For security and procurement review
Security and accessibility
Impactful Networks, Inc. · Last updated: October 12, 2026
This page is for the people who review a purchase of the Creative Coping Toolkit: IT, security, privacy, HR and procurement teams. It explains in plain words how the toolkit, the app at creativecopingtoolkit.com, handles information and supports accessibility, and, more briefly, how this website does.
It is a summary. The full detail is in the Toolkit Privacy Policy and in this website’s Privacy Policy.
Where it runs
The toolkit runs on Cloudflare Workers, and the data it keeps, such as the anonymous usage totals behind your reports, is stored in Cloudflare D1, Cloudflare’s database. In plain words: the toolkit reaches people’s browsers from Cloudflare’s network, and what it keeps is stored with Cloudflare.
The toolkit’s sign-up and sign-in pages are protected by Cloudflare Turnstile, a check that tells people from automated traffic.
This website, www.impactfulnetworks.com, and the forms we run on it are also hosted by Cloudflare. The website is served over HTTPS only, and no customer data is stored on the website itself. Its service providers store data in the United States.
What the toolkit collects, and what it does not
People in your community never sign in, have no account and are never asked for their names. The only people who sign in are program managers, the staff who run the toolkit for your organization.
| Who or what | What the toolkit keeps | Where |
|---|---|---|
| People in your community | No name and no account. Their progress, settings and quiz scores. | In their own browser, on that device |
| Program managers | Name, work email address and job role; your organization’s details (name, type, city, state or country, and website); their confirmation that they are 18 or older and work with your organization; sign-in sessions, held as a random token kept only in scrambled form, with no IP address or browser details | In the toolkit. When your organization signs up or asks for pricing, we also add these details to our customer records system, Zoho CRM. |
| Usage counts | Daily totals, with no cookies, no IP address and no identifier | Cloudflare D1 |
| GiGi conversations | Nothing on our servers | In the person’s browser only |
| Survey answers | Answers to the toolkit’s surveys | Our own forms service, forms.impactfulnetworks.com. Your organization sees totals only, and never written answers. |
Reports show totals only, never one person’s activity. Reports are kept per organization and open only after a program manager signs in; they are never sent as password-protected files.
GiGi and the AI provider
GiGi is the toolkit’s AI guide. Every adult in an organization with GiGi on can chat with it, and your program managers can limit the chat to program managers who sign in. Teens on their own and children never get the chat.
- What is sent. What someone types in GiGi’s chat or in the Today box goes to OpenAI, our AI provider, to produce the answer. The chat also sends the page the person is on, the last few turns of the conversation and the day’s check-in (who is here and their age group). No name, email address or access code is sent.
- How long it is kept. OpenAI may keep what it receives for up to 30 days in its abuse-monitoring logs. Any Today box text the toolkit keeps is deleted after 30 days.
- Where conversations stay. A GiGi conversation stays in the person’s browser only. Nothing is kept on our servers.
- When someone may be in danger. Messages with words that suggest someone may be in danger are never sent. The toolkit shows crisis lines instead.
What the community link opens
Your community uses one link, your organization’s community link. Only signed-in program managers can see and copy it. It needs no sign-up, so anyone who has the link can use it. With it, they can:
- watch, read and do the activities of the programs your organization licenses, in English or Spanish;
- see your organization’s name and description, the links and pages you add, and your support lines;
- chat with GiGi, if they are an adult and your organization offers GiGi to every adult.
The link opens the group leader guides for someone who checks in as leading a group. It does not open your reports, your license details or the list of program managers, and it shows nothing about what any other person did.
What your organization controls:
- whether GiGi’s chat is for every adult or only for program managers who sign in (to switch GiGi off entirely, ask us);
- the link itself: your main contact and editors can replace it, and the old link then stops working;
- the links and pages, support lines and details your community sees.
When every license has ended, the community link switches off, and anyone who opens it reads “Access period ended”.
Analytics
The toolkit counts use in two ways:
- Its own anonymous usage counts. Short notes such as “a chapter was finished” are added to daily totals. They use no cookies and store no IP address or identifier, and they are kept in Cloudflare D1. Your reports are built from them. Visits to Get support, Help, Privacy, Terms and Settings are never counted, and neither are links to crisis lines or therapist directories. Anyone can turn counting off in Settings.
- Google Analytics, only after the person opts in, in the cookie notice or in Settings. It runs with IP anonymization and with no advertising or personalization signals.
This website uses Google Analytics 4, loaded through Google Tag Manager. Until a visitor accepts cookies, it sets none and cannot recognize a return visit. It records that a form was sent or a video was played, never what anyone typed. Like the website’s other service providers, Google stores this data in the United States.
Accessibility
The toolkit can be used with a keyboard, has labels for screen readers, and respects the reduced-motion setting on a person’s device. We check its color contrast with APCA, the contrast method in the draft of WCAG 3.
Settings has light and dark mode and an easier-to-read font. The toolkit works on phones, and people can switch between English and Spanish at any time.
There is no formal Section 508 or WCAG 2 conformance report (VPAT) for the toolkit yet.
Full policies and security questions
- The Toolkit Privacy Policy: everything the toolkit collects, the services it uses and how long data is kept.
- This website’s Privacy Policy: what www.impactfulnetworks.com collects, why, and who sees it.
To ask a security, privacy or accessibility question, email hello@impactfulnetworks.com.