CALLISTO VAULT PRIVACY POLICY
This Privacy Policy was last updated on April 17th 2026, and supersedes the previous privacy policy applicable to Callisto Vault.
This privacy policy is updated following Callisto Vault’s new partnership with Ampersands Advocacy Resources who will provide advocacy services. Previously Callisto worked exclusively with attorneys as Legal Options Counselors, which ensured an attorney client privilege protection of communications between survivors and their Legal Options Counselors. While certain state laws may offer some confidentiality protections depending on the advocate's qualifications, those protections are not absolute, and your communications with them do not carry the same legal protection. Please review this updated privacy policy carefully prior to updating your settings to select an advocate contact option.
This Privacy Policy describes the information we collect, use, and store when you create a Callisto Vault account. Callisto Vault is a separate service from Callisto Campus, which was sunsetted in 2020. If you created an account with Callisto Campus, the Callisto Campus Privacy Policy remains applicable to that account. If you visit our website without creating a Callisto Vault account, the projectcallisto.org privacy policy is applicable.
Callisto Vault is a suite of web-accessible tools built for survivors, by survivors, that enable you to create an Incident Log or enter into our Matching System. We understand that sharing any information related to a sexual assault is difficult and can create real risks for survivors. We designed Callisto Vault to minimize these risks.
Through encryption, we ensure that only you have access to information that identifies you or the perpetrator you have designated. If you enter a unique identifier that matches another user's unique identifier, thus naming the same perpetrator, only your assigned advocate will have the ability to see your identity and the unique identifiers of the shared perpetrator. Your advocate is a trauma-informed advocate provided through Ampersands Advocacy Resources who will help you navigate your options for taking action. Your entry information and all communications with your advocate are confidential to further protect your privacy, however they may be disclosed pursuant to a subpoena, court order, or other judicial or law enforcement process.
In this Privacy Policy, we explain in detail:
What information about you we collect and store when you create a Callisto Vault account
The purposes for which we use your Callisto Vault information and general user data
What limited Callisto Vault information Callisto employees have access to
What information your advocate has access to
What non-identifying information we share with third parties
How we protect your information
How your information may be subject to disclosure in response to legal process
1. WHAT INFORMATION WE COLLECT AND STORE
The type of information we collect and store depends on your activity after you created a Callisto Vault account. The description below details the information we collect in Callisto Vault only.
YOU CREATE AN ACCOUNT IN CALLISTO VAULT
The login credentials that you need to provide to us when you create a Callisto Vault account are:
Your school email address, so we can send you a link to create an account, or help you recover access to your account
Your personal email, so we can send you important update information, or help you recover access to your account
A username for your account. This user name does not need to identify you and can be different from your first and last names
A password to protect access to your account
Your phone number and an answer to a security question, which may be used to help you recover access to your account or for an advocate to reach out to you in the event of a match.
We take survivor privacy seriously at Callisto, and take appropriate measures to safeguard your identifying information. The data we collect at signup is encrypted at rest and can only be accessed by advocates in case of a match, or (in the case of your email) by an administrator if we need to send time-sensitive emails requiring your attention.
Once you create an account, Callisto Vault stores your username and password information in an encrypted form that Callisto Vault cannot decrypt. We therefore do not have access to your account information.
When you create an account, you will also be asked to provide demographic information. This information is completely anonymous and is not connected to your user name or in any way tied to your account. It will only be used in aggregate form, to help us understand Callisto Vault users without knowing who they are.
Your Callisto Vault account username and password are the only way to access any information that is stored in Callisto Vault, so it is important that you choose a username and password that you can easily remember, or store them in a safe and secure place. You can change your account password at any time.
If you forget your password or lose your backup code (no longer distributed), you can provide Callisto your email address and phone number, which will be immediately encrypted and matched with your account information (all in encrypted form). An email will automatically be sent to you with a link to a page with your security question where you can provide the answer to recover access to your account. Your email address is decrypted solely for our email vendor to send you your account recovery email.
YOU CREATE AN INCIDENT LOG IN CALLISTO VAULT
If you decide to create an Incident Log, you will be asked to fill in a form with a series of questions to help you describe the events around the assault or coercion. You can include as much or as little information as you like. All Incident Logs are protected by advanced cryptographic techniques and only you, using your account username and password, can access it.
YOU CREATE A MATCHING ENTRY IN CALLISTO VAULT
To create a matching entry and designate your perpetrator, we request that you provide the following information:
Your preferred name
Your phone number or email
Your preferred contact method (phone, email, text)
At least one unique identifier of the perpetrator you designate, such as their social media account information, phone number or email address
The state in which the assault occurred, so that in the event of a match, we can assign an advocate who can verify the confidentiality protections applicable to you and the advocate.
The school that you attend
Until there is a match, all of the above matching entry information is protected using advanced cryptographic techniques and is only accessible by you using your Callisto Vault username and password. No Callisto employee has access to this information, therefore we cannot share it with anyone. Unless and until a match happens, you are the only person who has access to this information. If a match occurs, the advocate assigned to you will have access to your matching entry.
You may access your matching entry to edit or remove it from our platform at any time. When you delete your entry, all information associated with it is permanently removed from Callisto Vault.
YOU ARE MATCHED WITH ANOTHER SURVIVOR
No additional information is collected. When the unique identifier you entered into the Matching System matches the unique identifier entered by another survivor, a match occurs and we generate a non-identifying unique ID that corresponds to that perpetrator. Your entry and the entry of the other survivor are then linked via the common perpetrator unique ID generated by Callisto Vault.
When this match occurs and the common perpetrator ID is generated, your assigned advocate will have the ability to decrypt and access your matching entry information. See Section 4, Who Has Access to Your Information, for further details.
YOU GIVE US FEEDBACK ON YOUR ADVOCATE
Once you have been fully guided through your options by your advocate, they will ask you to fill out a survey to provide us with feedback on your experience. This is done on a voluntary basis. We are solely interested in feedback regarding the skills, competence, and professionalism of your advocate. The survey is anonymous and does not collect any information about you.
YOU HAVE BEEN DESIGNATED AS A PERPETRATOR BY A USER OF CALLISTO VAULT
If you have been designated as a perpetrator by a Callisto Vault user, we will store an encrypted version of the unique identifiers used to designate you in Callisto Vault, such as your telephone number, email address, or social media account information.
All such information is protected using advanced cryptographic techniques and is only accessible by the Callisto Vault user who created the entry or, in the case of a matching entry, their assigned advocate. Advocates are under a duty of confidentiality and will never publicly share any matching entry or other information collected by the Callisto Vault user.v
2. Why We Collect and Store Your Information
In this section we explain for what purpose we use information you create and submit to Callisto Vault.
To Provide Our Services to You
All account information, Incident Log information, and matching entry information is used to provide Callisto Vault tools and services, including our advocate service. Specifically, we use your information to enable you to create a record of your experience, identify your offender, be matched with other survivors of the same offender, be connected with an advocate, and have the opportunity to coordinate action with other survivors of the same offender. We also use your information to enable you to provide feedback to us, including your level of satisfaction with your assigned advocate.
Matching entry information also enables us to link survivors of repeat offenders together through coordination with advocates. Callisto Vault is committed to stopping serial offenders from committing further acts of sexual misconduct and to building safe communities where such behavior is unacceptable.
Callisto Vault also allows you to manage your account settings, including updating your password, helping you recover access to your account, and sending you email messages about updates to our terms of service, privacy policy or other Callisto Vault feature updates.
To Measure Our Effectiveness and Impact
We analyze aggregate usage trends to understand how our users are using our tools, and which features appear to be more useful and have the most impact. Specifically, the non-identifiable data we collect about our users’ use of the Callisto Vault and services helps us understand how many:
Users create an account
Account holders create an encrypted record form
Account holders create a matching entry
Entries match as having designated the same perpetrator
Survivors benefit from the support of an advocate and the effectiveness of the advocate service to them.
This helps us in our decisions to develop new products, features and services, and to create a better website, tools, and services to further our mission to empower survivors of sexual assault or coercion to navigate inequitable systems utilizing technology.
3. HOW LONG WE KEEP YOUR INFORMATION
Email: When you first provide your .edu email address to us to receive the link to create your Callisto Vault account, or if you use your email to recover access to your account, your email address is stored in an encrypted form. We store your email address in our database in an encrypted form, which is normally only accessible by you or by the advocate assigned to you in case of a match. If we need to send a broadcast email about important updates to our system, we are able to decrypt your email to send it, after which the plaintext copy is deleted.
Account Information: Your encrypted username and password are maintained for as long as you wish to keep your account and have access to your Incident Log or your matching entry. If you terminate your account, all account information will be permanently removed from our systems.
Incident Log: Callisto Vault will store your Incident Log for as long as you wish to maintain it. You can delete it from the Callisto Vault system at any time. Once you delete it, all associated information will be permanently removed from our systems. If you terminate your account, your Incident Log and all associated information will be automatically deleted.
Matching Entry Information: Matches happen over time, and it is therefore important that our users’ entries are maintained and stored over time to enable the matching feature. If you delete your entry or terminate your account, the information from your matching entry is deleted.
If you do not delete your account, Incident Log or matching entry information, we retain your data for as long as we have a legitimate purpose to do so (and in accordance with applicable law), including to continue to detect serial offenders, assist with legal obligations, resolve disputes, and enforce our agreements.
If you terminate your account or delete your Incident Log or matching entry, Callisto will keep the demographic information that you provided upon creating your account, but that information is never associated with your account and so cannot be used to identify you.
In the event that Callisto merges with or is acquired by another organization, your information may be transferred to that organization. We will notify you of any such transfer. In the event that Callisto ceases operation and there is no successor, we will securely delete any collected information.
4. WHO HAS ACCESS TO YOUR INFORMATION
Callisto Employees
No Callisto employee has access to your Callisto Vault username or password, nor to your Incident Log, and therefore we are unable to share this information with anyone, even if requested by a court order.
Callisto employees have access to limited information from your matching entry in the event of a match as detailed below:
Non-identifying visitor ID and Callisto Vault account ID(s)
The state in which the assault occurred — accessible only if a match occurs
The college campus with which you are affiliated — accessible only if a match occurs
Access to this limited information is necessary to assign you to an advocate that can best support you in the event of a match. Callisto employees do not have access to any information identifying you or the perpetrator. Such information is encrypted and Callisto employees do not have the capability to decrypt it.
Your Advocate
When you create a matching entry, you provide unique identifiers of the perpetrator — such as a phone number, email address, or social media handle — thereby designating the perpetrator in Callisto Vault. If you match with another survivor, an advocate from Ampersands Advocacy Resources will be notified of the match and will use the contact information you provided when creating your account to reach out to you to help you navigate your options for taking action.
Your advocate will have the ability to decrypt and access the following information you provided in your entry: your name, your contact information, the unique identifiers of the designated perpetrator, and the college campus with which you are affiliated. Prior to entering into matching, you will be prompted to share your entry data with your assigned advocate in the event of a match, with the understanding that this information will be shared for the purpose of receiving support from your advocate.
Your advocate is a trauma-informed professional provided through Ampersands Advocacy Resources. Advocates are bound by strict confidentiality obligations, and cannot share your identifying information with anyone unless you explicitly authorize them to do so in writing. However, such confidentiality obligations can be overridden by a court order. If a judge issues a subpoena or order directing your advocate or Ampersands Advocacy Resources to turn over your information, they may have to comply. Your advocate can explain the specific confidentiality protections available.
No identifiable user information is ever shared between Callisto staff and advocates. Advocates do not have access to any information in your Incident Log, your Callisto Vault username, or your password.
Our Partners
Callisto partners with colleges, foundations, corporations, and nonprofits across the United States. We may share aggregate Callisto Vault usage information with our partners, such as the number of users who create an Incident Log, a matching entry, or the number of matches, but never in any way that would identify or enable the identification of a specific user.
Our Service Providers
Like all other technology and web platforms, we can not do it all alone. We work with vendors and service providers to help us run Callisto Vault.
During account creation, we offer the ability for users to check the security of their password through a third party password security service. This service is separate and distinct from Callisto Vault and so any password you check via their service is subject to this privacy policy.
We also use a third party email service provider to send you the link necessary to create your Callisto Vault account, or help you recover access to your account. Your email address is used solely for this purpose and is discarded by a third party email service provider after five days.
In addition to the vendors listed above, we work with other vendors and service providers to operate our website and platform. We use cloud-based data hosting providers to host and securely store user data and encryption key information, as well as vendors to support our website infrastructure and protect against third-party attacks. None of these vendors have access to your username, password, Incident Log, or encrypted matching entries. They may collect information about user activities on our web application, but not about individual users.
5. HOW WE KEEP YOUR INFORMATION SAFE, INCLUDING FROM COURT ORDERS AND SUPBOENAS
Callisto Vault was built by survivors, for survivors. We understand that reporting sexual assault and coercion creates risks for victims, so we care about the privacy and security of our users.
To stop the spread of sexual violence and misconduct while still protecting the privacy of both the victim and the accused, we built an advanced cryptographic approach for our product. This means that any information that personally identifies you and any information you provide in your entry (including the identity of the designated perpetrator) is encrypted. Encryption is the process of converting data to an unrecognizable or “encrypted” form. It is used to protect sensitive information so that only authorized parties can view it. Encrypted information will appear scrambled to anyone who tries to view it. It must be decrypted in order to be recognized or readable. This requires a password or a private key, which can be used to unlock files associated with the key.
When you create your account, your account login credentials are encrypted and not accessible to any Callisto employee or third party.
When you create an Incident Log, all information you enter is encrypted and not accessible to any Callisto employee or third party. Callisto can only see the total number of Incident Logs created on our platform.
When you create a matching entry, all identifying information is encrypted and only accessible to you. In the event of a match, your assigned advocate will also have the ability to decrypt so they can contact you at your preferred contact method.
What Happens if We Receive a Court-Ordered Request for User Information?
We designed Callisto Vault so that no one can access data that identifies you or the offender designated in your entry except you or your advocate. Callisto Vault is also designed so that only you can access your Incident Log entries.If Callisto is ordered to disclose such data by a court-sanctioned subpoena or court order, Callisto would simply be unable to produce it. While Callisto does not have access to any identifying information, general Callisto Vault usage data that we log may be crossed with other information obtained from third parties (such as your internet service provider) to provide additional information about your activities on Callisto Vault. In the event we receive a subpoena or court order to produce any information stored in our Callisto Vault systems, our attorneys will address each such request individually with the goal of protecting survivor privacy and confidentiality.
What Happens if You Receive a Court-Ordered Request for Your Information Stored in Callisto or Shared With Your Advocate?
Communications between you and your advocate including your Matching Entry information, will be confidential under applicable federal and state law, including privileges in certain states that protect communications with sexual assault counselors, domestic violence counselors, human trafficking caseworkers, and licensed psychotherapists. However, these protections are not absolute.
Your communications, records, and any information shared with your advocate may be subject to disclosure in response to a subpoena, court order, or other legal process issued in connection with civil litigation, criminal proceedings, or law enforcement investigations. In certain circumstances, a court may compel disclosure of information you share with your advocate, even over an objection based on federal or state law confidentiality.
Additionally, your counselor may be required by law to disclose certain information without your consent, including where there is a reasonable suspicion of child abuse or neglect, an imminent threat of serious harm to yourself or others, or as otherwise mandated by applicable reporting statutes.
Should you receive a subpoena to compel the disclosure of any of your matching entry information, your advocate can help connect you with legal resources as necessary, and we advise that you consult an attorney on how to respond.
Should you receive a subpoena to compel the disclosure of any of your Incident Log information, we advise that you consult an attorney on how to respond.
100% Security Cannot Be Guaranteed
While privacy and security by design is integrated into Callisto Vault, no internet-enabled data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any of the information you submitted to Callisto Vault has been compromised), please immediately notify us by contacting us at privacy@projectcallisto.org.
6. UPDATES TO THIS POLICY AND HOW TO CONTACT US
Modifications to This Privacy Policy
We may update this Privacy Policy from time to time as we update Callisto Vault and its features. We will notify you through a notification posted on our website, or as required by applicable law. Unless stated otherwise, modifications will become effective on the day they are posted.
Your continued use of Callisto Vault after the effective date of any change constitutes your acceptance of the revised Privacy Policy. The revised Privacy Policy supersedes all previous Privacy Policies.
Contact Us
If you have any questions or concerns regarding our Privacy Policy or the way in which we process or protect your information, please contact us at privacy@projectcallisto.org.