Privacy policy

1. Web Server Logs

Like any website, we log basic request information: IP addresses and country (via Cloudflare), browser user-agent strings, request paths, timestamps, and HTTP status codes. These logs are used exclusively for security monitoring and debugging.

Retention: Log files are rotated daily and automatically deleted after 30 days.

2. District Lookup

When you look up your district by address, your address is sent to two external services to determine your districts and polling place:

• U.S. Census Bureau Geocoder (geocoding.geo.census.gov) to identify your congressional and state legislative districts
• Google Civic Information API (googleapis.com) to find your polling place near elections

As you type in the address box, the partial text is sent through our server to Maryland's state geocoding service (MD iMAP, mdgeodata.md.gov) to offer autocomplete suggestions. We do not log or store what you type; suggestions are handled transiently and the feature simply turns off if the service is unreachable.

If you choose "Use my location", your browser asks for permission first. Your coordinates are then sent to our server once and forwarded to the Census Geocoder to find your districts. Coordinates are never stored, logged, or cached on our servers, and no address is created or saved from this path.

These services are operated by the U.S. government and Google, respectively. Our server sends your address to them to process the lookup; they see the address, but not your IP address. We have no control over how they handle that data. See the Census Bureau privacy policy and Google privacy policy for details.

On our end, we cache the district result (not your address) so repeated lookups are fast. Your address is stored only as a hash (SHA-256), not as readable text, next to the district result. We keep nothing else that identifies you with it.

Retention: Cache entries expire after 30 days.

3. Browser Storage

If you use the district lookup feature, your district numbers (like "Congressional District 3") are saved in your browser's local storage so your pages stay scoped to your districts on later visits. The matched address itself is held only in session storage for the current tab, to prefill address fields while you browse, and is discarded when the tab closes. So the drop box map can pin your place on later visits, the map coordinates of that address (or of "Use my location") are also saved in local storage, never the street text; "Forget my saved location" on the map page removes them. To find those coordinates, the address is sent once to our server, which asks Maryland's state geocoder and keeps nothing. The same on-device rule applies to small preferences like candidates you hide on comparison pages.

Choices you make in the Ballot Builder (your picks and passes) live in your browser's storage; your ballot as a whole is never sent to or stored on our servers. When you decide a race, we count one anonymous tally for the chosen candidate (see §7): a bare counter with no link to you, your device, or your other choices. You can remove the on-device data anytime with the "Clear saved" action on the Districts page, the ballot's own reset control, or through your browser settings.

4. AI Chat Conversations

Chat messages are processed in real-time and are not stored by default. Once you close the page, the conversation is gone from our side. We do not use chat content for training or analytics. The only exception is the optional feedback flow described in §6 below, where you can choose to share a single question/response pair so we can debug a bad answer.

5. Email (Future Feature)

When we add email alerts in the future, submitting your email will only be used to send the notifications you signed up for. We will never share your email with third parties.

6. Chat Feedback (Optional)

If you rate an AI response using the thumbs up/down buttons, we store your rating along with technical metadata about the interaction (which tools were used, how relevant the search results were, the length of the response, and the version of the AI prompt that produced it). Your question is also hashed (SHA-256) so we can detect repeated failures without knowing what was asked, and we keep a hash of your IP address so one network cannot flood the feedback form.

If you give a thumbs-down, an optional form opens where you can pick a reason and add a free-text comment. The comment is run through an automatic scrubber that removes US addresses, email addresses, phone numbers, SSN-shaped sequences, and credit-card-shaped digit runs before it reaches our database.

That form also has a checkbox: “Share my question and the AI’s response so the team can debug.”The checkbox is off by default. If you tick it, your question and the response are stored in addition to the rating, after the same PII scrubber removes the patterns listed above. If you don’t tick it, neither value is sent to our database.

Retention: The rating, hash, and technical metadata are kept indefinitely to track quality trends. The free-text fields (your question, the response, and any comment) are automatically NULLed 14 days after the feedback was submitted. PII scrubbing is best-effort - please review what you type before submitting and avoid including personal details if you can.

7. Aggregated Usage Statistics

To understand what Marylanders find useful, we count a small set of anonymous events: views of candidate, legislator, and bill pages; when the Ballot Builder page is opened, and which link on our own site led there; when a Ballot Builder session starts or has every race decided; when a ballot is printed; one tally per candidate chosen when a ballot race is decided; and issue topics chosen in the builder. For the AI chat we count only that a message was sent, that a suggestion chip or example prompt was clicked, and that the chat was opened from a link on another page; the counters never include what was asked (see "What We Do NOT Collect" below). Each event is stored only as a daily counter (for example, "candidate X was viewed 214 times on this date"). No user identifier, cookie, session ID, or IP address is stored with any count, and no raw event log is kept, so individual activity cannot be reconstructed, by us or anyone else. Your browser's Global Privacy Control or Do Not Track signal turns this counting off entirely. We may publish or share these aggregate numbers (for example, most-viewed candidates); they never contain personal information.

8. Candidate Corrections (Optional)

The "Suggest a correction" form on candidate pages lets anyone report wrong or missing information. We store what you submit: the changes you propose, your note and evidence link, who you are (candidate, campaign staff, voter, or other), and your name and email if you give them. Campaigns are asked for an email so we can confirm a change really comes from them. To stop spam, we also store a keyed hash of your IP address. It cannot be reversed to recover the address, and it is used only to limit and spot repeat submissions. The form also shows a Cloudflare Turnstile check (see Hosting and Infrastructure below) to tell people from bots; it loads only on this form.

A person on our team reviews every submission before anything changes on the site. Your name, email, and IP hash are never shown publicly. Approved information (for example a campaign website or a campaign statement) appears on the candidate's page; a photo you link to is downloaded once, checked, and stored as our own copy.

Retention: Submissions not reviewed within 30 days are closed, and rejected submissions are deleted 30 days after review. Your name and email are deleted 90 days after the November 3, 2026 general election, or 90 days after you submit if that is later.

9. Problem Reports (Optional)

The "Report a problem" form lets anyone tell us about a wrong answer from Civvy, a broken page, or information that is wrong or out of date. We store the kind of problem, your description, the page you were on (its path only, never a search or address in the link), and your email if you give one for a reply. Before your description is saved we remove the personal details we can spot (street addresses, email addresses, phone numbers, and number patterns like Social Security or card numbers), so please leave them out. To stop spam we store the same keyed, non-reversible hash of your IP address as the corrections form, and the form shows the same Cloudflare Turnstile check.

Retention: Only our team reads reports; nothing from them is shown publicly. A report is deleted 90 days after we close it, and your email is deleted 90 days after you send the report.

• We do not use cookies
• We do not run Google Analytics or any third-party tracking
• We do not fingerprint browsers
• We do not store your street address. The hash is only used as a temporary cache key to reduce repeat calls to external services.
• We do not log what you type in the AI chat, unless you explicitly opt in via the thumbs-down feedback form (see §6 for the rules). Our server logs do record which lookup Civvy ran and its non-address details, such as a candidate's name or a bill number, for 30 days.

Candidate and legislator photos displayed on this site are loaded directly from their original sources. When you view a profile page, your browser makes requests to these external servers to fetch the image:

• Maryland General Assembly (mgaleg.maryland.gov) for legislator photos
• U.S. Congress (unitedstates.github.io) for federal incumbent photos
• Wikimedia Commons (upload.wikimedia.org) for some candidate photos
• Ballotpedia (ballotpedia-api4.s3.amazonaws.com) for some candidate photos
• Candidate campaign websites for self-hosted campaign photos

These image requests are subject to those sites' own privacy policies. We do not control or track these requests. Photos sent through our corrections form are stored and served by us.

This site uses the following third-party infrastructure services. Your browser may make requests to these services when you use the site:

• Cloudflare hosts and serves our frontend pages and acts as a CDN and security proxy for our API. Cloudflare processes your IP address and request headers as part of normal operation. See the Cloudflare privacy policy.
• Cloudflare Turnstile (challenges.cloudflare.com) runs a bot check on the "Suggest a correction" and "Report a problem" forms only. Your browser loads it directly from Cloudflare, which processes your IP address and browser signals to decide whether you are a person. Covered by the same Cloudflare privacy policy.
• MapLibre (demotiles.maplibre.org) provides map font files used to render district labels on the interactive map.

Fonts used on this site (Playfair Display and Inter) are bundled with the site at build time and served from our own domain. They are not loaded from Google at runtime.

Candidate, legislator, and bill data comes from public government records (Maryland General Assembly, MD State Board of Elections, OpenStates, U.S. Census Bureau, FEC), plus candidate websites, Wikipedia, and Ballotpedia. For a complete list, see our Data Sources page.

The hashed address cache auto-expires after 30 days. Since we store only a hash (not your actual address), there is nothing personally identifiable to delete.

If you sent a candidate correction (see §8), the name and email you gave are deleted on the schedule above. Email us and we will delete them sooner.

If you have any concerns or want to confirm what data we hold, contact us at [email protected].

If we change this policy, we will update the date at the top of this page.