Privacy Policy

Effective: October 7, 2026  ·  Last updated: October 7, 2026

1. Scope of this policy

This policy explains how SRO handles information collected through the SRO website, including the Community Research Intake form, technical security controls, standard web-hosting activity, owner notification emails, external links and third-party media that may appear on SRO pages.

This policy applies to the SRO section of the Grassroots Consulting website at grassrootsconsult.com/sasquatch/. A third-party website, media platform or source linked from SRO has its own privacy practices.

2. Information you choose to provide

The Community Research Intake form may collect the following information when you choose to submit it:

• submission type and your relationship to the information;
• witness, case or subject name or label;
• event date or time period and location;
• source links;
• the narrative or research information you submit;
• optional first name;
• optional last name; and
• optional email address.

First name, last name and email are not required. You may provide all, some or none of them. Providing an email address does not subscribe you to a mailing list and does not authorize SRO to contact you about the submission.

Your narrative can itself contain personal information about you or another person. Please provide only information relevant to the research lead and avoid unnecessary sensitive information such as Social Security numbers, financial account information, passwords, government-identification numbers, medical records or private home addresses.

3. How Community Research Intake stores submissions

SRO separates the research record from optional submitter identity information. The research record contains the research content, submission metadata, a stable submission ID and research-processing status. It does not contain the submitter’s first name, last name, email address or raw IP address.

If you voluntarily provide a first name, last name or email address, that information is stored in a separate private submitter-information record associated with the same submission ID. These private files are stored outside the public web root and are not intended to be publicly accessible.

A submission is a research lead only. Submission does not establish that a claim is true, does not create corroboration, and does not guarantee that a witness, case, source or claim will be published.

4. Why SRO processes submission information

SRO uses research submissions to identify material for possible research, verification, deduplication, provenance review, source recovery, correction of existing records and possible future inclusion in the Observatory under its normal evidence standards. Optional submitter information is retained for private project recordkeeping, provenance context and owner awareness. It is not required to evaluate the research lead and does not increase the evidentiary weight of a submission.

SRO does not sell Community Research Intake information, use optional submitter information for targeted advertising, or use it to create advertising profiles.

5. Owner notification email

After a submission has been successfully saved to the private intake storage, the SRO server attempts to send a private notification to contact@grassrootsconsult.com. The email contains the research submission and, when voluntarily provided, the submitter’s first name, last name and email address. This creates a private administrative copy of the information in the project owner’s mailbox.

The email is for owner awareness. It does not trigger personal research or outreach. SRO does not place a submitter’s email address in the notification’s Reply-To header.

6. Technical and security data

The intake handler uses technical information needed to protect the form from abuse. The server receives the requesting IP address as part of a normal web request. The SRO intake application uses that IP address transiently to create a secret-keyed HMAC value for rate limiting. The raw IP address is not written into the research submission or optional submitter-information record.

The rate-limit record contains a pseudonymous HMAC-derived key and submission-attempt timestamps. SRO uses it only for spam and abuse prevention. The application is designed to remove stale rate-limit state after the active security window rather than use it to track visitors.

Separately, normal hosting and server infrastructure may create access, error, security or delivery logs containing technical information such as IP address, browser or user-agent information, requested URL, date/time, referrer and response status. Those infrastructure records are used for hosting, reliability, security and troubleshooting and may follow the hosting provider’s own retention practices.

7. Cookies, analytics and third-party media

The deployed SRO site includes Google Tag Manager / Google measurement code. Depending on the tags configured through that service, Google may receive technical and usage information such as page URL, referrer, browser/device information, IP-derived information and interaction or measurement events, and Google services may use cookies or similar identifiers according to their own settings and privacy practices.

SRO does not intentionally combine optional Community Research Intake first name, last name or email fields with analytics identifiers, and those optional fields are not used by SRO for advertising or profiling.

SRO pages may also contain or link to third-party audio, video, documents, podcasts, archives or other media. Current SRO content includes integrations or links involving services such as Apple Podcasts, Spreaker, YouTube/YouTube-nocookie and other external research/source platforms. When third-party content is embedded or loaded, the provider may receive technical information about your visit, may set cookies or similar technologies, and may collect interaction data under its own privacy policy. SRO does not control a third party’s collection practices.

Following an external link takes you to a site governed by that site’s own terms and privacy practices.

8. Sharing and disclosure

SRO does not sell Community Research Intake personal information. Information may be handled by service providers that are necessary to operate the project, such as website hosting, server infrastructure and email-delivery services. SRO may also disclose information when reasonably necessary to comply with law, legal process, protect site security, investigate abuse, or protect rights and safety.

Research information may eventually contribute to a public SRO record only after it passes the project’s ordinary research and publication standards. Optional submitter first name, last name and email are not automatically published with a research record.

9. Retention

Research submissions and related provenance records may be retained long-term because maintaining an auditable research history, preventing duplicate work and preserving source provenance are core purposes of the Observatory. Optional submitter information may be retained privately with the associated submission for project recordkeeping unless it is removed under an applicable privacy request or is no longer needed for the stated purposes.

Security-rate-limit information is intended to be short-lived. Standard hosting, server and email records may have separate retention schedules controlled by the infrastructure used to operate the site.

10. Security

SRO uses technical and organizational measures intended to reduce unnecessary exposure of submission information. The intake design includes private storage outside the public web root, separation of research content from optional submitter identity information, restricted file permissions where supported, atomic file writes, input validation, request-size limits, spam controls and server-side rate limiting.

No website or storage system can guarantee absolute security. If SRO changes the way personal information is stored or used, this policy should be updated to reflect the change.

11. Children

SRO is a general-audience research project and is not directed to children under 13. Children under 13 should not submit personal information through Community Research Intake. If SRO learns that it has collected personal information online from a child under 13 in circumstances requiring removal or parental authorization, the information will be handled in accordance with applicable law.

12. Your privacy choices and requests

Because first name, last name and email are optional, the simplest privacy choice is to leave them blank. You may also ask about, correct or request deletion of personal information that you voluntarily provided. Send privacy requests to contact@grassrootsconsult.com and include the submission ID if available so the record can be located.

Because SRO permits anonymous submissions, SRO may be unable to identify an anonymous research record as belonging to a particular requester. Research records may also need to be retained when necessary for legitimate research provenance, security, legal obligations or other permitted purposes.

The statement “we will not contact you” applies to unsolicited outreach because you submitted a research lead. If you initiate a privacy or administrative request, SRO may respond to that request.

13. Changes to this policy

SRO may update this policy when the project’s data practices, technical systems or legal obligations change. The effective/updated date at the top of this page identifies the current version. Material changes to how voluntarily supplied personal information is used should be disclosed before the new use is applied.

14. Contact