Privacy policy

What we collect

• Email address. We store your email when you sign in (to identify your account and send a one-time verification code) or when you subscribe to campaign updates (e.g. via the footer, Updates page, or in-drawer form). We also store the time of your last sign-in. Verification codes are short-lived and discarded after use or expiry. If you subscribe to updates, we store your preference to receive campaign emails; you can unsubscribe via the link in any update email.
• Outreach you save. When you are signed in and record a call or email (e.g. via “I sent” or “End call”), we store the legislator you contacted, the type of contact (call, email, or no answer), your ZIP code, and any optional details you provide (outcome, notes, contact name, support rating, whether you are a constituent). When a campaign is active, we also store which campaign the outreach was part of.
• Account ZIP code. If you set or update your ZIP code on the advocacy page (e.g. via "Use location" or the inline edit under the sign-in strip), we store it on your account so we can pre-fill your search on future visits. We do not update this from the URL or from outreach events.
• Community-sourced legislator emails. When you record a call and provide a legislator's office or staff email (for a member who has no public email listed), we store that email and associate it with the legislator and your user id. We use it to pre-fill the recipient field for other constituents contacting that legislator; we do not sell or share it for other purposes.
• Bug reports. If you submit a bug report, we store the description, any optional email you provide, the page URL you were on, and any screenshot you attach. The notification we receive (e.g. by email) also includes your IP address and browser information so we can respond and prevent abuse; that information is not stored in our database.
• Community stories and statements. If you submit a story (photo and text) or a text-only statement via “Share your story” after the kei poll, we store your name, location, story or statement text, and (for stories) your photo and email. We use this to show approved submissions on the site (e.g. the community marquee) and to email you when we approve or deny. We only use what you submit with your consent for those purposes.
• Analytics. When analytics is enabled (in production), we use Umami to understand how the site is used. Umami may receive data such as page views, referring source, and device or browser type. Umami is cookie-free; data is processed by Umami’s infrastructure according to their practices.
• Usage and conversion measurement. We use a first-party session identifier (stored in your browser's session storage only, under the key ilga_anon_sid) to measure how the advocacy flow is used and to compute conversion rates (e.g. what share of people who open the flow go on to complete a call or email). When you sign in, we link that session to your account so we can attribute your earlier steps correctly. We do not sell or share this data with third parties. Step and conversion data are retained for 12 months, then deleted or anonymized.
• Local browser storage. We use browser session storage for preferences that stay on your device (e.g. whether you dismissed the beta notice) and for the anonymous session identifier described above. This data is first-party only and is not shared with third parties.

How we use it

• Your email and last sign-in time are used to identify you and to associate the outreach you choose to save (calls, emails, notes, ratings) with your account. If you subscribed to campaign updates, your email is used only to send those updates; we respect unsubscribe requests.
• Bug report content, optional email, and the IP/browser information in the notification are used only to respond to your report and to prevent abuse.
• Analytics data is used only to improve the site and understand usage patterns.
• Step and conversion data (from the session identifier above) are used only to understand funnel performance and improve the advocacy experience; we do not use them for advertising or sell them.
• Your account ZIP code is used only to pre-fill the advocacy search when you return. Community-sourced legislator emails are used only to pre-fill the email recipient for other users contacting that legislator.
• Community story and statement submissions are used only to display approved content on the site (e.g. marquee) and to notify you when we approve or deny; we do not use them for advertising or sell them.

Data sharing and no sale

We do not sell your personal data. We do not share your data with third parties for advertising or marketing. Analytics and funnel measurement are first-party only (our database, our domain); when Umami is enabled, analytics data is processed on their infrastructure as described in What we collect. We do not use your data for cross-site tracking or profiling for ads.

Retention

Verification codes expire quickly (within minutes). We retain account data (including your stored ZIP code), outreach you saved, community-sourced legislator emails, community story and statement submissions, and bug report data as needed to operate the service and until you ask us to delete it or as required by law. Step events and conversion-related data used for funnel measurement are retained for 12 months, then deleted or anonymized. IP and browser information in bug report notifications are kept only as part of those notifications (e.g. in our inbox). Our servers may log requests (e.g. IP, time, URL) for security and operation; we do not use such logs to identify you except where needed for abuse prevention or law. Umami retains analytics data according to their plan (e.g. 6 months on the free tier).

Security

We serve the site over HTTPS. Session and CSRF cookies are set with secure flags in production. We use the data we collect only as described in this policy and do not use server logs to identify you except for abuse prevention or as required by law.

Cookies

We use two cookies: (1) a session cookie to keep you signed in, and (2) a security (CSRF) token cookie to protect forms and requests from cross-site forgery. We do not use first-party cookies for analytics; when Umami is enabled, it does not set cookies.

Your rights

You may request access to, correction of, or deletion of your data. Contact us using the Report a bug link in the footer (or /report-bug). We will respond within a reasonable time and, where applicable, honor deletion requests subject to legal or operational retention needs.

Contact

For questions about this policy or to exercise your rights above, use the Report a bug link in the footer (or visit /report-bug) and we’ll respond.