Privacy Policy
The one-sentence version: your profile is private by default, nobody sees anything unless you choose to share it or step up to a public role, and we never sell data or show individual voter records in public — ever.
What we collect, and why
Your account: an email address (it’s how sign-in works — passwordless links, no passwords to leak), your first name, and optionally your last name. Where you vote: your ZIP, your state, and the county you confirm — the county is stored with its official federal identifier so pages and statistics can be exact. Your ZIP suggests a county; you always confirm it yourself. Optional street address: asked for only so a future block feature can work, and it is unconditionally private — never shown to anyone, at any visibility tier, for any reason. Photo: only if you upload one; a person reviews every photo before it appears anywhere, and the upload process strips hidden camera metadata (including location) automatically.
Who can see what — the three tiers
Default: nobody. A base profile is invisible until you flip “visible to my county” yourself. People making sure their street votes choose how widely others doing the same can see their name and county — their county, their state, or nationwide — and can change it any time. Verified officers of a county (confirmed by a live human meeting, never automatically) can additionally see the emails of that county’s street neighbors doing this work — the one place contact opens without you handing it over, and the page tells you exactly why. Every other field renders only per your own toggles. These rules are enforced in the database queries themselves, not just hidden in the interface.
Donations
Payments run on Stripe’s hosted checkout: we never see or store your card number. We keep what a receipt needs — amount, date, your email, and the state you supported — and a running public total. You are anonymous by default; your name appears publicly only if you check the box that says so. Plain-words disclosures sit above every give button.
Verification records
When an officer claim or an identity vouching happens, we record who verified whom, for which committee scope, and when — that audit trail is what makes a “verified” badge mean something. Verification records are visible only to the person they’re about and to the people who hold verification authority for that scope.
Voter data
Public pages show aggregate statistics only — turnout, totals, shares. Individual voter records never appear on a public page, no voter-file-derived feature is ever paywalled, and donations never gate any of it. Where states impose data-use restrictions, those restrictions bind our architecture per state.
Cookies & analytics
The complete cookie list — it’s short — lives at Cookies, along with the one choice you can make (whether we remember your county between visits). Page analytics is Vercel Analytics: cookieless and aggregate. No advertising or cross-site tracking exists on this site.
Where it lives, who touches it
Data is stored with Supabase (Postgres) and served through Vercel, under least-privilege access with row-level security enabled across the database, audit logging on sensitive actions, and per-state boundaries for restricted data. Transactional email is sent via SMTP.com from our own authenticated domain.
Your controls
Every sharing toggle is on your own profile page and takes effect immediately. To correct or delete your account and its data, email support@thedems.org from your account address — a person handles it. This policy changes only in writing, on this page, with the date below.
Last updated August 12, 2026.