Your data on CivicView

Privacy policy

This policy explains what CivicView collects, why, who can see it, who else receives it, how long we keep it, and what you can do about it. We wrote it in plain English, and we describe what the app actually does today, including the parts we plan to improve.

The short version. We collect what we need to show you who represents you, let you take part, and keep accounts safe. We don't sell your data, show ads, or use advertising or analytics trackers. Your individual poll votes and likes are never shown with your name. Comments and polls you write are public, with your display name and the place they were written from. CivicView is for adults 18 and older. You can see, correct and delete your data at any time.

Who we are and what this covers

CivicView is run by CivicView, Inc., a Florida benefit corporation (“CivicView,” “we,” “us”). This policy covers civicview.app, the CivicView Android app on Google Play and the Windows app on the Microsoft Store, which all use the same service. It applies to everyone who uses CivicView: visitors, citizens, elected officials and their staff, and candidates. You can reach us at civicview@civicview.app or at CIVICVIEW, INC., PO Box 621182, Orlando, FL 32862-1182.

What we collect

If you browse without an account

You can read CivicView without signing up. We still receive the technical information every website receives (see Technical information), any address you type into the lookup, and anything you choose to send us.

Citizen accounts

Email address and password. For signing in and for messages about your account. We store your password only as a one-way hash. Demo accounts get a generated address that receives no mail.
Contact email (optional, demo accounts only). If you add one, we use it only for your account: the sign-in email you can ask for when you create the account (your generated sign-in address and a link to choose a new password, never your password), password reset emails, and one notice before demo accounts are retired.
Display name. The name you choose. It appears on the comments and polls you write. No two accounts can share a name, and citizens can't use the names of members of Congress, other federal officials, governors and statewide officials, or officials and candidates with a CivicView account.
Age confirmation. When you create an account, you confirm that you're 18 or older, and we keep the time you confirmed it.
State and congressional district (required) and city (optional). We use them to show you your officials, ballot and elections, and to count engagement by area. You can change them in Settings on your dashboard. If you use “find my district from an address,” the address is handled like the address lookup below and isn't saved to your account. For a verified account, these come from your verification.
Your settings. Your start page, notification settings (for each kind of alert, whether it reaches the bell, your phone or your email; quiet hours; how often you're alerted; whether notifications show details; and your time zone offset, which also sets the times shown in your pushes and emails), whether you want the weekly digest email (off unless you turn it on), the officials, bills and elections you track, save or feature, and the officials you mute.
Bills you track. Once a day we check each federal bill someone tracks on Congress.gov, the official source, and record its latest action so we can tell you when it changes. We send Congress.gov only the bill's number, never anything about you. We record which bill updates we sent you so you never get one twice.
Polls you voted in. When a poll closes, we use the record of who voted in it to tell those people the results are in. Your vote itself is never shown to anyone.
What you do on CivicView. The polls you vote in and your choice, the posts, comments, polls and bills you like or dislike, the comments you write and the polls you create. Each vote, like and comment is recorded with the state, district, city (and county, where known) of your account at that moment and whether your account was verified, so it can be counted for the right area.
Edits and deletions. When you edit or delete a comment, we keep its original text, hidden from everyone, so moderation decisions can be checked. It's removed when you delete your account.
Optional poll questions. See Optional poll questions below.
Notifications. The in-app notices we send you, such as a reply to your comment (which includes the replier's display name and a short preview).
Election reminders. Before voting deadlines and Election Day, we send a reminder with the date and a link to the state's official election site, the same for everyone in that state, to citizen accounts in each state where we have its dates from official sources, and to anyone tracking an election in one of those states. We use your account's state, the elections you track and your time zone offset to choose and time them, and we record which reminders we sent you so you never get the same one twice. If you tap “I already voted” on a reminder, we record that for that election only, so we stop reminding you; it isn't shown or shared with anyone, and you can undo it. If you turn on reminder emails, we also send them to your sign-in email. You can turn reminders off from any reminder or in notification settings.
Reports and appeals. When you report content, we record that you reported it, your reason and any note. The person you report is not told who reported them. When you appeal a moderation decision, we keep your appeal and our decision.

Optional poll questions

Some polls ask optional questions the poll's creator chose: age range, sex, whether you're a parent or guardian, education, employment, whether you own or rent, and military service, and on some polls the sensitive questions political party, race or ethnicity, household income and religion. Answering is always optional, and answers are kept only for verified accounts. They're stored with your vote so you can change them until the poll closes, and are published only as totals for groups of at least 10 people, never tied to you. You can save the non-sensitive answers as a reusable profile; sensitive answers are never saved to it, and you can clear it from your dashboard.

Identity verification (ID.me)

Verification is not live yet. When it opens, it happens on ID.me's own site, and ID.me sees what it needs to verify you (such as your name, address, date of birth and ID documents). We receive the result and keep:

whether you're verified, how and when;
your legal name as ID.me confirms it, stored encrypted. It is used to check a name hand-off for a former official (see below), and a CivicView administrator can see it only when reviewing one of those;
the city and state of the address ID.me confirms, which replace the ones you entered, and that address's congressional district, which we look up once by sending the address to the U.S. Census Geocoder;
a one-way hash of your street address, never the address itself; and
a separate record of one-way hashes of your email, verified name and verified street address, with the date you verified. It lets us recognize someone who has already verified so we don't pay ID.me to verify the same person twice, and it stays after you delete your account. The hashes are salted with our application secret, so they can't be turned back into your email, name or address.

ID.me's reply can include your date of birth. We don't read it or save it to your account. We never receive the documents ID.me looked at. ID.me's privacy policy covers what ID.me does with your information.

Representative and candidate accounts

Account details. Sign-in email, password (as a one-way hash), display name, your role, the official or candidate page your account runs, and the state, district or city that page covers (from our records, not from you).
What you publish. Posts, polls, events and images, and the comments, likes and votes you make as the official or candidate. All of it is public, and it stays on the page as a public record (see Deleting your account). Edited or deleted posts keep their original text, hidden, for moderation review.
Images. We remove hidden details such as location from the images you upload before storing them. Images taken out of a post may stay in storage.
Claim requests. If you ask to claim a page, we keep your email, state and the details you send us (such as your name and your connection to the official), and add your email and state to our Brevo mailing list like a waitlist sign-up.

Former officials and candidates

When someone leaves office or a campaign ends, their page stays, labeled as a former official's or former candidate's page, and is archived six months later (three months for a campaign). We record the date, its official source and which administrator set it. The person can link a citizen account by being signed in to both in the same browser. We keep that link, and each choice they make about what to carry over (their name, a copy of their tracked items, saved posts and notification settings, and an optional “Served as” line), with the time it was turned on or off. Their name is released to their citizen account only if ID.me verifies a matching legal name, or an administrator approves the match with a source.

Waitlist sign-ups

If you join the waitlist, we keep your email, your state if you give it, which button you used and any note. We also add your email, state and that button to our mailing list at Brevo, which may send you an email asking you to confirm, and which we use to announce CivicView's launch and major news. Every such email has an unsubscribe link.

Messages you send us

Emails you send us, and anything you write in our feedback form (a Google Form, so it also goes to Google under Google's privacy policy).

Security information

Two-step sign-in (2FA). If you turn it on, your 2FA secret is stored encrypted and your recovery codes as one-way hashes.
Sign-in records. Each sign-in attempt is recorded with the email tried, whether it worked, your IP address and your browser's user agent, to stop password guessing. We also count failed attempts to lock an account under attack. If your account is locked, we email you, and that email includes the IP address the attempts came from.
Last sign-in time for every account.

Technical information

IP address. Our servers see it on every request and use it to limit abuse. Apart from sign-in records and lockout emails, we don't store it, and we don't build profiles from it.
Server logs. Our application logs record some events, such as a sign-up or an email we sent. They name an account by its number, and show an email address only as its first letter and domain (like j***@example.org). Typed addresses and the random voter ID are masked. Our hosting providers keep these logs, and their own request logs (IP address, browser and the page requested), for a limited time.
Addresses you look up. When you type an address to find your officials, our server sends it to the U.S. Census Geocoder (or, if that fails, OpenStreetMap's Nominatim) and, when it's turned on, to Google Civic Information. We don't save it on our servers. Lookup results can be cached briefly by our network provider and your browser, and the app remembers the last address you matched on your device.
“Use my location.” Only if you tap it and allow it. Your device's coordinates go straight from your browser to Nominatim, which returns the nearest address, and that address is then looked up as above. We never receive or store the coordinates.
Push notifications (Android, only if you turn them on). A device token from Google Firebase Cloud Messaging, your push settings (including your time zone offset and whether notifications show details), the app's version number, whether notifications for CivicView are turned off in Android settings (so we stop sending to that phone until they're back on) and, if you aren't signed in, the list of officials you track on that device. While you're signed in on the device, the token is linked to your citizen account; signing out unlinks it and clears that list. If you choose a daily or weekly summary, or an update arrives during your quiet hours, we keep that update (who or what it's about and the push text) until the summary goes out, then delete it. Turning push off deletes the token and everything stored with it. By default each notification, on a locked phone or not, shows only a general line such as “New update from an official you track,” not who posted or what; you can choose Show details. Each push passes through Google with that line, the kind of update and the ids that open the right place in the app (for example an official's page id and a post id; for other alerts an event or poll id, a federal bill's number, or a state's two-letter code; and the id of your notification in the bell), but no names and no other text unless you choose Show details.
Web push notifications (in a browser, CivicView on an iPhone or iPad Home Screen, or the Windows app, only if you turn them on). Your browser gives us a push subscription: its endpoint (the web address of your browser's push service for this browser) and two keys that every notification is encrypted with. We store it with your push settings (including your time zone offset and whether notifications show details), whether the device is a computer, an Android phone, or an iPhone or iPad, when we last sent to it and, if you aren't signed in, the list of officials you track in that browser. While you're signed in there, the subscription is linked to your citizen account; signing out unlinks it and clears that list. Each notification goes through your browser's push service: Google for Chrome and for Edge on Android, Microsoft for Edge on Windows, Mozilla for Firefox, and Apple for Safari and for Home Screen apps on iPhone and iPad. What a notification says (its text, the ids that open the right page, and the unread count) is encrypted for your browser, so the push service can't read it. The push service does see which browser it is for, that it comes from CivicView, when it is sent, its size, how long it may wait while your device is offline (a notification about an event expires when the event starts, so the push service can tell when that is), its urgency (high for replies and election reminders), and a coded label that names no one but is the same for notifications about the same thing, so that a newer one can replace an older one still waiting. Updates held for a daily or weekly summary or during quiet hours are kept and deleted as for the app. Turning push off deletes the subscription and everything stored with it; so does blocking CivicView's notifications in your browser (the next time you open CivicView there) and a push service telling us the subscription no longer exists. By default each notification shows only a general line such as “New update from an official you track,” not who posted or what; you can choose Show details, which applies to your phone and your browsers alike. In an installed app, the icon can show how many notifications you haven't read.

Payments

Paid subscriptions aren't available yet. When they launch, Stripe will handle payment on its own pages. We'll keep your Stripe customer and subscription IDs, your subscription status and renewal date, never your card number. When your account is deleted, we cancel any subscription on it right away, so you aren't charged again.

Cookies and storage on your device

CivicView sets three cookies, only to keep you signed in: cl_citizen, cl_session (officials) and cl_candidate. They can't be read by page scripts and expire after 14 days. We use no advertising or analytics cookies.

The app also stores a few things in your browser's local storage:

a copy of your sign-in and security tokens, which keeps you signed in, including in the Android and Windows apps;
a random voter ID (civicview_voter_token) that shows you how you voted on older polls from this browser. It isn't linked to your name;
your push choice and token (or, in a browser, the push subscription's endpoint), and your notification settings;
your ballot-measure leanings, which stay on your device and are never sent to us;
the last district and address you looked up, your map view, tutorial and display choices, and which site notice you dismissed.

You can clear all of this in your browser's settings. Pages run by others, such as our Google feedback form and, later, Stripe's payment pages, may set their own cookies.

How we use your information

To run CivicView: show you your officials, ballot and elections, display what you publish, and keep your settings.
To count engagement: totals of votes, likes and comments by area for officials, candidates and everyone.
To notify you: the in-app, push and email messages you turned on, election reminders (on unless you turn them off), and notices about your account or the pages you track.
To keep CivicView safe: screening new content, handling reports and appeals, rate limits, lockouts and 2FA.
For AI features: plain-English summaries, topic and tone tags on comments, polls and posts, and AI search (see Anthropic below).
To verify citizens, once ID.me verification opens.
To understand use in total, for example how many polls were created, from our own database. We don't use outside analytics services.
To meet legal duties and protect our users and the service.

We don't sell personal information, we don't share it for targeted advertising, and we don't build advertising profiles.

Who can see what

Everyone, without signing in

Your comments: your display name, the text, the district or state and the city the comment was written from, an “Unverified” label if your account wasn't verified, and your account number (which opens your public card).
Polls you create: your display name, your current state, city and district, and whether you're verified.
Your public card: your display name and, only if you chose it, a “Served as” line. It shows nothing else.
Totals of votes and likes. Your own vote or like is shown only to you.
Everything on an official's or candidate's page.

Never public: your email, your individual votes and likes, your answers to optional poll questions, what you track or save, and your verification details.

Officials and candidates who run a page

They see totals for their page: votes, likes and comments by area, poll results by group (only for groups of at least 10), how many different citizens engaged, and their top posts. Their dashboard also lists their five most active commenters, with each person's display name, city, district, state and number of comments; those comments are already public. They never see your email, your individual votes or likes, or your answers to optional poll questions.

CivicView administrators

Only people on an explicit admin list can use admin tools. They can see account emails, reports and who filed them, suspended and locked accounts, and, only when reviewing a former official's name hand-off, a verified legal name. They use database access to handle reports, appeals, security incidents and support, and for totals. We don't browse personal data without a reason. Moderation decisions, appeals and changes to former officials' pages are recorded with who made them.

Companies that help us run CivicView

These providers receive personal information only to do their job for us:

Render: hosts our server and database.
Vercel: hosts the website and receives every visitor's IP address and request details.
Cloudflare: sits in front of our server to block attacks and speed it up. It handles the traffic to our server, including its contents, and briefly caches public responses. Cloudflare R2 stores images uploaded by officials and candidates.
Anthropic (Claude AI): receives the text of comments, polls (question and options) and the posts and polls of officials and candidates, to screen them for safety and tag their topic and tone; posts when someone asks for a summary; what you type into an AI search box, with the items being searched (for comment search, that includes commenters' display names and short excerpts); and public bills, votes, executive orders and ballot measures to summarize. It doesn't receive your email, address, verification or votes. Under its commercial terms, Anthropic doesn't use this content to train its models.
Postmark: sends our account emails (password resets and changes, sign-in help, lockout alerts with the IP address), the weekly digest, election reminder emails you turn on and notices about former officials' and candidates' pages.
Resend: emails our administrators about new reports (the content, the reason and the reporter's display name) and appeals (the appellant's name, email and reasons), and emails you our decision on your appeal.
Brevo: our waitlist mailing list (email, state and the button used).
ID.me: identity verification, once it opens.
U.S. Census Geocoder, OpenStreetMap Nominatim and Google Civic Information: addresses you look up, to find their districts.
Google Firebase Cloud Messaging: delivers push notifications in the Android app, so each push passes through Google: the notification's line, the kind of update and the ids that open it, and names and text only if you choose Show details (see Push notifications above).
Your browser's push service (Google, Microsoft, Mozilla or Apple, depending on the browser): delivers web push notifications. What each one says is encrypted for your browser, so the push service can't read it; it does see the delivery details listed under Web push notifications above.
Google Forms: our feedback form.
Stripe: payments, once subscriptions launch.

Your browser also loads some content straight from other sites: map tiles from CARTO, boundary files from GitHub and the U.S. Census, and officials' photos from public sources such as Wikimedia Commons, GitHub, government websites, Amazon S3 and Google Cloud Storage. Like any website, they see your IP address and browser details when they send it. The public-data services we use (Congress.gov, Open States, the FEC and others) receive no personal information.

We may also disclose information when the law requires it (for example a valid subpoena or court order), to protect someone's safety, to report child sexual abuse material to the National Center for Missing & Exploited Children, or to a company that takes over CivicView, which would have to honor this policy.

Tracking, Do Not Track and Global Privacy Control

CivicView has no advertising or analytics trackers, and we don't let other companies collect information about your activity across websites through CivicView, beyond the request details any site you load content from receives (listed above). Because we don't track you across sites, CivicView works the same whether or not your browser sends a Do Not Track signal. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your information, which we don't do for anyone.

Emails we send

Account and security emails (password resets and changes, sign-in help, lockout alerts). These protect your account, so they can't be turned off.
The weekly digest of the officials you follow: only if you turn it on. Turn it off in your notification settings (Weekly email digest) or with the one-click unsubscribe link in each one.
Election reminder emails: only if you turn them on, the same reminders as in the app. Each one links to the setting that turns them off and has a one-click unsubscribe link.
Bill update emails: only if you choose email for Bill updates, at most one a day, listing the federal bills you track that changed. Each one has a one-click unsubscribe link.
One notice when a page you track changes, for example when an official leaves office, a campaign ends or a candidate takes office. By email unless you choose a setting without email for “Changes to pages you track” in your notification settings or use the one-click unsubscribe link in the email; the notice in the app still comes. To stop both, stop tracking the page.
Notices to former officials and candidates about their page.
Your appeal decision.
Waitlist emails from Brevo, each with an unsubscribe link.

We never send advertising for other companies. Bell, push and email alerts are controlled in your notification settings (the bell's Settings, or Settings on your dashboard), and election reminders also from any reminder.

How long we keep information

Your account and what you do on CivicView: until you delete your account. Clearing a notification hides it; it's removed when you delete your account.
Sign-in records: about 90 days. Our daily cleanup removes older ones.
Password reset links: expire after one hour (the demo sign-in link after 24 hours), and expired ones are removed daily.
Accounts scheduled for deletion: 30 days, then deleted (citizens) or closed (officials and candidates).
Content hidden by moderation, reports and appeals: kept so decisions can be appealed and checked.
Our moderation system's assessments of content (which can quote up to a few sentences of it): kept as a safety record, even after the account is deleted.
Push tokens: until you turn push off, the token stops working, or you delete your citizen account. Updates held for a summary push: until the summary goes out.
Web push subscriptions: until you turn push off, block CivicView's notifications in that browser, the push service says the subscription no longer exists, or you delete your citizen account.
Bill status records: the latest action we saw on each tracked federal bill, and the updates we found, are public information about the bill and are kept while anyone tracks it. The record of which updates we sent you is deleted with your account.
Waitlist entries: until you ask us to remove them, and on Brevo until you unsubscribe or ask us.
Verification records: the one-way hashes and date described above, kept to avoid paying to verify the same person twice.
Pages of officials and candidates, and records of their changes: kept as a public record. Former pages are archived, not deleted.
Logs: for the limited time our hosting providers keep them.
Backups: deleted data can remain in our database provider's backups for a short time, until they're replaced.

Deleting your account

Go to Delete account. You can schedule deletion for 30 days from now (sign back in before then to cancel) or delete right away.

Citizen accounts are deleted, with your comments, the polls you created, your likes, your answers to optional poll questions, your tracked and saved items, notifications, election reminder records, records of the notices we sent you about pages you track, push registrations, sign-in records and password reset links. What stays: your votes on other people's polls remain in their totals with no link to you; reports you filed remain without your name; your appeals and our moderation assessments remain as a safety record; your verification hashes and date remain (see above); and reply notices other people received keep your display name and a short preview.
Official and candidate accounts are closed, never emptied. You can no longer sign in, and your sign-in email, password, 2FA secret and recovery codes, tracked and saved items, notifications, records of the notices we sent you and sign-in records are removed. What you published (posts, polls, events, comments, likes and votes) stays on the page as a public record, whether or not you're in office, so deleting an account can never erase what was published on it.

Your rights and choices

Wherever you live in the U.S., you can:

Get a copy of the personal information we have about you, in a common machine-readable format.
Correct it. Most of it is editable in Settings on your dashboard; email us for the rest.
Delete it, with the delete page or by email (with the exceptions in Deleting your account).
Opt out of the sale or sharing of your information, targeted advertising and profiling. We don't do any of these.
Change your mind about optional things: your poll answers (until the poll closes), your saved poll profile, push, the digest and the “Served as” line.

To make a request, email civicview@civicview.app from the email address on your account (or tell us how to confirm it's you), or write to the address above. Someone you authorize can make a request for you, with your signed permission. We'll answer within 45 days, and if we need more time we'll tell you why, within another 45 days at most. If we turn down a request, you can reply to ask us to reconsider, and we'll answer that within 45 days too; if you still disagree, you can contact your state's attorney general. Using these rights never changes how CivicView treats you.

Sensitive information

Some of what you share can reveal sensitive things: your political views (through your votes and comments) and, if you choose to answer, your party, race or ethnicity, household income and religion. We collect those answers only when you choose to give them, use them only for anonymous totals of at least 10 people, and never sell them or use them for advertising. We never collect your precise location, and we keep your verified legal name encrypted.

Children

CivicView is for adults 18 and older and isn't directed to children. We don't knowingly collect information from anyone under 18. If you believe someone under 18 has an account, email civicview@civicview.app and we'll delete it.

Security

We protect your information with HTTPS everywhere, one-way hashed passwords and recovery codes, encrypted 2FA secrets and legal names, protection against cross-site request forgery, rate limits and lockouts, a web application firewall in front of our server, automated code and dependency scanning, and an explicit list of administrators. We plan an independent security review as CivicView grows. No system is perfectly secure. If a breach puts your personal information at risk, we'll notify you and the authorities as the law requires (in Florida, within 30 days). To report a vulnerability, email civicview@civicview.app before disclosing it publicly.

If you're outside the United States

CivicView is built for people in the United States, and your information is stored and processed in the U.S. If you use it from the European Union or the United Kingdom, you have the rights above under the GDPR, and you can also object to our processing or complain to your data protection authority. We rely on these legal bases: providing the service you asked for, our legitimate interest in keeping CivicView safe and working, your consent for optional things (poll answers, push, verification), and our legal obligations.

Changes to this policy

When we change this policy, we update the “Last updated” date at the bottom of this page. For a material change, such as collecting something new, using it in a new way or sharing it with someone new, we'll post a notice on CivicView and email account holders at least 30 days before it takes effect. We won't use information you've already given us in a materially different way without your consent.

Contact us

Email civicview@civicview.app with any privacy question or request, or write to CIVICVIEW, INC., PO Box 621182, Orlando, FL 32862-1182. We usually reply within 24 to 48 hours during the work week.

Last updated: October 24, 2026