Privacy Policy
This policy covers vbgps.org and the Veteran Benefits GPS™ tool. Veteran Benefits GPS LLC runs both, and in this policy "I" and "me" mean that company. This policy says what the tool stores, what it never collects, what the company that hosts the site can see when it serves a page, and what happens to anything you choose to give me, including how to erase it. It is checked against the source code before every change to it. Where a sentence here and the software ever disagree, the software gets fixed or this policy gets fixed, the same week.
The optional account opens to everyone on November 11, 2026, and may open earlier for beta testers. Everything this policy says about an account describes what one is and what it holds. Until you make one, nothing the tool keeps is stored anywhere but in your own browser.
1. The short version
You can use the whole tool without telling me anything about you, and you never have to make an account. The tool offers an optional account from November 11, 2026. If you want it to remember your place when you change devices or clear your browser, you can make one. An account takes an email address and nothing else. You never create a password, because there is no password: you type your email address, I send you a single-use link that expires in fifteen minutes, you click it, and you are signed in.
Signed in or not, the only things the tool remembers about your use of it are which parts of the map you have opened and checked off, with the dates your journey started and was last touched; on your own device, whether its tips are on and which ones you have seen; and, with an account, the dates it was created and last used, when you accepted the Terms of Use and which version, and whether you turned on product updates and check-ins. With no account, that stays in your own browser, where I cannot see it. With an account, the map part is also stored on my side, tied to your email address and nothing else, so it can follow you to your phone.
There are no uploads, no cookies for advertising, no analytics code, and no advertising or tracking technology of any kind (the one exception, an ad's campaign code on the support page, is in section 7B). I never sell, rent, trade, or share anything I hold. The only thing that could ever make me hand anything over is a court order or a law that compels it, and section 10 says what I do then. Apart from your name on the Supporters page when you ask for it, no sponsor and no supporter ever receives anything about you. If you make an account, you can see everything stored against it, download a copy of it, and delete all of it yourself, from inside the tool.
Through vbgps.org there are only four ways I can ever hold anything about you, and each one is your choice: an account, if you want one; the "tell me on 11/11" list; a contribution; and an email you send me. Sections 2A, 6B, 7B, and 6, in that order, say what happens to each.
Cloudflare, the company that serves the pages, sees what every web server sees, your IP address and the pages requested, and keeps ordinary request logs for a limited time. Some public pages outside the tool also load a typeface from Google, whose servers see that request the same way. That is the whole story, and the rest of this policy is the detail.
2. What the tool stores on your device
This section is what happens with no account. Section 2A is what happens with one.
When you use the tool, your browser keeps a small navigation record in its local storage for vbgps.org. It has exactly seven fields: a version marker, which territory is open, which territories you have visited, which you have marked complete, which steps inside each territory you have checked off, the date this device's journey started, and the date it was last touched. Apart from the version marker, which is a short label the tool writes itself, every value is a date or is made up only of numbers. None of the seven fields can hold a name, an address, a service record, a claim detail, or any other identifying information, because there is no place in the record for it.
Beside the record, the tool keeps its tips setting in the same place: whether tips are on or off and which ones you have already seen. It says nothing about who you are, it never leaves your device, and it is never copied to an account.
The five population filters you can apply on the map are not stored at all. They reset when the page reloads or the tab closes. The state you choose on the State and Local Benefits territory works the same way: it is never stored and never sent anywhere, and it is gone when the page reloads or the tab closes.
The short questions at the front door work the same way. They only pick a starting place and whether some of the five filters start out on. Your answers stay in the page's memory on your device: they are never stored, never sent anywhere, and gone when the page reloads or the tab closes.
If you never make an account, this record never leaves your device unless you send its route yourself as a Route Pass (section 2B). The tool makes no network request that carries it, and there is nothing on my side holding a copy of it.
If you have an account and you sign in, those same seven fields are copied to your account so your place follows you from one device to another. If your account has nothing saved in it yet, what is in this browser is copied up and nothing is lost. If your browser and your account hold different progress when you sign in, I show you both and you choose. While you are signed in, a change on one device reaches the other; where one copy holds everything the other does and more, the fuller copy is kept, and where each holds something the other lacks, I show you both and you choose. Nothing is merged behind your back, and no progress is dropped without your choice. The seven fields do not change and nothing is added to them. The record cannot hold a name, an address, a service record, or a claim detail whether it sits in your browser or in your account, because there is still no place in it for any of that.
Once you have visited the tool, your browser may keep a copy of the tool's own public pages and files on your device so it can open without a connection, and you can add the tool to your phone's home screen. The copy is what every visitor is served and holds nothing about you, and nothing in it is sent anywhere. The tool asks the network for each page first, so you see the current words, and uses the saved copy of a page only when the network fails. Clearing your browser's site data for vbgps.org erases it, and a new version of the tool clears the old copy.
2A. Your account, if you want one
It is optional. The tool works completely without one. If you never sign in, you get the same content, the same navigation, and the same browser-only storage described in section 2. The account exists so you do not lose your place.
It takes an email address and nothing else. You type your email address. I send a single-use link that expires in fifteen minutes. You click it and you are signed in. No password is ever created, chosen, stored, reset, or sent, by you or by me. There is no security question and no answer to one.
What is stored against your account, and this list is the whole of it:
Nothing else is stored against it. Section 4 is the list of what is never collected, and it applies to accounts exactly as it applies to everything else. While you are signed in, your browser also keeps a sign-in session so that you stay signed in. It is used for nothing else, and it ends when you sign out.
What you can do with it, any time, without asking me. From inside the tool, signed in: see everything stored against the account, download a copy of it, and delete the account and everything stored against it. Deletion is immediate: the account and everything stored against it are erased from the tool the moment you do it. It is not a flag on a record that stays. There is no phone call, no form, and no waiting period. If the service that stores accounts keeps a short safety backup, a deleted account is gone from it when that backup ages out, and a deleted account is never brought back from one.
The only email an account brings is listed in section 6A.
2B. The Route Pass
On any territory, the tool can draw your route as a pass: a picture of where you have been on the map, with a link and a QR code that carry the same route. The pass is made on your own device, from the record in section 2, and nothing about it is sent to me or stored on my side.
The link carries navigation state and nothing else: which territory the pass is for, which stops you have opened and completed, and which steps you have checked off. It carries no name, no answer to any question, no filter, and no date, and the route sits in the part of a web address that a browser never sends to a server. Besides your route and the day the pass was made, the picture shows only the tool's own content: the territory and its steps, their form numbers and official pages, the date on or after which every link on the pass was checked against its official page, and, once a sponsor has paid, the sponsor credit.
The pass goes nowhere unless you send it. Share hands it to your device's own share sheet or copies the link on a browser that has none; Save to Photos (Download image on a computer) saves the picture to your device; and Copy link copies the link. Where it goes from there is your choice, through your own apps. The tool never reads your photos or your contacts.
Anyone who opens the link, on any phone or computer, sees that route on the map in their own browser, with no login and no account. Opening it adds the route to the record in that browser, opens its territory, and never removes any progress already there.
3. How long it stays and how to erase it
If you do not have an account: the record expires about twelve months after it was last touched on that device, which happens each time you open a territory, mark one complete, or check a step on or off there, and the tool erases it the next time it opens there after that. The check compares calendar months, so it can run up to a month early. Your browser may also erase the record sooner on its own. You can erase your progress at any time, without waiting, with the Reset Journey control inside the tool, which starts a fresh, empty record, or by clearing your browser's site data for vbgps.org. If the tool's internal format ever changes, anything stored in the old format is discarded rather than carried forward.
The tips setting does not clear itself, and Reset Journey leaves it as it is. Clearing your browser's site data for vbgps.org erases it.
If you do have an account, the twelve-month clock does not apply to what is stored in the account. Losing your place at twelve months is the exact thing the account exists to prevent, so replacing that clock is the point of it. It is replaced, not removed: an account that has not been signed in to or used for twenty-four months is deleted, along with everything stored against it, and I send a warning email thirty days before that happens so you can sign in once and keep it. Signing in resets the clock.
You do not have to wait for either clock. Delete the account yourself from inside the tool, at any time, and it is gone from the tool the moment you do it.
4. What the tool never collects
Inside the tool, your email address is collected if, and only if, you choose to make an account, and section 2A says exactly what happens to it. Apart from that one field, here is what the tool never collects or stores, at any point, with or without an account:
There is no place anywhere in the tool where any of it is stored, because sections 2 and 2A are the whole of what the tool stores. Some of the questions at the front door touch these subjects in general terms, such as how your service ended, whether a claim is in progress, or whether you have experienced military sexual trauma, so that the tool can pick where you start. Those answers never leave your device and are never stored, as section 2 says.
The tool itself sets no cookies and loads no analytics, no advertising scripts, and no third-party data services. If you have an account and you sign in, the sign-in session in section 2A is the only thing it adds in your browser beyond section 2, and it is never used for advertising, analytics, or tracking. There are no advertising or tracking pixels, and nothing about you ever goes to a data broker. No artificial intelligence reads or responds to anything you do in the tool; the navigation is rule-based and the same for everyone.
5. What the hosting provider and the other services see
The pages are served by Cloudflare, a hosting and content delivery provider, the way nearly every website is. When your browser requests a page, that provider's servers receive the standard information every web request carries: your IP address, the page requested, the date and time, and your browser's type and version. The provider uses this to deliver the page, to secure the connection (TLS), and to keep ordinary server logs for security and reliability. Those logs are kept by the provider for a limited time under its own retention policy and are not used by me to identify anyone. I do not add anything to what the provider logs by default, and I do not receive or keep a copy of those logs. The numbers I read from Cloudflare are totals, such as how many times a page was viewed, and they are never about any one person. Cloudflare may also set a short-lived security cookie of its own when it has to check that a visitor is a person and not an automated program.
Some public pages of vbgps.org that sit outside the tool load a typeface from Google Fonts. When one does, your browser asks Google's servers for it, and Google receives the standard information that request carries, under Google's own privacy policy. The tool itself calls no outside font service; its typefaces come with it.
The account needs two more services: a United States hosting provider to store the account database and a United States email delivery provider to send the sign-in link, the other account email, and the product updates and check-ins. Cloudflare, which serves the pages, stores the account database in its D1 database service, and Amazon Web Services sends that email through its Simple Email Service from a United States region. Both are United States companies. Each will be a service I use on a paid plan, never a free one, and each will work under a written agreement that lets it use what it stores or sends for me only to provide and maintain that service, to keep it secure, or when a law or a court order compels it. Neither may sell it, or share it with anyone except the companies it uses to provide that service, which are bound the same way.
Two more hold what you send me or what I must keep: my business email, which Google Workspace hosts, holds any email you send me; and my business records, including the contribution records my books need, are kept in a private, access-controlled repository that GitHub hosts. An AI assistant, Claude, made by Anthropic, reads, sorts, and files that business mailbox, drafts replies for me, and helps me keep my business records; no reply goes out without my review, except a standard reply whose words I have already approved, and Anthropic's own terms and privacy policy govern how it handles what it processes. The companies this policy names receive only what they need to run the site, the email, the payments, and my records for me, and each handles it under its own terms. Wherever this policy says that nothing about you is shared, handed to anyone, or reaches a third party, it means no one beyond them; an accountant or lawyer I engage, who must keep it confidential; anyone a court order or a law compels me to answer; and, if the business is ever sold, its buyer, who takes what I hold about you bound by this policy, except that no account, and nothing stored against one, passes to a buyer unless its holder agrees, as section 14 of the Terms of Use says. The one other exception is your name on the Supporters page, when you ask me to list it (section 7B).
6. Email
If you write to casey@vbgps.org, I receive your email and keep it in the business mailbox, which is a Google Workspace account. An AI assistant, Claude, made by Anthropic, reads, sorts, and files that mailbox and drafts replies for me; no reply is sent without my review, except a standard reply whose words I have already approved. I use your email to answer you and to act on what you wrote, such as fixing an error you report, and for nothing else. I do not add you to a mailing list. Writing to me does not create an account, and it does not sign you up for any email in section 6A or put you on the list in section 6B. If you ask me to delete the correspondence, I will, unless a law requires me to keep it.
If you ask for a sponsor seat on vbgps.org/sponsors, the page opens an email to casey@vbgps.org in your own email app, filled in with what you typed, and nothing is sent until you send that email yourself. The page stores nothing. Once you send it, it is correspondence like any other, and if you become a sponsor, I also use it to carry out the sponsorship agreement.
6A. The email I send to you
Here is every kind of email that comes from the tool or from the "tell me on 11/11" list. There are four, and there is no fifth kind:
- 1The launch note. One email, when the tool goes live, and only if you asked for it in the "tell me on 11/11" field. Section 6B is the whole story of that list.
- 2Account email, if you make an account. The sign-in link, which you get because you asked for it from the sign-in box. The link that confirms a new address when you change it (section 9). And the one warning, thirty days before an account that has not been signed in to or used for twenty-four months is deleted (section 3).
- 3Product updates and check-ins, if you have an account and turn them on. What is new in the tool and the occasional note asking how your journey is going.
- 4A notice this policy or the Terms of Use promise you. The one section 10 gives if anything I hold is ever exposed, and the one the Terms of Use give before the site and the tool pass to a successor.
That is the list. I never send you anyone else's message.
The launch note, the product updates, and the check-ins are treated as commercial email whether the law requires that or not, which means each one carries honest headers, a subject line that says what the email actually is, the business's real postal mailing address, and a one-click unsubscribe. That address is PO Box 2, Herod, IL 62947. Unsubscribing takes one click, does not require you to sign in, does not ask you a single question, and is honored within ten business days.
Unsubscribing never stops your account email. It stops the launch note, the product updates, and the check-ins, and nothing else. The sign-in link is how you get into your own account, you ask for it every time, and turning down my updates is never going to lock you out of your own record or cost you the warning before an unused account is deleted.
Sponsors and my email. Account email carries no sponsor content of any kind. The launch note, a product update, and a check-in carry no sponsor content.
Your email address is never sold, rented, traded, or handed to anyone, before or after you unsubscribe.
6B. The "tell me on 11/11" list
If you leave your email address in the "tell me on 11/11" field on vbgps.org, this is everything that happens to it:
7. Where the tool's links go
Almost every link in the tool opens a VA.gov page. The rest open another federal agency's page (DFAS, OPM, or SBA), the page of the VA's Office of Inspector General, the Veterans Crisis Line, another page of vbgps.org, or, in a sponsor credit, that sponsor's own website. Outside the tool, the site also links to the tool's own pages on social media. On the State and Local Benefits territory, once you choose your state, the territory links to that state's own official pages, such as its Veterans agency, its Veteran property tax exemption page, or its Veteran education benefit page, and, for a local program, to the official page of the local public body that runs it. Where the tool has not confirmed that state's own page for a step, it links instead to the VA's directory of state Veterans agencies, the Disabled American Veterans' office finder, and the House and Senate pages for finding your members of Congress. The state you choose is never stored and never sent to me or to anyone. When you follow a link to another site, you are on that site under its privacy practices, not mine. Like any site you arrive at from another, it can see at most that you came from vbgps.org and nothing more about what you did here. None of them sends me anything about you when you follow a link, and I send nothing about you to any of them. If you follow, subscribe to, or write to one of my own pages on social media, that platform shows me what it shows the owner of any page, such as a subscriber's email address, under its own privacy policy. A sponsor's agreement with me buys its credit and nothing about you (section 7A).
7A. Sponsors and supporters, and what they receive about you
The tool is free to every Veteran and it stays free. Businesses can sponsor it, and once a sponsor pays, the sponsor is credited on the tool's screens in two places only, by name and tier, in text, with no logo: the band at the foot of every screen, labeled "Sponsors" in plain words so you never have to guess what it is, and, for the first sponsor the band lists, the foot of the Route Pass. A sponsor's name and link, and its logo once the artwork passes screening, also appear on the Supported By page.
Apart from your name on the Supporters page when you ask for it, a sponsor receives nothing about you. Not your email address, not your journey, not which territories you opened, not a list, not a segment, not any other name. A sponsor never learns from me that any particular person used this tool. This is not a setting and it is not something a bigger sponsor can buy: nothing I hold about any Veteran is ever sold, rented, traded, shared, or used to target anything, by anyone, at any price.
A sponsor buys visibility and nothing else. No say in what the tool's guidance shows, links to, or recommends. No access to any Veteran's information. No placement inside the body of any step, territory, or route. No influence on the order or the content of anything in the tool's guidance. A credit identifies and never sells: it carries no call to action, no price, and no qualitative or comparative claim.
The same is true of supporters and of anyone else who helps pay for the work.
What a sponsor may be told is a count: how many times a page was seen, in total, and never who saw it. No per-person data, no lists, no identifiers, no segments, and nothing worked back from any one person's use of the tool. A count of visits is not information about you.
7B. If you contribute
If you contribute through vbgps.org/support, the payment itself happens on Stripe's own page, under Stripe's own privacy policy. To take a contribution I need what Stripe, the payment processor, needs: your name, your email address for the receipt, and your payment details, which Stripe holds and I never see in full. I keep your name and email, the amount and date of each contribution, and, if you came to the support page from one of my ads, that ad's campaign code, which Stripe records with the contribution so I can count which ad brought it. I keep them so I can send the receipt, honor a cancellation, answer you, keep my books, and list you on the Supporters page if you asked me to. I do not sell that information or share it except as this policy says, I do not add you to any list you did not ask for, and I keep it only as long as those purposes, the law, and the processor's rules require.
A listing on the Supporters page is your name and nothing else, never an amount, and you can ask me to take it down at any time. Nothing you type on the support page itself is stored on vbgps.org.
Contributing does not create an account. Creating an account does not contribute. A contribution record and an account are never joined, even when they carry the same email address. Apart from your name on the Supporters page when you ask for it, nothing about you from either place ever reaches a sponsor, a supporter, an advertiser, a broker, or any third party beyond Stripe; the companies section 5 names; an accountant or lawyer I engage, who must keep it confidential; anyone a court order or a law compels me to answer; and, if the business is ever sold, its buyer, who takes the contribution records bound by this policy, and an account only if its holder agrees to the move, as section 14 of the Terms of Use says. It is never sold, rented, traded, or used to target anything. The Supporter Terms at vbgps.org/support/terms say the rest.
8. Children
This tool is built for Veterans, service members, and the family members who help them. It is not directed at children under thirteen. There is nothing in it aimed at a child and nothing in it for a child to do: it is a map of benefits programs and a list of official starting points.
I am not going to tell you it collects nothing, because an account, the "tell me on 11/11" list, and a contribution each take an email address, and the federal children's rule counts an email address as personal information. So here is what I will tell you instead, and it is the truth:
9. Your rights
If you have an account, everything stored against it is yours to see, to take, and to destroy, and you do all three yourself:
If you do not have an account, the record on your device is yours to erase and section 3 says how.
Whatever else I hold about you, from an email, the "tell me on 11/11" list, or a contribution, you can write to me at casey@vbgps.org to see it, correct it, or have it deleted, and I will answer within forty-five days. I may ask you to write from the email address in question, so that I only ever answer the person it belongs to. I delete what you ask me to delete unless a law or the payment processor's rules require me to keep it. I answer that way whether or not your state's privacy law reaches a business this small, because sorting out which law applies costs more than simply answering you. I do not sell personal information and never have.
I do not respond to browser Do Not Track signals, because nothing on vbgps.org tracks you in the first place: no page carries advertising, analytics, or tracking code. The same goes for Global Privacy Control; there is no sale or sharing of your information for it to turn off. The one exception is the support page: when you arrive from one of my ads, it passes that ad's campaign code to Stripe with your contribution, as section 7B says. Apart from Cloudflare, which serves every page, the only company whose servers a page of vbgps.org calls on its own is Google, for the typeface in section 5.
If you have an account, you can also change the email address on it without losing your journey. I send a link to the new address, and the new address replaces the old one only after you click that link. Changing your email address never costs you your place, which is what the account is for.
10. Security
There is an account database, so here is what is in it and what is not. In it: email addresses, the seven navigation fields, the dates an account was created and last used, the date and time the Terms of Use were accepted and which version was accepted, whether product updates and check-ins are turned on, and, for each sign-in link, only a scrambled fingerprint of it, which cannot itself open an account; the link itself stops working within fifteen minutes. There is no password in it, anywhere, because the tool never creates one, so there is nothing in it that could be used to open an account of yours somewhere else. There is no name, no Social Security number, no service record, no rating, no medical condition, no claim fact, and no document in it, because the tool never collects any of those. A short list is easier to protect than a long one, and that is the main reason the list is short. The "tell me on 11/11" list holds email addresses and nothing else, and it is deleted within thirty days after its one use (section 6B).
The connection between your browser and the site is encrypted (HTTPS). If I ever learn that anything I hold or the hosting provider's logs were exposed, I will follow every law that applies, including the Illinois Personal Information Protection Act (815 ILCS 530). I will also tell the people affected, whether or not a law requires it for the kind of information I hold: by email where I hold their address and by a notice on vbgps.org where I do not.
If a court order or a law ever compels me to hand over something I hold, I hand over only what it compels and nothing more, and I tell the people it concerns before I do, wherever I can reach them and the law allows it.
11. Changes to this policy
When I change this policy, I change the date at the top. For a change that matters, I will post a notice on the site for thirty days before it takes effect. I will not start collecting information without changing this policy first and saying so plainly. The list in section 2A and the list in section 4 are the test: if either one changes, this policy changes first, and you will be told what moved.
12. Who to contact
Veteran Benefits GPS LLC, an Illinois limited liability company · casey@vbgps.org · PO Box 2, Herod, IL 62947