Privacy Policy

You enter a street address once, when you sign up, and again only if you move. Here is exactly what happens to it, in the order it happens.

First, the part that matters

Your street address is never written to our database. Not in a table, not in a column, not encrypted and filed, not in a log, not in a backup, and not in the app's storage on your phone or in your browser's storage.

It exists only in the memory of a single request. We read it, we work out which districts it falls in, and it is discarded when that request ends — seconds later.

Your coordinates are treated the same way. The address is briefly converted to a latitude and longitude in memory, purely to compute the two coarse area labels in Section 5. Those coordinates are never stored, never sent back to the app, and never written to any log.

Second, who sees it on the way

Deleting it is not the same as nobody ever seeing it, and we would rather be precise than let the sentence above do more work than it should.

Three companies receive your address while it is being converted, because they are what does the converting. None is given your name, phone number, email, or account number — only the address text.

Google (Places) receives what you type as you type it. In the iOS app, it is sent from your phone directly to Google. The address field offers autocomplete, and to do that it sends the partial address every 300 milliseconds once you have typed three characters. So a series of progressively longer pieces of your address reaches Google during a single entry, not one finished string. Because the request leaves your device rather than our servers, Google also sees your device's IP address. On the website, the same partial text is relayed to Google through our servers, so Google does not see your IP address. We attach no account identifier, and we neither request nor receive coordinates from this service.

Geocodio receives the completed address from our servers and returns your districts.

Google (Civic Information) receives the completed address from our servers and returns civic information such as polling places and registration links.

What those three do with your address afterwards is governed by their terms, not ours. We can tell you what we do, and we do not keep it.

A note on the order of things

Address entry happens before the screen where you accept this policy. So the transmissions above occur before you accept. No political preference data is collected before you accept — the issue screens come afterwards — but we would rather tell you the real order than imply a different one.

We do not collect your name, your date of birth, your party registration, your voter file record, your contacts, your photos or camera, your precise location, any biometric data, or any health, financial, or employment information.

There is no advertising in Citizen. No ads, no ad software, no ad network, no advertising identifier. We do not use Apple's advertising identifier, and neither the app nor the website asks for tracking permission, because there is nothing to track for.

There is no third-party analytics or tracking software in the app or on the website. Our usage measurement is entirely first-party. A third-party analytics component that once existed in our codebase was removed, and reintroducing one would require changing this policy first.

On the website we use first-party cookies and your browser's storage only to keep you signed in, remember that you passed the age check, and hold a usage-session identifier that ends when you close the tab. None is used for advertising or shared with third parties.

We do not sell your personal information. Not to data brokers, not to researchers, not to anyone. There is no export mechanism in the product that could do it — this is not only a commitment; the machinery does not exist.

We do not share your information with any political party, candidate, campaign, or political committee. We take no money from any of them.

We never send a message for you. Citizen can draft one, but it is handed to your own email app or the official contact form, and you send it yourself.

We never send anything identifying you to an AI company. No name, phone number, email, address, or account number goes to xAI, OpenAI, or Anthropic, and nothing links two requests to the same person.

There is no Face ID or Touch ID sign-in. Earlier materials described one. It does not exist and this policy does not claim it.

Citizen Scorecard LLC is a Texas domestic limited liability company. This policy covers the Citizen iOS app and the website at citizenscorecard.com. Citizen is available in the United States only, for people 18 or older.

Contact: support@citizenscorecard.com

Citizen has no password and no username. You sign in with your phone number and a six-digit code, which expires after 90 seconds.

Why we keep it: it is your account. There is no other identifier, and no password we could store instead.

We use it to sign you in and for nothing else. We do not text you marketing, and we do not share it. We use Twilio to send the code; Twilio receives your phone number and nothing else.

This section describes what is left after your address is deleted. None of it is your address, and none of it is a location. It is a set of labels for areas you are inside.

• City and state.
• Your federal congressional district, your state house district, and your state senate district.
• A Census block group identifier — a Census-defined area typically holding a few hundred to a few thousand people.
• A grid cell identifier covering roughly five square kilometres. This is deliberately coarser than the threshold at which location is generally treated as precise.

Why we keep them. Districts determine which representatives are yours and are the basis of your score. Without them there is no product. The two coarse labels let us produce area-level figures without holding a location.

Why none of this is your address. A district is not a place you are — it is a region you are inside, shared with a great many people. A congressional district holds roughly 760,000. The grid cell and block group are smaller but still shared, and neither converts back into a street.

You choose five issues from twelve and set your position on each on a five-point scale. The twelve are: Economy & Inflation, Immigration, Healthcare, Government Spending, Crime & Public Safety, Abortion Policy, Gun Policy, Energy, Climate & Environment, Military & Foreign Policy, Housing, and Education.

Why we keep them: your score is a comparison between these and voting records. There is no version of the product without them.

These are the most sensitive information Citizen holds, and we treat them accordingly:

• Readable only by your own account, enforced at the database.
• Never sent to an AI company as your positions attached to you. When drafting a message, your position on that one issue is included in what goes to xAI — because that is the message you asked for — but with nothing identifying you.
• Never copied into usage measurement. We record that you changed your preferences and how many you changed, never the values.
• Never sold or shared. See Section 17.

From your positions and your representatives' recorded votes we compute an overall score, a score per issue, a score per representative and term, and a history of how they moved.

Why we keep them: they are the product.

How AI does and does not enter this. The formula is fixed arithmetic containing no model. It consumes a value that AI produced — which way each bill leans — so AI shapes an input to your score without computing your score. Both halves are true and neither is complete alone.

The formula is mirror-symmetric in the bill's position: if a bill is classified wrongly, two users holding exactly opposite views move by the same amount in opposite directions. A classification error makes a score less accurate; it cannot make our scores favour one side. Full detail is in our AI Use and Methodology Disclosure.

Citizen Pro is sold through Apple in the iOS app and through Stripe on the website. We never see your card; Apple and Stripe process payment and do not give it to us.

Why we keep it: to know whether you have Pro, and to honour a purchase you already made.

We store your subscription tier, when it expires, the Apple or Stripe transaction and customer identifiers needed to validate and restore purchases, and a ledger of your AI action allowance and any query packs. Purchase records are kept as long as we need them for tax and accounting. Refunds for App Store purchases are handled by Apple; refunds for website purchases are handled by us through Stripe.

Only if you turn them on. Your device gives us a push token, which we store.

The push token goes to Expo, which operates the push service we use, and Expo passes the notification to Apple for delivery. Earlier materials described Google Firebase; that is a legacy name in our own database, not the service in use. There is no Android delivery path at launch. The website does not send push notifications; notifications appear in your inbox when you sign in.

We store notifications we have sent so they appear in your inbox, and we record whether one was opened. We measure open rate as opened divided by dispatched — Apple cannot tell us whether something was seen, and we will not describe it as though it could.

Optional, and offered after sign-up. It is used for two things:

• Account recovery — available to everyone.
• The Daily Brief, a Citizen Pro feature, if you opt in — a recurring email with bills relevant to you and, where applicable, how your own score moved on an issue and what drove it.

Earlier versions of this policy said the optional email was for account recovery only. That was wrong, and the Daily Brief is not a minor nudge — it contains personalised civic content about you.

Sending it requires a separate, recorded opt-in. Holding your address is not enough; our system checks for a consent record and will not send without one.

Your address and the brief's contents go to Resend, our email delivery service. This was not previously disclosed and should have been.

An unconfirmed email address is never written to our database.

Turning it off. Every brief carries an unsubscribe link. That link does one thing: it turns off the Daily Brief switch in your settings. You can turn it back on in the app or on the website. It does not delete your address or change anything else about your account.

We measure app usage ourselves. There is no third-party analytics software and no advertising software in Citizen.

Why we do it: to find where sign-up breaks, which features go unused, and whether a notification was worth interrupting someone for.

This begins the first time you open the app, before you have an account. In the iOS app, on first launch the app creates a random identifier — an install ID — and stores it on your device. From that moment we record a small set of events: the app was opened, a session ended, a link was followed, which sign-up step you reached, and whether the age gate was passed or failed. These carry the install ID and a timestamp and are not connected to any account, because no account exists yet. If you later create an account, the install ID is attached so we can tell how many people who begin sign-up finish. The website creates no lasting identifier; it uses a session identifier held in your browser that ends when you close the tab.

The install ID is ours alone. It is not Apple's advertising identifier, it is never shared, and it is not used for advertising.

Once you have an account we record a fixed, published list of about forty event types — screens opened, bills viewed and followed, searches run, notifications opened, paywall views, sign-up steps. Each event type has a declared list of permitted fields, and anything else is discarded when the event is recorded, including free text.

What we deliberately do not record, enforced by that mechanism rather than by policy alone:

• The text of your searches. We record length as a bucket and how many results came back, not the words.
• The content of any message you draft.
• Which representative you drafted a message about, or how you feel about them. Drafting events are recorded with no representative attached at all.
• The values of your issue positions. Only how many you changed.
• Which representative an accuracy flag was set against.

Turning it off. Settings has a switch that stops usage measurement. It is honoured on our servers, not just in the app, and it applies to both the account and pre-account paths.

None of these receives your name, your address as stored data, or your account number, except as stated.

Companies that receive nothing about you. LegiScan, OpenStates, the Congressional Bioguide, and state legislature websites supply us with bills, votes, and information about legislators. We read from them and send them nothing about any user. They are credited in our Data Sources and Attribution page rather than listed here.

In transit: everything between your phone and our servers is encrypted.

At rest: data is encrypted at the storage-volume level by our hosting provider.

Access: every table containing your data is restricted to your own account by rules enforced at the database itself, not by application code that could be bypassed. Access to production systems is restricted.

No absolute guarantees. No system is perfectly secure. We have described what we do rather than promising an outcome, because a promise you cannot check is worth less than a description you can.

We use it carefully, and in two places it does not yet apply.

Genuinely aggregate and non-identifying: the usage rollups in Section 11, which carry no account identifier, no install ID and no entity reference, and which suppress any group below 25 people.

At our AI vendors. None of the three uses what we send to train their models. Each keeps a short record for abuse monitoring: Anthropic deletes within 30 days; xAI stores requests and responses encrypted for 30 days; OpenAI retains abuse-monitoring logs for up to 30 days. Content any of them flags as a policy violation may be kept longer.

You can delete your account from Settings by typing DELETE. It cannot be undone.

We remove your account record, your issue positions, your scores, your followed bills, your notifications and settings, your push token, your cached civic information, your subscription record, your share records, and your app usage events. We revoke your sign-in credentials and end all your sessions. We complete this within 30 days.

Deletion is not total, and here is exactly what outlives it.

1. A record of your issue positions, without your account identifier. Before deletion we copy your positions — the issue, your position, whether it was a priority, your districts, and the month — into a separate record used only for area-level figures.

2. A record that a message draft or search was blocked by our election-law guardrail, including your account identifier, kept for 12 months and then deleted. These exist to evidence that the guardrail worked, which is their entire purpose. This applies to both the search guardrail and the drafting guardrail.

3. Any error report you submitted, with your account identifier removed. The report itself survives, including any free text you typed into it.

4. Aggregate figures that contain no identifier of any kind and cannot be traced to you.

Today, and at launch:

• We do not sell your personal information.
• We do not share it with any political party, candidate, campaign, committee, or advertiser.
• There is no advertising in Citizen. Campaign events a campaign has paid to list are shown only with a 'Paid placement' label and receive no information about you.
• There is no function in Citizen that exports data to any third party for these purposes. The mechanism does not exist.

What we may do in future. We may offer area-level figures — how a district's residents lean on an issue — to researchers and institutions. If we ever do, these commitments bind it:

• Only aggregates. We will never release a record describing one person's combination of positions, at any group size. Figures will be produced per issue, so that no individual's full set is reconstructable.
• A minimum group size. No published or licensed figure will be derived from fewer than 25 people, and where suppressing a small group would let it be recovered by subtraction, we will suppress further groups until it cannot be.
• Never individual data, and never your identity, contact details, or address.
• Notice first. We will update this policy and increase its version number before any such programme begins.

Citizen produces a personalised result about you automatically: your score, which representatives and bills you see, and which notifications you receive. The arithmetic is fixed, applies identically to every user, and contains no AI model. The bill classifications it consumes are AI-generated.

You are not subject to any decision with a legal or similarly significant effect. Citizen decides nothing about your rights, your eligibility for anything, or your access to any service. It tells you how your representatives' recorded votes compare with the positions you chose.

Citizen is for adults. Both the app and the website ask you to confirm you are 18 or older before sign-up, and you cannot proceed if you say no. The App Store rates Citizen 17+. We do not knowingly collect information from anyone under 18, and we delete it if we learn we have.

Everyone, in the app or on the website: change or remove your issue positions, change your address (which recomputes your districts), turn usage measurement off, turn notifications and the Daily Brief off, and delete your account.

If you live in California, you have the right to know what we collect and to receive a copy, to correct it, to delete it, to opt out of sale or sharing, to limit our use of sensitive personal information, and not to be treated differently for exercising any of these.

If you live in Texas, you have the right to confirm whether we process your personal data and to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects. You also have the right to appeal a refusal of any of these requests. We will respond to an appeal in writing within 60 days and, if we deny it, tell you how to complain to the Texas Attorney General.

Do Not Sell or Share. We do not sell or share your personal information, so there is no opt-out for us to offer you. If that ever changes, we will build one and tell you before the change takes effect.

How to exercise these rights. Deletion is self-service in Settings. For anything else, contact us at the address in Section 3. We will verify your request against your phone number, since that is the only identifier we hold.

If personal information is exposed in a way that creates a risk to you, we will notify affected users and the regulators we are required to notify, without unreasonable delay and within the deadlines the law sets.

When we change this policy materially we will update the version number and the date below, and tell you in the app.

Citizen Scorecard LLC

support@citizenscorecard.com

citizenscorecard.com