Privacy policy

This policy describes what CivicView collects, why we collect it, who can see it, and how long we keep it. We've tried to write it in plain English. The goal is to be honest about what's happening with your data — not to bury the practices in legal-speak.

Quick summary: We collect the minimum we need to match you with your reps, let you engage, and verify you're a real constituent. We don't sell your data. We don't show you ads. We don't share your individual engagement with reps or candidates — they only ever see aggregate counts by geography. You can delete your account at any time.

What we collect

Citizens

• Email address — for login and account recovery. Required.
• Display name — shown next to your comments + poll votes. You choose what to use.
• City, state, and (optional) congressional district — so we can show you the right ballot, match your engagement to the right rep's dashboard, and surface local conversations. Required.
• Address verification status — provided by ID.me when you complete identity proofing. We store only the result ("verified" / "not verified") plus the verification date — not the underlying documents ID.me used.
• Engagement history — the polls you've voted in, posts you've reacted to, comments you've made. Tied to your account.

Representatives and candidates

• Email + display name — for login + page attribution.
• Official identifier — your bioguide_id (for reps) or candidate_id (for declared candidates). Used to bind your account to your public page.
• Posts, polls, and events you publish. These are public — that's the point of the page.

Security data (all identity types)

• Password hash — bcrypt with a per-account salt. We never see your actual password.
• 2FA secret (when enabled) — encrypted at rest using Fernet symmetric encryption keyed off our application secret. Unusable without access to both the database AND the application secret.
• Recovery codes (when 2FA enabled) — bcrypt-hashed, single-use, never shown to anyone but you at generation time.
• Last login timestamp — used to surface "active recently" indicators + spot abandoned accounts.

Technical data

• IP address — visible to our backend on every request. Used for rate-limiting and abuse detection; not stored long-term. We don't build IP-based profiles.
• Browser type + device info — present in standard HTTP headers; we don't log it beyond what our hosting provider's request logs retain.
• Cookies — httpOnly session cookies (cl_session for reps, cl_citizen for citizens, cl_candidate for candidates). No tracking cookies. No third-party advertising cookies. No analytics cookies.

How we use your data

• To match you with your representatives — your city / state / district is the lookup key for which rep pages, ballots, and elections we show you.
• To attribute your engagement — your display name and verification status appear next to comments + poll responses so reps can tell verified constituents from anonymous visitors.
• To roll up engagement for reps — your rep sees that X people in their district voted in their poll, but never the individual list. Aggregates only.
• To send notifications you've opted into — tracked items, new posts on pages you follow, replies to your comments.
• To enforce account security — 2FA, rate limits on login attempts, automatic moderation thresholds.

Who can see your data

Public

Anyone visiting CivicView can see: your display name on comments + poll responses you've left, the content of those comments, your verification status badge (if shown), and the page-owner's attributed posts. Anonymous visitors can see this without signing in.

The page owner (rep or candidate)

Reps and candidates see aggregate engagement on their page — the number of citizens in their district who voted each way on a poll, the total comment count, top reactions. They do not see a list of individual citizens who engaged. The owner's dashboard surface explicitly hides per-citizen identities.

Other citizens

Other signed-in citizens can see your display name on comments + polls + reactions you've made (same as the public view). They cannot see your email, district, or any account-level info.

CivicView staff (admins)

Admins have database access to investigate moderation reports, respond to security incidents, and run aggregate analytics. Admin access is gated to an explicit allow-list (the ADMIN_EMAILS environment variable on the backend), not "anyone who signs in." Admins can see your email + content when investigating a specific report. We don't browse user data speculatively.

Third parties we share data with

• ID.me — for citizen identity verification. They see what they need to verify you (name, address, ID document); we receive only the verification result. Their privacy policy applies to their handling of that data.
• Anthropic — for AI features. We use Anthropic's Claude models to (a) generate plain-English summaries of public bills, votes, and executive orders (only public government text is sent), and (b) classify and moderate user-generated content: when you create a poll or post a comment, its text is sent to Anthropic to tag it (sentiment, tone, topic) and to screen it for safety and policy violations. We do not send your name, email, address, ID verification, or engagement history. Anthropic processes this content on our behalf and does not use it to train its models.
• Render — our hosting provider. They have access to the underlying server + database. We chose Render because of their privacy posture; we don't make them our data processor for any analytics use.
• Cloudflare — DNS + WAF + CDN. Sees the IP address of every visitor (that's how DNS works). Doesn't see the contents of HTTPS-encrypted application traffic.
• Cloudflare R2 — object storage for post images. Images uploaded by reps + candidates are stored in R2 buckets in our account.

We don't share data with advertisers, analytics platforms (Google Analytics, Mixpanel, etc.), or data brokers. We don't have an ad network. We don't sell user data.

How long we keep your data

• Active accounts: kept indefinitely until you delete.
• Soft-deleted accounts: kept for 30 days, then permanently purged. During the grace period you can sign back in and recover.
• Permanently deleted accounts: the account row + all your content (posts, polls, comments, reactions) is removed. For citizens, we retain only a one-way hash of your email + the date your ID.me verification ran. This lets us recognize you on a future signup so you don't pay for re-verification ($1.50). The hash is salted with our application secret, so the table isn't reversible to your actual email even if it leaked.
• Reported content: kept for 90 days after the report resolves so we can audit moderation decisions, then anonymized.
• Audit logs: admin actions (suspensions, content removals) are logged with timestamps and the responsible admin's account. Kept indefinitely as a moderation audit trail.

Your rights

• Access your data: email civicview@civicview.app and we'll send you a copy of everything we have associated with your account within 30 days.
• Correct your data: most fields are editable in your dashboard. For fields we control (your verification status, your bioguide_id binding, etc.), email us.
• Delete your account: go to /account/delete. Two options — 30-day archive (recoverable) or immediate hard delete.
• Port your data: the access-data export above is in a portable JSON format you can re-import elsewhere.
• Opt out of any communication: notifications can be turned off in your dashboard. Email us for any communication channels not exposed in the UI.

GDPR (EU) + UK GDPR

If you're in the EU or UK: you have the rights listed above as statutory entitlements. Our legal basis for processing is legitimate interest (providing the civic-engagement service you signed up for) and, where applicable, consent (for optional features like ID.me verification). To exercise your rights, email civicview@civicview.app. If you're unsatisfied with our response, you can complain to your national data protection authority.

CCPA (California)

California residents have the right to know what personal info we collect, to delete it, and to opt out of sale. CivicView does not sell personal information, so opt-out is automatic. For knowledge + deletion requests, use the email above or the deletion flow.

Children

CivicView is not directed at children under 13. We don't knowingly collect data from users under 13 (or under 16 in the EU/UK). If you believe we've inadvertently collected data from a child, email civicview@civicview.app and we'll remove it.

Security

We follow the practices outlined in our internal SECURITY.md: HTTPS end-to-end, parameterized queries (no SQL injection surface), bcrypt password hashing, encrypted 2FA secrets, Cloudflare WAF in front of the API, regular dependency scanning via Dependabot + CodeQL, planned annual penetration testing. No system is perfectly secure; if you discover a vulnerability, please report it to civicview@civicview.app with the subject line "Security disclosure" before public disclosure.

Changes to this policy

We'll update the "Last updated" date at the bottom of this page whenever we change something material. For substantive changes (new data uses, new third-party sharing), we'll also notify signed-in users via in-app banner before the change takes effect.

Contact us

Email civicview@civicview.app for any privacy question. We aim to respond within 48 hours.