encrypted at rest with AES-256-GCM — the encryption key lives in the Worker’s secret store, separate from the database, so the database holds only the ciphertext. Your topic and description are stored as written, because the board has to be able to read and act on them. We also store a daily-rotating one-way hash of your IP address (used for rate-limiting — your IP is never stored raw) and a one-way hash of your email address (for the same purpose, if you provided one). We log the browser user-agent string that accompanied the request. Nothing in this list is published publicly.

Where it goes. Your submission is delivered to the board by email immediately. If you provided your email address, you will receive an automated confirmation and the board can reply to you. Your email address is not used for any other purpose.

Rate limiting. To prevent automated abuse, a short-lived counter keyed by IP and email hashes (not by identity) is maintained for up to one hour and then discarded.

Turnstile. The form uses Cloudflare Turnstile, an invisible challenge that confirms you are a person before delivering a submission. No interaction is required on your part. Turnstile is subject to Cloudflare’s privacy policy.

When you subscribe to the newsletter

The newsletter signup appears on /newsletter and inline on /community. Submitting it starts a double opt-in: the site sends a confirmation link to the address you provide, and your subscription only activates when you click it.

What the signup collects. Your email address, a Turnstile challenge response, and a timestamp.

What we store.

When editions arrive. Editions are sent by Resend — the same service the contact form uses. Every email includes List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) so your email client can show a native one-click unsubscribe button (see below).

Retention. If you unsubscribe, your subscription record is marked inactive immediately and no further editions are sent. The encrypted email address is retained so the site won’t re-add you without a fresh signup. If you also hold a member account with the same email, deleting the account (see the Deleting your account section below) lets you unsubscribe at the same time. To request deletion of a subscription record with no account behind it, email board@lakecherokeefl.org.

How to unsubscribe. Any of three ways works:

Turnstile. The signup form uses Cloudflare Turnstile the same way the contact form does — see “When you use the contact form” above.

The neighborhood’s residential units

Under the bylaws (Article IV), the association’s vote belongs to the home, not the individual — each occupied residential unit in the historic district is allocated one vote. To support that, the site keeps a registry of the district’s residential units, built once from public Orange County property-appraiser parcel records.

What the registry stores about a home. Its street address (street, house number, and any apartment or unit designation), the parcel’s property class (single-family, condominium, multi-family, apartment), whether it appears owner-occupied, and whether it sits inside the historic district. None of this is information the county doesn’t already publish.

What it deliberately discards. The source records also carry owner names and a full financial profile — assessed values, taxes, equity. The site keeps none of that. Owner names are reduced to a one-way HMAC-SHA-256 hash before anything is stored: the plaintext name is discarded and never published, and a one-way hash can confirm a match but cannot be turned back into the name. The raw property file is never committed to the site’s code and never uploaded to the server.

A residential-unit record is not an account. It means “this home exists and is in the district.” It says nothing about who lives there. People enter only by signing up, below.

When you join as a household member

Residents join the association by entering a one-time code mailed to their home on a postcard — or scanning its QR code — and then confirming an email address they control. That proves two things at once: that you receive mail at a real address in the district, and that the email is yours.

Signing up at a neighborhood event. There is a second way in, and it asks for less. At an occasional in-person gathering, the association may put out a QR code that lets anyone in the room sign up by choosing their address from the district’s list instead of entering a mailed code. That deliberately proves less: the mailed code shows you receive post at an address, while choosing one from a list shows only that you were at the event. We accept the difference because you are standing in a room with your neighbors, and we limit it in three ways — each event code works only during that event, it can be switched off at any moment, and a board member reviews every signup that arrives through one. If your home has no member yet and someone claims it this way, that review is where it gets caught.

What the signup collects. The mailed code — or, at an event, the address you picked and the event you picked it at — your name, an optional display name (how you appear to neighbors), your email address, your agreement to the current bylaws and to the Neighbor Data Pledge (the promise you make about how you’ll treat other neighbors’ information), and a Turnstile challenge response. If your address is one the county records leave unclear about how many homes it contains, you may also be asked, optionally, to describe which home is yours in your own words; that answer is stored on your signup for the board to read and never changes the district’s address list on its own.

What we store.

Confirming your email. Signing up and signing in both work by a one-time link emailed to you — there are no passwords to set or store. Sign-up links and sign-in links are single-use and short-lived, and only a one-way hash of each link’s secret is kept in the database.

Signing in with Google. You can also sign in — or, with a valid mailed or event code, sign up — by choosing “Continue with Google.” Google confirms your identity to us and shares your email address (and your name, if available), which we store exactly as described above. We also store a stable Google account identifier, so the link keeps working if your name or display changes, and we record which sign-in methods your account has. We never receive your Google password, and Google is told only that you signed in to Lake Cherokee — not what you read here. Google’s handling of the sign-in is governed by Google’s privacy policy. Signing in by an emailed link to your account’s email address always remains available, so this option is never the only way in.

When you ask the board to confirm your address. If you sign in with Google but have no mailed or event code, you can pick your home and ask the board to confirm you live there. Until a board member approves the request, your account is pending: it carries no vote and none of the verified-resident features (your household roster, household management, member-directory visibility). You can sign in to see that your request is “awaiting review.” The board sees your display name, your selected address, and a masked form of your email (for example m•••@example.com), and either approves the request or declines it with a reason emailed to you. A declined account is locked immediately (its sign-in stops working, so the same request can’t simply be retried) and is then deleted within 90 days.

Staying signed in. Once you sign in, the site sets a single lcna_session cookie so you don’t have to sign in again on every page. It is HttpOnly (page scripts can’t read it), it is never sent to any third party, and it has nothing to do with the anonymous analytics described above — it is not used to track what you read. The database stores only a one-way hash of the session’s secret, the browser user-agent, and a daily-rotating hash of your IP address (the same rate-limiting hash used elsewhere on the site). Signing out revokes the session immediately.

Administrative actions are logged. When a board administrator generates or revokes a code or changes a household record, the site writes an entry to an internal audit log — who acted, what changed, and when — so account changes stay accountable. This log is internal and never published.

Retention and deletion. You can delete your own account and household membership at any time from your account page — see the Deleting your account section below. To correct a record, email board@lakecherokeefl.org.

When the board invites you as a non-resident owner

Some parcels in the district are owned by people who don’t live here. The board can invite such an owner to hold an Associate account — a website account that carries no vote. Association membership and the vote follow residency, not ownership, so an Associate account is deliberately not a bylaws membership. These invitations always come from the board; there is no way to sign yourself up as an owner.

What the invitation collects. Your name and email address, both supplied by the board, and the language you’d like to hear from us in.

What we store. The same protections as a household member’s record above: your name encrypted at rest (AES-256-GCM), your email address encrypted at rest plus a one-way hash for deduplication, your chosen display name in plain text, and a record of which parcel(s) you own. You are not recorded as living at the unit, and you are never counted toward a household, a quorum, or any vote.

What board administrators can see. An administrator managing a parcel sees your display name and a masked form of your email — for example m•••@example.com — so they can tell two similarly-named owners apart, or see that an invitation went to the wrong provider. The full address is not shown on that page, and the masked form is deliberately not detailed enough to read back the address itself.

Removing the link. A board administrator can unlink you from a parcel — if a property changes hands, or an invitation was sent to the wrong address. That removes the ownership record only; your account itself is kept, since you may own another parcel. The unlinking is written to the internal audit log described above.

Retention and deletion. You can delete your own Associate account at any time from your account page — see the Deleting your account section below. To correct a record, email board@lakecherokeefl.org.

When the site notifies you

Signed-in members have an inbox at /inbox. It fills up when something happens that involves you — a reply to your comment, a meeting added to the calendar, an agenda published, a decision that affects your household.

What we store. One record per notification: which member it is for, what kind of event it was, which thing it was about, who acted, a one-line preview of the text, the link it points at, and the times it was created, delivered and read. The preview is a plain-text excerpt of content a neighbor wrote — it is kept as written, in the language it was written in.

Your settings. You choose how each kind of notification reaches you — inbox only, inbox plus an email straight away, inbox plus a daily summary, or not at all — on your account page. There is no kind of notification you are required to receive. Two things are worth saying plainly about how those settings are stored:

You can also mute a particular conversation. That is stored as one row naming the conversation, and it stops future notifications about that one thing without changing anything else.

The daily summary. If you’ve asked for any notification by daily summary, the site keeps a short queue of the lines waiting to go into it, along with the hour you asked for it. Lines are marked sent rather than deleted, so a double-send would be visible.

Retention. Notifications are kept until your account is deleted, at which point every notification, preference, mute and queued summary line for you is deleted with it. There is no automatic expiry before that — an old notification simply stays in your inbox, marked read. You can delete your account yourself from your account page — see the Deleting your account section below.

When you volunteer to help

The get-involved form lets you offer to help with a committee or a neighborhood effort. Your name and email are required, so a chair can reach you; everything else is optional.

What you submit. Your name and email, and — if you choose to give them — your phone number, your home (picked from the district’s list or typed in), the committees and roles you’re interested in, upcoming efforts you’d help with, your skills, your availability, and any notes you add. You can also ask the board to help you find a fit instead of naming a committee.

What we store. Your name, email, and phone are encrypted at rest with AES-256-GCM — the key lives in the Worker’s secret store, separate from the database, the same scheme the contact form uses. A one-way HMAC-SHA-256 hash of your email is stored for rate-limiting, and if you typed a home address it is encrypted the same way. Your committee and effort interests, skills, availability, and notes are stored as written, because a chair has to read and act on them. We also store the daily-rotating one-way IP hash and the browser user-agent, exactly as the contact form does. Nothing here is published publicly.

If you’re signed in. When you submit while signed in, your interest is linked to your member account, so you can review it — and withdraw it — from your account page. Withdrawing marks the interest closed; a chair no longer acts on it.

Who can see your contact details. A board member, or the chair of a committee you asked to join, can reveal your encrypted name, email, and phone in order to contact you. Every reveal is written to the internal audit log with the reason given. Your details are never shown to other members or to the public.

Turnstile and rate limiting. The form uses Cloudflare Turnstile and the same short-lived, identity-free rate-limit counter as the contact form — see “When you use the contact form” above.

Retention and deletion. Your interest is kept so the board and chairs can act on it. If you submitted while signed in, you can withdraw it yourself from your account page. Deleting your account strips the encrypted name, email, phone, and address stored on any volunteer form you sent — the same as for the contact form (see the Deleting your account section below). To remove a record you sent while signed out, email board@lakecherokeefl.org.

When you’re listed on a committee

The board keeps the neighborhood’s committees on the site. When you take a role — chair, co-chair, a committee member, a liaison — the board may add you to that committee’s page.

What we store. One record per listing: the committee, your role, and either a link to your member account or a plain-text name the board typed in for someone who isn’t registered yet. A record is only ever added by the board.

What the public sees. By default, only leadership names are shown publicly, and only as a first name and last initial — “Joseph W.”, never the full name. A signed-in member sees full names. Nobody’s email or phone number appears on a committee page unless you choose to share it, below.

Sharing your contact is opt-in, per channel. On your account page you can turn on “share my email” and “share my phone” separately. Both are off unless you turn them on. When a channel is on, other signed-in members can see it wherever you’re listed — for example on a committee you help lead. The public never sees either one. Turn a channel back off and it stops showing immediately; the setting is a single flag on your record, nothing more.

Retention. A committee listing is removed when the board removes you from the committee, or automatically if you delete your account (see the Deleting your account section below). To be taken off a committee page while keeping your account, email board@lakecherokeefl.org.

Your profile in the member directory

Signed-in members can fill in a profile on your account page and appear in the member directory, so neighbors can find each other by interest, language, and skill. The directory is members-only — the public sees a “for members” notice, never member data.

What you can add. A short bio, your pronouns, a profile photo, the interests and languages you pick from a set list, an approximate move-in date, skills you can offer, and a short pet introduction. All of it is optional, you write it yourself, and you can edit or clear any of it at any time.

You control what shows, field by field. Every field has its own show/hide switch, and there is a master “hide my profile entirely” switch that removes you from the directory altogether. The defaults are privacy-safe: your name, pronouns, bio, and photo start visible; your address starts hidden and the directory never lists addresses. A “sort by street” view can position you by street name only if you make your address visible, and it never shows a house number.

Your photo. When you upload a photo it shows right away — to other signed-in members, and, if you hold a public board office, on the public board page. A board member can hide a photo that breaks the community guidelines: hiding removes it everywhere, deletes the stored image, and sends you a note in your inbox explaining why, so you can upload a replacement. Uploading a new photo clears the hide on its own.

What we store. The profile fields above, in plain text (they are yours to publish and are governed by your per-field visibility, not encryption), plus the photo in a private store the site streams only to viewers your settings allow. A photo the board hides is deleted from that store. Deleting your account removes your profile, your photo, and its moderation history (see the Deleting your account section below).

When you add or RSVP to a calendar event

The community calendar shows neighborhood events, LCNA meetings, and civic dates. Signed-in members can add an event, and RSVP to one.

When you add an event. You write the title, description, date and time, an optional location, and — for a repeating event — a recurrence rule. You choose whether it is public or members-only. New member-authored events go to the board’s review queue before they appear; the board is notified. Your member display name is shown as the organizer on the event’s page, so neighbors know who to ask — on a public event, that name is public. If you would rather not have your name on a public event, don’t author one.

When you RSVP. Your “going” or “maybe” is one record per event, changed in place — it is a toggle, not a history. The count of who’s going is public. Names in the attendee list are shown only to signed-in members; the public sees the count alone. A member you’ve blocked (or who has blocked you) never sees your name in the list, though the count still includes you. If you RSVP “going”, you get a reminder in your inbox the day before the event, and everyone who RSVP’d is notified if the event is cancelled.

What we store. The event fields you write are stored as written and are meant to be published on the calendar. Your RSVP is a single row linking your member account to the event, with its status. None of this is encrypted, because it is either public or shown to fellow members by design.

Retention and deletion. Deleting your account hard-deletes your RSVPs (see the Deleting your account section below). An event you organized is kept on the calendar — neighbors may have planned around it — but your name is removed from it and the organizer shows as removed. The board can cancel an event; a cancelled event stays on the calendar with a “cancelled” note so anyone who RSVP’d sees why.

Deleting your account

Signed-in members can delete their own account from your account page — there is no need to email anyone, and deletion is reversible for 30 days.

How it works. When you confirm, your account enters a 30-day grace period. During it, your account still works, and you can sign in and choose “Keep my account” to cancel at any time. After 30 days, the account and its personal data are permanently deleted and cannot be recovered. We email you when you request deletion, so if the request wasn’t you, you can cancel it.

What is deleted. Your account and every device you’re signed in on, your sign-in methods, your profile, your household membership, your event RSVPs, your inbox and notification settings, and the encrypted name, email, and phone you gave us — including the ones stored on any suggestions or volunteer forms you sent.

What is kept, with your name removed. A small set of records the association is required to keep as a governance and legal trail: the internal audit and security logs, bylaws approvals and other decisions you took part in, the property and residency records for your home, committee-roster history, and any calendar events you organized (kept on the calendar, with the organizer shown as removed). In each, the link to you is severed and your encrypted personal data is removed, but the record itself remains. A vote you already cast belongs to your household, not to you, so it is unaffected.

The newsletter is separate. A newsletter subscription is a separate consent held against your email address, not part of your account, so deleting your account does not by itself unsubscribe you. The delete screen offers a checkbox to unsubscribe at the same time if you want to.

How “no cookies” still produces useful counts

Umami groups page hits into anonymous sessions by hashing your IP address together with your browser’s user-agent string, server-side, with a salt that rotates every day. The hash itself is what’s stored. The IP isn’t. Two visits within the same day from the same browser look like one session; the next day, the same browser looks like a brand-new visitor. There is no way to connect a session to a person, and there is no way to follow a session across days.

This is the technical basis on which Umami markets itself as GDPR-compatible without a consent banner, and it’s the reason this page is short.

Third parties any web visit naturally touches

When your browser loads a page on this site, a few other services see the request the way every web host sees every request:

Each of those services has its own privacy policy, linked above. Apart from Google Identity Services when you deliberately use it to sign in, none of them receive identifying information from this site beyond what your browser would send to any web server.

How to opt out

When this page changes

If the site adds, removes, or changes a third-party service, this page is updated in the same commit that makes the change — the two never drift apart. The site’s source repository is not currently public, so if you want to know what changed here and when, ask us and we will tell you.

Contact

Questions about anything on this page go to hello@lakecherokeefl.org.