Privacy Policy

Civitas Tech, Inc. ("Civitas," "we," "us") makes the Civitas iPhone app (CivitasIQ) and the civitasapp.io website. This policy explains, as the app works today, what we collect, how we use and share it, and your choices.

• Account: your email (with Sign in with Apple, possibly a relay address, and possibly your name); an optional first name; and, for older accounts, a hashed password.
• Location: your ZIP code or a street address, to find your state, county, districts and (in Massachusetts) precinct. For an address we keep codes for the Census areas it falls in, such as your town and school district, but not the address itself. Our app's own code does not read your phone's GPS location. In the current test version, Persona's verification page inside the app can ask for your location; if you allow it, Persona receives it, and we do not store it.
• Optional profile facts, used to show which bills may affect you, estimate how, and personalize answers: for example age, work, income, household, housing, health-coverage type, veteran, union, gun-owner or disability status, and figures such as rent, taxes and savings. Some are sensitive. Gender, race or ethnicity, religion and immigration status (including DACA status) given to earlier versions of the app stay in your profile until you ask us to remove them or delete your account.
• Activity: poll answers, how strongly you feel and reasons; bills you track; topics and officials you follow; favorites; positions you state; reports you send us; and, for 90 days, which bills, officials and donors you open in the app and which items the Orb has shown you.
• Inferences: topics we infer from your votes, tracked bills and follows, and positions we infer from your votes; a "political compass" result if an earlier version of the app made one; and impact estimates. Some of these are shown on What Civitas Knows.
• Device and usage: your push token if you allow notifications; when your account was last active (updated as you use the app and when you vote); crash reports; and server logs that may record your IP address and the web address requested, which for some features includes your voting ID. The app has no advertising identifier and no analytics or ad software.

Each account has a separate random voting ID. Your poll answers, reasons, follows, favorites, stances, political compass and the 90-day record of what you open in the app are stored under it rather than under your name, email or account ID. Vote records also carry your state, district, county, and industry and occupation categories; in a small area these can narrow down who answered.

Today your account record also holds information that links it to your voting ID: the ID itself, a coded version of it that can be matched against your activity, or both. The app uses this link to show your history, personalize features, send notifications about polls you answered, and export or delete your data. It also means someone with full access to our database, such as the people who operate Civitas, can connect an account to its votes, reasons and other activity. Some information is kept with your account itself rather than under your voting ID: your tracked bills and push tokens; topics we infer from your votes, tracked bills and follows; some impact estimates; and notification records, which show which polls you answered and, for some older notifications, how you answered.

Poll results appear in the app and on public poll pages, with percentages only after enough people answer. A counted answer can't be changed and stays in the totals even if you clear your voting history or delete your account.

Before saving a reason, we send it to OpenAI's automated moderation check and refuse flagged reasons; if the check is unavailable, the reason may be saved unchecked. Reasons are shown without your name, but with the answer, district and the time you submitted it, to any signed-in user whose profile is set to your district (anyone can create an account and enter a ZIP code there), once at least 50 people there have answered. Reasons are also sent to OpenAI, without names, to write summaries anyone can see, including a summary for a single district once at least 10 people there have given reasons. We do not edit reasons, so leave out details that could identify you.

If you answered Support or Oppose and your members of Congress later vote on the bill, we may notify you. The notification does not show your answer, but receiving it shows that you answered and took a side.

To vote in polls, you verify your identity with Persona, on its page inside the app. Persona collects images of your government ID, may ask for a photo or video of you, and receives your IP address and device information. We send Persona your account ID as a reference, not your name or email.

From Persona's result our server reads your document number and date of birth and stores only a coded fingerprint of them (a salted SHA-256 hash) with your account, to check whether that ID has verified another account. If Persona's result does not include these details, verification can be granted without a fingerprint, and no duplicate check is made for that account. We do not store your ID images, selfie, document number or date of birth. We also keep your verification status and date, and Persona's reference for your check until our deletion request is processed.

After your check, and before we delete an account, we ask Persona to delete your check's data (for unfinished checks, generally after about 7 days). Persona's own privacy policy governs what it collects and keeps.Voting in polls is for people 18 and older. When you verify, our server also uses the date of birth on your ID, without storing it, to refuse voting to anyone under 18 on the day of the check; the rest of the app stays open to you. We do not use verification to check citizenship, voter registration or where you live. If your ID is verified on another Civitas account, you can move the verification here. That other account is then deleted and its owner is not notified; the answers, reasons and other activity stored under its voting ID are kept, and its votes stay counted.

The Orb (our assistant), bill analyses and some summaries are written by OpenAI's AI and can be wrong; check important information against official sources.

With each Orb question we send OpenAI your question and the earlier messages in that conversation (anything you type is sent as written), your location and representatives, and what is on your screen, which can include your votes, reasons or tracked bills. Unless you pause personalization (on What Civitas Knows), we also send profile facts you have shared (such as age, income, work and household), topics inferred from your votes or that you follow, and, for questions about your own activity, your poll answers, your representatives' votes on bills you track and your impact estimates. If a temporary error stops us reading your pause setting, these may still be included. Gender and race or ethnicity, if in your profile, are included unless you turn off Identity in Personalization in AI Settings, which is on by default. The app does not currently ask your permission before sending this information to OpenAI.

We also send OpenAI the figures behind your impact estimates (which can include amounts you entered); earlier versions of the app also sent your poll answers to make your political compass. Civitas does not add your account name or email to these requests, though what you type may identify you. OpenAI's handling and retention of these requests are subject to its own terms and policies. We do not keep Orb conversations with your account, but our server logs may record question text, and we keep shortened copies of unanswered questions, and of answers you report together with the question you asked, without your name or account.

• Supabase — our database and sign-in, including sign-in emails; it holds the information above.
• Amazon Web Services — our servers, which most app requests pass through, and our backups.
• Persona and OpenAI — as described above.
• Sentry — crash reports (technical details such as device model and app version) and the sender's IP address. We do not attach your name, email, account or voting ID, though a report can include a web address containing an ID or ZIP code.
• Expo and Apple — push notifications (your push token and each notification's content) and Sign in with Apple.
• Apple TestFlight — if you test a beta version, Apple shares with us what TestFlight provides, such as crash reports, feedback and screenshots you choose to send, and, if we invited you by email, your name and email.
• U.S. Census Bureau and USAspending.gov — our server sends your ZIP code or typed address (or the map point for that address) to find your districts, and your ZIP code for Spending in My ZIP.
• Vercel hosts our website, and the app loads official photos from public sites such as Wikimedia; these see your IP address.

We may also disclose information when the law requires it, or to protect safety or security.

We do not sell your personal information, show ads, use your information for advertising, or track you across other companies' apps or websites. We do not share your personal information with political campaigns, parties or PACs, or send your individual answers or reasons to your representatives.

We may share or license statistics that combine many people's answers, such as poll results by district. They do not include names, email addresses, account IDs or voting IDs.

Clear voting history deletes your answers, reasons and what we derived from them (inferred stances and interests, compass, impact estimates). Your votes stay counted, you can't answer those polls again, and we keep a coded receipt for each poll, without your answer, to enforce that. Because your account record can still be linked to your voting ID, someone with full access to our database may be able to use these receipts to tell which polls the account answered, though the receipts do not show how you answered.

Deleting your account (on the Profile screen) deletes your profile, sign-in account and activity, including answers, reasons, tracked bills and push tokens, and asks Persona to delete your verification data. What remains:

• your votes, as counts in poll totals;
• your verification fingerprint, until every poll that existed when you deleted your account has closed. Every poll stops taking answers 120 days after it opens, so a daily cleanup is designed to delete it about 120 days after you delete your account;
• clear-history receipts, reports you sent us, and shortened copies of unanswered Orb questions;
• copies in backups (our own nightly backups expire after 35 days), in logs, and at service providers under their own policies.

If we cannot match your voting ID to your account, activity under it is not deleted; the app tells you if so. If you signed in with Apple, deleting your account also asks Apple to revoke Civitas's access to your Apple ID; the account is deleted even if that step does not complete, and you can also revoke access in your Apple ID settings. Most notification-log entries are deleted after 30 days; otherwise we keep your information while your account exists, unless you delete it sooner.

What Civitas Knows shows much of what we hold and infer, and Export my data gives you a copy that may not include everything. In the app you can also change or clear profile facts, pause personalization, turn off notifications, clear your voting history or delete your account. For anything else, email support@civitasapp.io. Depending on where you live, you may have more rights under state law.

Civitas is for people 13 and older. At sign-up you confirm that you are 13 or older; we do not verify age at sign-up. Voting in polls is for people 18 and older and is checked against the date of birth on your ID when you verify. We do not knowingly collect information from children under 13 and will delete an account we learn belongs to one; contact us if you believe this has happened.

Civitas is designed for people in the United States, and our own servers and database are in the United States. We encrypt traffic between the app and our servers, but no system is completely secure.

Information about officials, bills, elections, campaign finance and lobbying comes from public records, such as Congress.gov and the Federal Election Commission. Some name private individuals, such as campaign donors.

We may update this policy. We will post changes on this page and update the "Last updated" date.

Questions about this policy or our data practices:

support@civitasapp.io

Civitas Tech, Inc.
Delaware C-Corp · File #10521676