Privacy Policy

Keystone is a free membership platform for Masonic bodies (Lodges, Chapters, Councils and Commanderies) and the Grand bodies they associate with. It is operated by JPSA Technologies, LLC, a company in the United States ("we", "us"). Our servers are in the United States.

Keystone is invitation-only. There is no public sign-up: you have an account because a body you belong to invited you.

Your body decides what is kept about you. Each body is a separate space on Keystone with its own records, officers and finances. The body, through its officers, decides which member records to hold and why. We provide the system, keep it secure and run it. Records of one body are not open to another body, except for the limited sharing described in section 6. If you want to know what a body holds about you, or want it changed, start with that body's Secretary.

For the things we run ourselves, such as signing you in, securing the platform and answering for its operation, we decide the purpose and are responsible for them.

We collect what your body, and you, put into the platform, and a small amount that the platform itself records:

• Account information: your name and email address, and the sign-in methods you set up (see section 4). You do not register yourself; an invitation creates the account.
• Profile information: details such as phone number, mailing address, date of birth, a short biography, emergency contacts and family links, whatever you or your body's officers enter. You choose whether you appear in your body's member directory.
• Membership records: which bodies you belong to, your status, degrees and dates, member numbers, offices you hold, committees, attendance and similar records kept by the body. Membership in a Masonic body can itself be sensitive, so Keystone treats it that way: it is not shown publicly, and a body sees only its own members.
• Financial records: dues invoices, payments, receipts and the body's ledger entries that mention you. This includes payments you report yourself, such as a Zelle or Venmo transfer, which a treasurer then verifies.
• Messages and uploads: announcements, notifications and emails sent through the platform, and files your body uploads, for example a scanned petition.
• Security and activity records: sign-in times, the session, and an append-only audit log recording who did what, to which record, and when, for sensitive actions such as suspensions, exports, permission grants, erasures and financial postings.

We do not collect card numbers (section 7), we run no advertising, and we do not use analytics or tracking tools from outside companies on the platform.

• To run the platform for your body: membership records, dues, events, communication.
• To sign you in, enforce the second factor and keep accounts secure.
• To send you the email and notifications your body sends and the ones the platform needs (sign-in codes, receipts, reminders).
• To keep the audit trail that makes changes to a body's records traceable.
• To produce the reports and exports a body needs to run itself, and to answer data requests (section 9).
• To meet legal duties and to preserve records when the law or a legal hold requires it.

We do not sell personal data, and we do not use it for advertising or to build profiles for anyone outside your body.

• Encryption at rest: personal data that identifies a member, such as phone numbers, addresses and dates of birth, is encrypted in the database with AES-256-GCM.
• Encryption in transit: the platform is served over HTTPS, with HSTS and other browser protections.
• Sign-in: an emailed one-time code or a passkey, with a password kept only for accounts that already have one. Passwords are stored as bcrypt hashes. Every user must also set up a second factor (an authenticator app or a passkey); no session starts until it is answered.
• Short sessions: a session ends after 30 minutes. Sessions are stored on the server, so ending one takes effect immediately.
• Separation between bodies: every query is limited to the body it belongs to, and what a person may do is decided by their role, the offices they hold and any permission specifically delegated to them. There is no general administrator override. For the audit log and uploaded files, the database itself also refuses to return another body's rows.
• Tamper-evident audit log: entries are hash-chained, so changing or removing one after the fact is detectable.

No system is perfectly secure, and we cannot guarantee absolute security. Keystone has not been penetration tested by an outside party. If you suspect a problem, tell your body's Secretary right away.

Keystone uses only the cookies it needs to work. It uses no advertising, analytics or tracking cookies.

• Session cookie (__Secure-better-auth.session_token): keeps you signed in. It is secure, HTTP-only, same-site, belongs to the Keystone address you are using only, and the session behind it lasts 30 minutes.
• Second-factor cookie (better-auth.two_factor): set briefly while you are in the middle of answering the second-factor challenge, for about ten minutes.
• Cross-site request protection: Keystone refuses state-changing requests that come from another origin rather than using a separate cookie, so there is no CSRF cookie.

Your browser also keeps a theme preference (light or dark) and, if you dismiss them, the prompts about installing the app or turning on notifications, in its local storage. These stay on your device. Blocking cookies will stop you signing in.

• Your body's officers, according to the permissions of their office. A treasurer sees finances; a secretary sees membership records.
• Other members, only as far as you and your body allow, for example the directory if you opted in.
• Grand bodies. Bodies join Grand bodies voluntarily. A Grand body can see what that arrangement needs, such as roster counts used to calculate per-capita fees (the count is frozen on the invoice) and training completions on courses it shares. A body that leaves an association keeps its records.
• The public, for what a body publishes on its own public website, such as its officers, events and calendar. Keystone has no public member list.
• Platform staff. JPSA Technologies, LLC operates the system and can reach it in order to run, secure and repair it. The platform records sensitive actions in the audit log.
• A body's own WordPress site. A body can connect its own WordPress site to Keystone. If it does, an officer must first accept a data-handling notice, and Keystone then sends that body's member records (name, email, contact details, status, degree, offices and similar) to that site. The site is run by the body, not by us, and its handling of the data is the body's responsibility. Sending is one way: nothing is written back to Keystone.
• Authorities, where the law requires it.

We use the following outside services to run Keystone:

• Hostinger hosts our server and the domain's DNS. Your data is stored on that server in the United States.
• Let's Encrypt issues the certificates that make HTTPS work. It sees the platform's web addresses, not member data.
• Your body's payment processor. Keystone does not have a payment processor of its own. Each body chooses and connects its own (for example Stripe, PayPal, Square or Authorize.net) using its own account. When you pay by card or bank transfer through a body's page, you are paying at that processor, which collects your payment details under its own privacy policy. Keystone does not receive or store your card number; it receives the result of the payment. Apple Pay and Google Pay, where offered, work through the processor.
• Your own email provider. Keystone sends email from its own mail server. Once a message reaches your email provider, that provider handles it.
• Google, Microsoft or Apple sign-in, only if enabled for the platform and only if you choose it. It matches you to your existing invited account by email; it cannot create an account.

A body that uses Keystone training content can also send learning records to its own learning record store; that is configured by the body, not by us. We do not send text messages: the text-message tool records opt-in and opt-out choices, but nothing is delivered.

• While you are a member, a body keeps its membership, finance and officer records. Bodies are required by their bylaws and by law to keep some records for a long time, and an officer's term is part of the minutes, which a body keeps permanently.
• The audit log is kept, because its purpose is to be a lasting record. It does not store values removed by an erasure.
• When a body closes or merges, its data is built into an encrypted archive about 90 days later and kept for seven years. The live data is not deleted before the archive is verified and the seven years have passed, unless the body signed a waiver asking for permanent deletion earlier. A legal hold stops deletion altogether until it is lifted.
• Exports. A body can export its complete records at any time, including in an encrypted form that only the body can open. Download links expire; a body-held decryption key for an export is retired after two years.
• Copies kept for recovery are replaced over time and may briefly hold data after it has been deleted from the live system.
• Technical logs are kept only as long as needed to run and secure the service.

Depending on where you live, you may have rights over your personal data, including those below. Because your body keeps your records, requests go through the body, and it must answer within 30 days.

• Access and a copy: a structured, machine-readable copy of your data.
• Correction: you can edit your own profile in Keystone; your Secretary can correct membership records.
• Erasure: you can ask for your personal data to be erased. See below.
• Restriction and objection: you may ask your body to limit or stop a use of your data. Keystone has no automated tool for this, so the body handles it by hand and decides under the law that applies to you.

How to ask. Ask your body's Secretary, who records the request in Keystone with its date and due date. Officers are alerted before the deadline.

Erasure can be refused, and you are told why. A body must keep records of its own membership. Erasure is refused, with the reason in plain words, while: a legal hold applies; you owe the body money; you hold a current office; a suspension or expulsion is in force; or you are still recorded as a current member (including suspended). It can be asked again once that changes. When erasure goes ahead, your name, email, phone, address, date of birth, biography and picture are removed and the account becomes unidentifiable. The internal record number stays so that the body's ledger, history and audit trail remain intact. Because one account can belong to several bodies, each body answers for its own records, and the shared account is cleared only when no body has grounds to keep it. Files a body uploaded, such as scans, are not removed by an erasure request.

If you live in California, the EU or the UK, you have the rights your law gives you, and you can complain to your local regulator. We do not sell or share personal data for advertising.

Keystone is for adults only. Membership is limited to adults, and the service is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child's data is on the platform, tell the body's Secretary so it can be removed.

Keystone is hosted in the United States. If you use it from another country, your data is transferred to and stored in the United States.

When we change this policy we post the new version here with a new "Last updated" date. Please check it from time to time.

For anything about your own records, or to make a request under section 9, contact your body's Secretary. For questions about the platform itself, ask your Secretary to take it to the platform operator, JPSA Technologies, LLC.