Politigram Privacy Policy

Effective date: [EFFECTIVE DATE]

[OPERATOR LEGAL NAME] ("we", "us") runs Politigram. This policy says what data we collect, why, and what you can do about it. We do not sell your data. We do not share it for ads. Politigram has no ads, no ad trackers, and no tracking pixels. We do not use an analytics service.

1. What we collect

Without an account. When you follow someone, check a card, report an error, or write a note, we give your browser a random ID in a cookie. We store:

• The random ID, the date it was made, and the date you were last seen.
• Who and what you follow (people and places).
• Your accuracy checks ("Matches the source" or "Doesn't match") and the card each one is for.
• Your error reports and what you wrote in them.
• Your community notes (text and source link) and your ratings of other notes.
• The moderation status of your notes, and reports that other readers file about them.
• A hash of your IP address (see Section 2).

With an account (coming soon). We also get your email address and, if you give it, your name, from our sign-in provider Clerk. We store your email-alert choices.

What we do not collect. We do not ask for your precise location, your contacts, or payment details. We do not store your raw IP address in our database.

2. How we use IP addresses

When you check a card, write a note, or rate a note, we turn your IP address into a salted hash. We store the hash, not the IP. We use it to stop one person from voting many times with many cookies, and to limit abuse. A hash cannot be turned back into an IP address without our secret salt. We do not use it to learn who you are. Our host (Vercel) sees your IP address when your browser connects. That is part of running the service.

3. Why we use data

• To run the features you ask for: follows, alerts, checks, reports, and notes.
• To decide when readers have checked a card. We need enough agreeing checks from different IP hashes.
• To score notes. A note shows only when raters who usually disagree both find it helpful. The score uses your past ratings to find which raters tend to agree. It does not use your name, email, or any guess about your politics.
• To prevent spam and abuse. Software hides notes and limits actions without a person looking. These steps can affect what you can post or what shows. They have no legal effect on you. You can ask us to look again (see Terms, Section 6).
• To send the email alerts you ask for.
• To keep the service safe, fix bugs, and obey the law.

4. Who handles data for us

• Vercel hosts the app. It handles requests and may keep server logs.
• Neon hosts our database (Postgres).
• Clerk runs sign-in (email code or Google sign-in). If you use Google, Google also gets sign-in data under its own policy.
• Resend sends our email alerts. It sees your email address and the alert text.

These companies may use the data only to serve us. We may also share data when the law requires it, or to protect people and the service. If we are sold or merged, data may move to the new owner.

Notes you post, with their source link, are public. They do not show your name or email. Other people may copy a public note, and we cannot pull those copies back. Do not put private facts about yourself or others in a note or report.

Public records. Politigram shows public records about politicians, such as votes and campaign money totals. That data comes from government sources, not from you. If a card about you is wrong, see "Corrections" in the Terms, Section 7. We do not show individual donor names.

5. Cookies and browser storage

We use only the cookies and storage the service needs. We use no ad or tracking cookies.

If you block cookies, you can still read the feed. Follows, checks, and notes will not work.

6. How long we keep data

[OWNER TO DECIDE: the app has no automatic deletion yet.] Our plan: we keep follows, checks, notes, and ratings while your browser ID or account is active. We delete anonymous IDs with no activity for [RETENTION PERIOD]. We delete IP hashes after [RETENTION PERIOD]. We delete account data when you delete your account. We may keep some records longer if the law requires it or to stop abuse.

7. Your choices and rights

You can ask us to:

• Tell you what data we hold about you (access).
• Fix wrong data (correct).
• Delete your data (delete).
• Give you a copy of your data in a file you can reuse (portability).
• Stop email alerts or take back a consent you gave.

Email [CONTACT EMAIL]. Use the subject line "Privacy request". Say what you want, and say which email or browser it is about. For anonymous use, we may need you to prove the request is yours, for example by making it from the same browser. We cannot find data we cannot link to you. We will answer within 45 days. If we need more time, we will tell you why. We do not charge a fee for a normal request. [OWNER TO DECIDE: confirm that deleting an account also deletes the matching records at Clerk and Resend.] [OWNER TO DECIDE: say whether your public notes are deleted or kept without your name.] You can also clear your cookies at any time. This ends the link between your browser and your data. It does not delete the data.

California (CCPA/CPRA) and Virginia (VCDPA). If you live in these states, you have the right to know, access, correct, and delete your personal data. You may also opt out of sale, targeted ads, and profiling. We do not sell personal data. We do not share it for cross-context ads. We do not use it for targeted ads. We do not use sensitive personal data to infer traits about you. We will not treat you worse for using your rights. If we deny a request, you may appeal by writing to [CONTACT EMAIL]. In Virginia, you may then contact the Attorney General. Other states may give similar rights, and we honor them where the law applies. We treat browser signals such as Global Privacy Control as opt-outs. Because we do not sell or share data, there is nothing more to opt out of.

8. Email alerts and unsubscribing

We send alerts only if you ask. Each email has a one-tap unsubscribe link. We stop sending after you use it, within 10 business days at most, as CAN-SPAM requires. Each email shows our mailing address: [MAILING ADDRESS]. We may still send account or security messages.

9. Children

Politigram is not for children under 13. We do not knowingly collect data from them. We do not offer accounts to them. If you think a child under 13 gave us data, write to [CONTACT EMAIL] and we will delete it.

10. Security

We use encrypted connections (HTTPS). We store IP addresses only as salted hashes. We limit who can reach the database. No system is fully safe. If a breach affects you, we will tell you and the authorities as the law requires.

11. Where data is processed

Our providers may process data in the United States and other countries. Politigram is meant for U.S. readers.

12. Changes

We may change this policy. We will post it here with a new effective date. For material changes, we will also notify account holders.

13. Contact

[OPERATOR LEGAL NAME]
[MAILING ADDRESS]
[CONTACT EMAIL]