Democracy Unlocked
Back home

Privacy Policy

Effective: May 24, 2026 · Last updated: May 24, 2026

Democracy Unlocked ("we," "us," "our") provides a free, nonpartisan platform for citizens to read, vote on, and discuss U.S. Congressional legislation. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. By using our site you agree to the practices described below. Where the law gives you stronger rights — under the EU General Data Protection Regulation, the California Consumer Privacy Act (CCPA/CPRA), or any other applicable statute — those rights apply in full.

1. Information we collect

1.1 Information you give us directly

  • Account information. When you sign up we collect your email address, a hashed password (or an OAuth token if you sign in with a third-party provider), and your name. Authentication is handled by Clerk — your password is never stored on our servers in plaintext.
  • Optional profile data. Your home state, ZIP code (stored encrypted), and policy interests, if you choose to provide them.
  • Civic engagement data. Your votes on bills, your comments in discussions, the bills you track, and any feedback you submit. Because votes on legislation can reveal political opinions, we treat them as a special category of personal data under GDPR Article 9 and process them only with your explicit consent (which you give by casting a vote).

1.2 Information collected automatically

  • Usage data. Pages visited, features used, approximate session duration. We do not use third-party analytics that profile individual users across sites.
  • Device and connection data. IP address (used only to derive approximate region and prevent abuse — not stored long-term in identifiable form), browser type, and operating system.
  • Cookies and similar technologies. See "Cookies" below.

1.3 Information from third parties

  • Public legislative data. Bills, sponsors, roll-call votes, representative profiles — all sourced from public APIs (Congress.gov, OpenStates). This information is about elected officials and legislation, not about you.
  • Authentication providers. If you sign in via a third party (e.g. Google), that provider shares the minimum profile fields needed to create your account.

2. Why we use your information (legal bases under GDPR)

Where GDPR applies, our lawful bases for processing your personal data are:

  • Contract. To provide the service you signed up for — authenticating you, saving your votes, displaying your dashboard.
  • Legitimate interests. To operate, secure, and improve the platform; prevent fraud and abuse; analyze aggregate (non-identified) usage to make product decisions.
  • Explicit consent. For processing your votes, comments, and inferred political opinions (special-category data); for sending email notifications; for any cookies beyond strictly necessary ones. You can withdraw consent at any time.
  • Legal obligation. To respond to lawful subpoenas, court orders, and statutory requests.

3. How we share information

We do not sell your personal information. We do not share it with advertisers, data brokers, or political campaigns. The only third parties that receive your information are the service providers we use to run the site, each under a contract that limits what they can do with it:

  • Clerk — authentication and session management.
  • Supabase — encrypted PostgreSQL database hosting.
  • Vercel — application hosting and edge networking.
  • Anthropic — AI bill summaries and analysis. Bill text and metadata are sent for analysis; your personal account data is not.
  • Resend (or similar email provider) — transactional email if you have notifications enabled.

We may also disclose information when required by law, to protect the safety of users or the public, or in connection with a merger or acquisition (we'll notify you and honor existing privacy commitments).

4. Cookies and tracking

We use a minimal set of cookies, organized into two categories:

  • Strictly necessary. Authentication, CSRF protection, and your privacy preferences. These cannot be turned off — without them the site doesn't work.
  • Functional. Remembering your selected state, your interests, and your reading position. Loaded only with consent.

We do not use advertising cookies, third-party trackers, or cross-site tracking. The cookie banner appears on your first visit and any time you change devices or browsers.

5. Your rights

5.1 Rights everyone has

  • Access — request a copy of the data we hold about you.
  • Correction — fix data that's wrong or out of date.
  • Deletion — permanently delete your account and personal data.
  • Portability — get your data in a machine-readable format (JSON).

Exercise any of these via your Privacy Controls page or by emailing privacy@democracyunlocked.com. We respond within 30 days.

5.2 Additional rights for residents of the EU/EEA, UK, and Switzerland (GDPR / UK GDPR)

  • Object to processing based on legitimate interests.
  • Restrict processing while we resolve a dispute.
  • Withdraw consent at any time, without affecting the lawfulness of prior processing.
  • Lodge a complaint with your local data protection authority.
  • Where we transfer data outside the EEA (e.g. to US-based service providers), we rely on Standard Contractual Clauses or equivalent safeguards.

5.3 Additional rights for California residents (CCPA / CPRA)

  • Know the categories of personal information collected, sources, business purposes, and third parties shared with — all listed above.
  • Opt out of "sale" or "sharing" of personal information. We do not sell or share your information in the CCPA sense.
  • Limit the use of sensitive personal information. We treat your political opinions and precise geolocation (when collected) as sensitive.
  • Non-discrimination — exercising your rights won't degrade your service.

5.4 Other US state laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), and Delaware (DPDPA) have rights substantially similar to those listed above and can exercise them through the same channels.

6. Data retention

We keep your account data for as long as your account is active. When you delete your account, we permanently remove your personal information within 30 days. Anonymized aggregate data (e.g. "67% of California voted yes on HR 123") is retained indefinitely for civic transparency, since it can no longer be linked back to you.

Audit logs of sensitive account actions (login, password change, data export, account deletion) are retained for 12 months for security purposes, then deleted automatically.

7. Security

We protect your data with:

  • Encryption in transit (TLS) and at rest (database-level).
  • Application-level encryption for the most sensitive fields (your email and ZIP code are encrypted with keys we control).
  • Single sign-on via Clerk — passwords are never stored in our database.
  • Limited access to production systems; audit logs of every privileged action.
  • Automated dependency scanning and routine security updates.

No system is perfectly secure. If we ever detect a breach affecting your personal data, we'll notify you and the relevant authorities within the timeframes the law requires (72 hours under GDPR for a high-risk breach).

8. Children's privacy

The site is not intended for children under 13 (under 16 in the EU/EEA). We don't knowingly collect personal information from children. If you believe a child has registered, please contact us and we'll delete the account.

9. International users

Democracy Unlocked is operated from the United States. If you access the site from outside the US, you understand that your data will be transferred to and processed in the US. We use Standard Contractual Clauses (SCCs) and equivalent safeguards for any transfer of EU/UK personal data, and we limit such transfers to what's strictly necessary to provide the service.

10. Changes to this policy

We'll post any updates here and update the "Last updated" date above. If the changes are material, we'll notify active users by email. Continued use of the site after a change means you accept the revised policy.

11. Contact us

Questions, requests, or concerns about your privacy?

  • Email: privacy@democracyunlocked.com
  • Postal: Democracy Unlocked, Privacy Office, [address — fill in before launch]
  • EU/UK representative: [appoint before EU launch under GDPR Art. 27]