Privacy policy

What we collect when an assistant uses the connector

When you ask Claude, ChatGPT or another assistant an election question, it may look something up in a newsroom's voter guide through our connector. Each lookup names a tool and what to look for: a candidate, an office and district, a state or newsroom, or search words the assistant chose.

That lookup is all we receive. We don't get the question you typed, the rest of the conversation or anything about your account with the assistant. The company that makes your assistant handles the conversation under its own privacy policy.

For each lookup we record:

• The tool and what it was asked for, up to 200 characters
• What it found: which candidate, race and guide, or that nothing matched
• The name and version of the app that made the request, such as Claude
• The country the request came from, as Cloudflare, our host, reports it
• The time, how long it took and whether it failed

Requests usually reach us from the assistant company's servers, not from your device, so the country is often theirs. We use the IP address a request comes from only in the moment, to cap how many requests one connection can make. We don't save it.

Search words come from the assistant, which usually bases them on your question. If your question includes personal details, the assistant could pass some of them along in a search, and we would record them like any other search words. The exception is anything that looks like a street address. We record that a search was made, but not its words.

Street addresses

One tool finds the races on your ballot from a street address. The address goes to the U.S. Census Bureau's geocoder, a free federal service, which returns the districts it is in. We don't write the address to our records. We record only the state, so we can count lookups by state.

We hold the result of each address lookup in a temporary cache for 30 days, so a repeat doesn't go back to Census. The result is the districts and the names of the city, county and school district. The address isn't in it. The cache is filed under a one-way scramble of the address, made with a secret key, and we have no way to list or search what is in it.

After an address lookup, an assistant may ask about a race in those districts. Those lookups are recorded like any others, as an office and a district number. They aren't linked to the address, which we don't have.

Cards

Some assistants can show a card beside an answer. The card is a page we supply and the assistant's app draws. It loads nothing from anywhere else, so nothing about you leaves it. The information we send for a ballot card has your city, county and districts in it and no address, and the card ignores the address the app passes along with your question.

An app tells us it can draw cards when it connects, and we answer with a short label that it sends back with each request. The label is the same for every app and every person. It says the app draws cards and nothing else.

What we collect when you visit this site

This site sets no cookies and runs no tracking scripts. Nothing on it loads from an advertising or analytics company.

Our own server counts each page view. It records the page, the site that linked you here (its name only, not the full address), the country, whether the visitor looked like a browser or a bot, whether the page was found and any utm_source tag on the link. It doesn't record your IP address.

What we collect when you send us a form

Reporting a wrong answer

The report form saves what you send: your question, the assistant's answer, what's wrong with it and, if you give them, which assistant it was, your newsroom and your email. The report is emailed to us, and a person at Hacks/Hackers reads it.

We also check the pasted answer against the guides automatically. As part of that, sentences from the answer that describe a candidate are sent to TypeSafe, an AI service, along with what the guide published about that candidate. Your question and your email aren't sent to it.

Leave out anything private.

Signing up a newsroom's guide

The signup form saves the outlet's name and website, the guide's link, what it covers, your name, email and role, the outlet's EIN if you give it and anything you add in the notes. People at Hacks/Hackers read it to decide whether the guide can join.

Before they do, an AI model run on Microsoft Azure gives the signup a first read, and it receives what you put in the form. We also check public records about the outlet: its website and guide page, the mail and registration records for its domain and for your email's domain and, if you gave an EIN, its listing in ProPublica's Nonprofit Explorer.

Limiting repeat sends

To stop one sender flooding a form, we keep a one-way scramble of the sender's IP address and the date with each submission. It is erased after about two days.

When you donate

Donations are handled by Stripe on its own pages, under Stripe's privacy policy. We never see your card number. Stripe gives us a record of each donation, such as the donor's name, email and the amount.

How we use what we collect

We use the records of lookups and page views for:

• Running the connector and fixing it when it breaks
• Counting how much it is used, and by which assistants
• Telling each newsroom how its guide is used
• Keeping a record of the project and planning for future elections, such as which states and races to add

What you send in a form is used for what the form is for: fixing a wrong answer, or deciding whether a guide can join.

Each participating newsroom gets a summary of the candidates, races and topics looked up in its guide, the search words used, which assistants made the lookups and how many address lookups were in its state. These are counts, and they never say who asked. Search words are reduced to plain words first, with characters such as @ signs, dots and slashes removed, so an email address or a link can't pass through intact.

We may publish totals, such as how many lookups were made or which topics were searched most. Like the newsroom summaries, they never say who asked.

We don't sell what we collect or share it for advertising. We don't build profiles of people, and we don't use any of it to train AI models.

Who else handles what we collect

• Cloudflare hosts the connector and this site, stores our records and sends our email. Every request passes through its network.
• The U.S. Census Bureau receives street addresses sent for a district lookup.
• TypeSafe receives sentences from answers pasted into the report form.
• Microsoft Azure runs the AI model that reads newsroom signups.
• Google provides the email inbox where reports arrive.
• Stripe processes donations.
• Participating newsrooms receive the usage counts described above.

Links to a newsroom's site in an answer carry a tag, utm_source=voterguidecommons, so the newsroom can count the visits we send. It names us, not you. Once you follow a link, the newsroom's own privacy policy applies.

Beyond that, we share records only if the law requires it.

How long we keep records

• Records of individual lookups and page views: about three months, after which Cloudflare deletes them.
• Daily totals built from those records, including counts of what was looked up, the search words used and what came up empty: kept indefinitely, as a record of the project and to plan for future elections.
• Cached address lookups: 30 days.
• The scrambled sender mark on a form: about two days.
• Reports and signups: until we no longer need them, or until you ask us to delete them.

Seeing or deleting what we hold

To see or delete a report or signup you sent, email contact@voterguidecommons.org and we will.

We can't find or delete your lookups through the public connector, because nothing in those records says who made them.

You can stop all of it by removing the connector from your assistant.

Changes to this policy and how to reach us

If this policy changes, we'll post the new version here and change the date at the top.

Questions about privacy go to contact@voterguidecommons.org. Voter Guide Commons is a project of Hacks/Hackers.