Privacy · CivicScope

What we store

Your account: Your email address, your first and last name, the year you were born, and your password, stored only as a one-way hash (argon2id) that we can't turn back into the password. If you sign in with Google, we keep the Google account id and email Google shares with us.
Your address and districts: The address you enter, its location rounded to about 11 meters, and what it resolves to: your county, city or town, school district, precinct, and legislative and congressional districts, plus the officials and meetings for them. This is what makes CivicScope about your area.
About you: Your party registration (or "Prefer not to say"), and if you answer them: whether you're registered to vote at your address, how you usually vote, whether you own or rent, whether you have kids in public school, and how you heard about CivicScope. We use these to show the right primary ballot, deadlines and decisions first. Your party is never used to choose ads, and we never ask about immigration status, race, religion or income. Change or clear any answer on your Profile.
Your choices: The topics and levels of government you follow, when you finished setup, anything you follow, and your notification and consent settings.
Not your ballot picks: Who you plan to vote for never leaves your device. Picks on My ballot are kept only in this browser. They are not sent to our servers, not saved to your account, not in your activity log and not in your data export, so nobody at CivicScope can see them. Signing out erases them from the device.
Sign-in sessions: When and from which browser (its user-agent) you signed in, so you stay signed in for 30 days of use. The session cookie is random, and we store only a hash of it.
Your activity, only if you agree: With Personalize with my activity on, we record what you do in CivicScope: pages and bills you view, searches, questions you ask the bill analyst (that you asked, not the question's text), and what you follow. Never your ballot picks. We never record your address in this log. It is off until you turn it on.

Why we keep it

To show you your officials, meetings, bills and ballot, on any device you sign in on.
Your birth year, to make sure you are 13 or older and to tell you which elections you can vote in.
To keep your account secure: sessions, sign-in limits and password resets.
If you opt in: to personalize what CivicScope shows you first and, later, to send the notifications you ask for and to choose which ads or sponsored content to show you.
To meter the free bill analyst allowance per account.

Your controls

On your Profile you can:

Turn personalization and interest-based ads on or off at any time. Both start off.
Choose whether we email you, and how often. Nothing is sent until you opt in.
Download my data: everything above, as one JSON file.
Delete my account: signs you out everywhere and erases your email, name, password, address, choices and activity from our database right away. What remains is an anonymous record that an account existed, so usage counts still add up.

We share it only with the services that run CivicScope, each for its one job:

Google Maps suggests addresses as you type, and the U.S. Census Geocoder finds your districts. They receive the address you type, from our server, not your browser.
Resend delivers account emails (confirming your email, resetting your password) to your address.
Google, if you choose to sign in with Google.
OpenRouter and the AI model providers it routes to receive the questions you ask the bill analyst, with the bill text, to write answers. Your name, email and address are not sent.
Railway hosts our servers and database.

We disclose information if the law requires it, and we'll tell you when we're allowed to.

On your device

A copy of your profile, choices and last ballot is kept in your browser so CivicScope opens fast and works offline, along with your ballot picks, which are kept only there. Signing out removes all of it. Cookies: a session cookie (to keep you signed in), a cookie with your district numbers (never the address) so pages load for your area, and a few settings like light or dark mode. No third-party tracking cookies.

Security

Connections are encrypted, passwords are hashed with argon2id, session and email tokens are stored only as hashes, sign-in attempts are rate limited, and we never write passwords, tokens or full addresses to our logs.

Questions

Ask us anything about your data, or ask us to correct it, by replying to any email we send you. We'll update this page when what we do changes, and tell you in the app when it matters. How CivicScope works