Privacy Policy

NOFO is a federal funding discovery and pursuit platform operated by Sun Bear Industries (“we,” “us”). This policy covers the NOFO website and application, and the information we handle when a person creates an account, joins a team, or uses the product. It applies to tribal governments, tribal organizations, CDFIs, and the consultants and partners they invite.

It does not cover the federal opportunity information NOFO indexes. That corpus is public information published by federal agencies, and what your team does with it is not.

• Account information. Your name, email address, and profile image, supplied either by you or by the identity provider you sign in with (Google or Microsoft), plus the sign-in method itself. Passwords, when you use one, are stored only as a salted hash by our authentication provider; we never see them.
• Team and organization information. The team you create or join, the organization it represents, its roster, roles, and pending invitations.
• The work you put into NOFO. The goals and priorities your team writes, the opportunities it saves or dismisses, and the notes, statuses, and deadlines it records against them.
• Technical information. Standard server and application logs: IP address, browser and device type, pages requested, timestamps, and errors. We use cookies to keep you signed in and to remember interface preferences such as theme. We do not use advertising cookies or third-party trackers.
• What you send us. Messages sent through the contact form or to our support address, and anything you choose to include in them.

We do not ask for, and do not want, enrollment data, individual financial records, health information, or information about the people your programs serve. Please do not put it into NOFO.

• To operate the product: authenticate you, keep your team's workspace separate from every other team's, and match open funding programs to the goals your team has written.
• To communicate with you: sign-in and password emails, team invitations, deadline reminders you have turned on, service notices, and replies to messages you send us.
• To keep the service working and secure: diagnose errors, investigate abuse, and understand aggregate usage so we know which parts of the product to improve.
• To meet legal obligations, and to enforce our Terms of Service.

We do not use your team's work to advertise to you, and we do not build profiles of you for anyone else's purposes.

When you sign in with Google, we receive only your basic profile information: your name, your email address, your profile picture, and a stable identifier for your Google account. We request no other Google scopes, and we do not read your Gmail, Drive, Calendar, or Contacts.

That information is used for one purpose: to create and authenticate your NOFO account and to show your teammates who you are. It is never sold, never used for advertising, and never transferred to anyone except the service providers described in clause 06, who process it only to run NOFO on our behalf.

NOFO's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect NOFO's access to your Google account at any time at myaccount.google.com/permissions. Signing in with Microsoft works the same way, with the same basic profile information and nothing more.

NOFO uses AI to read open funding programs against the goals your team writes and to explain why each match fits. To do that, your team's goals, and the public text of the opportunities being considered, are sent to our AI provider for processing. Every match comes back with its reasoning, so your team can see why a program was suggested and decide for itself.

We do not permit our AI provider to train models on your team's content, and we do not train models on it ourselves. Your goals are used to find and explain your matches, and for nothing else.

We do not sell your information, and we do not share it with advertisers, data brokers, or funders. What your nation is planning to pursue is competitive information in a world of limited grant dollars, and we treat it that way.

We share information only in these cases:

• Your own team. Goals, saved opportunities, notes, statuses, and roster are visible to the members of your team, and to nobody else on NOFO. A team's owner decides who joins and can remove access at any time.
• Service providers. Companies that run parts of the product under contract with us: Supabase (database, authentication, and storage), our hosting and content delivery provider, our transactional email provider, and our AI provider. They may process information only to provide their service to us.
• Legal requirements. When we are required by law, subpoena, or court order, or when it is necessary to protect the rights, safety, or property of a person or of NOFO. Where we are permitted to tell you, we will.
• A change of ownership. If the company is acquired or merged, information may transfer as part of that transaction, subject to this policy. We would tell you before your information became subject to a different one.

Data is stored in the United States with Supabase, encrypted in transit and at rest. Access inside the product is scoped by team membership and enforced by row-level security on every table, checked by the database itself on every request rather than only by the application. Sign-in is handled by the identity provider you choose; email accounts must confirm their address before they work, and a password reset signs out every other session on that account.

We are a small company and say so: we do not yet hold formal certifications such as SOC 2, and this page will change when that changes rather than implying it early. No system is perfectly secure, and we do not claim otherwise.

We keep your account and your team's work for as long as the account is active, because that work is the point of the product. When you ask us to delete an account or a team, we delete its records from our production systems within 30 days, and from routine encrypted backups as those backups age out, within 90 days. Logs are retained for a shorter period for security and debugging. We may keep what the law requires us to keep.

• Access and export. You can ask for a copy of everything your team has created, and we will provide it.
• Correction. You can edit your profile, goals, notes, and team information in the product, or ask us to correct anything you cannot reach.
• Deletion. You can ask us to delete your account, or a team's entire workspace, and we will. There are no retention dark patterns and no exit fee.
• Communication. You can turn off deadline and activity notifications in settings. Essential messages about your account and the service are not optional while the account exists.

Email support@nofogrants.com and a person will answer. Depending on where you live, you may have additional rights under state or other privacy law; we extend the rights above to everyone rather than asking you to prove which apply.

The goals, pipeline, and records your team creates belong to your nation or organization, not to us. We hold them to run the service you asked us to run, and we will hand them back and delete them on request. A Nation's information is never treated as our asset and is never turned into somebody else's product.

NOFO is a tool for professional staff and is not directed to children. We do not knowingly collect information from anyone under 13. If we learn that we have, we will delete it.

We will update this page when the product changes, and we will move the effective date at the top when we do. For changes that materially affect how your information is handled, we will notify account holders by email before the change takes effect.

Privacy questions, access and deletion requests, and complaints go to support@nofogrants.com, addressed to Sun Bear Industries. We answer them ourselves.