Privacy Policy
Effective: August 4, 2026 · Last updated: October 24, 2026
This Privacy Policy explains what information Ucracy Inc., a Delaware corporation (“ucracy”, “we” or “us”), collects through the ucracy website and apps, how we use and share it, how long we keep it, and the choices you have. ucracy is a civic platform: members propose bills and vote on them, and see how their senators and representative voted in Congress.
1. Information we collect
When you create an account
- Your name (first and last, and a middle name if you give one), email address, mobile phone number, mailing address, a username (your @handle) and a password. Our sign-in service, Amazon Cognito, keeps your password.
- If you sign in with Google, Apple, Microsoft or Yahoo, that service sends us your email address, whether it has verified it, and your first and last names. We ask for the rest when you complete your profile.
- If you sign in with Apple, we keep a one-way code made from Apple’s identifier for you, so that your next sign-in with Apple finds your account. If you sign in with Apple in the app on an iPhone or iPad, we also keep a token from Apple, sealed with encryption, whose only use is to tell Apple when your account is deleted. Both are deleted with your account.
- Your statement that you are 18 or older, and when you made it.
- If we ask you to confirm your age with Persona (section 6): that you are 18 or older, how and when Persona checked, and a reference to the check. We keep nothing else Persona tells us, and we never see your ID, your birth date or your selfie. When you give your consent before Persona opens, we keep which version of its words you agreed to, and when. We also keep when your account first had to confirm its age, and in which state, and we keep asking until you do, even if your address changes. While a check is open, we keep, for a day at most, what we need to collect its result from Persona.
- Your party (Republican, Democrat, Independent or “Prefer not to say”) and, if you choose to answer, whether you are a US citizen. If you answer the citizen question, you also agree that we may use your answer as section 2 explains, and we keep when you agreed.
When you use ucracy
- Your answers to the issue questions.
- What you post and do: the bills you propose; your votes on bills, and any reason you give; co-signs and their reasons; reposts; reactions; comments; posts in the community feed, on officials’ boards and in groups; the events you create or sign up for; the groups you join; the people and boards you follow; the bills, officials and topics you track; the people you block or mute; and the reports and correction requests you send.
- Your bio and interests, if you add them.
- Files you attach to posts and comments: pictures, audio and video. We keep each file as you uploaded it. A picture, a video or a recording can carry details your phone or camera added, such as when and where it was made. We do not remove them, so remove them before you upload if you do not want them shared.
- If you mark your identity as self-declared, that you did and when. We ask only which kind of identity document you hold, and we do not keep your answer. We never ask for the document’s number or a picture of it.
- Your notification settings, and the notices we show you in the app.
Technical information
- When your browser or the app reaches our servers, they record the network address it came from (its IP address), its description of itself (its user agent), what it asked for and when. We keep this record for one month.
- Our servers keep logs of errors and events for 90 days. Some of them name your account by its internal number.
- Our cloud account keeps a security record of what is done in it for 365 days, and up to 30 days more before each entry is deleted for good. Some entries name your account by its internal number: for example, when a token from Apple that we keep for you is sealed or opened. An entry for a sign-in may hold the network address it came from and its user agent.
- To limit abuse, we count recent requests from each network address and each phone number, and keep each count, with the address or number it counts, for about two hours.
- In ucracy’s live service, our sign-in service, Amazon Cognito, also checks each sign-in for signs that it is risky.
- The website sets two cookies of its own, which only tell it which page to show you. They last 30 days. Your browser’s storage keeps your sign-in and a few settings, such as the government you chose. The phone app keeps your sign-in in your phone’s secure storage.
- We use no advertising or analytics cookies, and no tracking tools from other companies. Section 6 names the one service from another company that runs in your browser on ucracy, Cloudflare Turnstile.
When you send us a request
Anyone, with or without an account, can ask us to remove an intimate image or send us a copyright notice. We keep what the form asks for. For an intimate image: your signature, whether you act for yourself or for someone else, your email address, your name if you give it, your statement, and where the image is. For a copyright notice: your signature, name, email address and postal address, your phone number if you give it, and the work and where it is. A member who sends a counter-notice gives their signature, name, postal address and phone number, and may give an email address.
When a profile is claimed
Where ucracy offers it, an official or a candidate, or someone they authorize, can claim their profile. We ask the person claiming for the official’s legal name, date of birth and home address (for a member of Congress or the President, only their home ZIP code), and for their own relationship to the official. We never ask for a Social Security number. For a member of Congress or the President, we also ask for the official’s work number, mobile number and email address, and we check the work number and the email address with the office. We reach the office only through the telephone number in our records and the email address it names on our call: we call the office on that number, the office names its email address, and we email a link for that one claim to that address and read the claim’s code to the office on the call. We seal these details, and the office’s email address, with encryption, and delete them about 30 days after we decide the claim, or about 90 days after it was sent if it is still undecided. Our encrypted backups keep a sealed copy for about 35 days more. We use these details only to check the claim, with one exception: if the claim succeeds, the mobile number fills in the official’s own phone step, where they can change it before they ask for the text code that confirms it. If the claim succeeds, the office’s email address becomes the sign-in of the official’s profile. If a claim turns out to be wrong, we undo it on the office’s word: we delete the sign-in it made, with what it posted as the official, and keep a copy of what we take down out of sight, as the record of what was removed. We keep the claim itself: who sent it, their relationship to the official, and what we decided.
2. How we use your information
- To run ucracy: to sign you in, show you what you ask for, and keep your settings.
- To find your officials: we send your address to the U.S. Census Bureau’s Geocoder, which tells us your state and your congressional district. Your district decides who your officials are and where your votes count. Your district and state also help order your Home feed and the community feed: after what you write, follow, track or join, and what your followers write, what comes from your district, then your state, is shown next. In the same way, they help order what you write in other members’ feeds.
- To compute and display each bill’s totals, and to show you where you and your officials stand, issue by issue.
- To show you notices in the app about activity you follow, as your notification settings allow. We do not send these by email or push. We email you codes, and notices about your account, a claim you sent, or a file of yours that was taken down.
- To keep ucracy safe: to check that a person, not a program, is signing up; to refuse a password found in a known data breach, and a sign-in that looks risky; to limit how often codes can be sent; and to review reports.
- To check, with Persona, that members in the states section 6 names are 18 or older.
- To meet our legal duties.
We use your citizenship answer to decide where your answers and votes count. If you’re not a US citizen, your answers, votes and picks for a seat are kept, but they aren’t counted in any totals. If you skip the question, they’re kept but not counted.
We use your party to fill in your answers to the issue questions: your party’s side on each issue, where it’s known, and “Mixed / it depends” elsewhere. They count as your answers until you change them. If you change your party, the answers still as we filled them change with it. We use your answers to show you where you and your officials stand, issue by issue, and we add them, without your name, to running totals for your state and district, which ucracy does not show. Where ucracy counts the issues on which you and your officials take the same side, a summary of your answers, worked out ahead for these counts, is kept privately with your account, and deleted with it. Your answers aren’t shown to other members, unless you hold public office and have claimed your profile, where they show as your positions.
3. AI and what you write
To submit a bill you press “Check with AI and continue”. That sends its title and description to an AI model, which checks that members can vote on it, suggests its issue, and looks for similar bills. To find similar bills, we also send it the titles and descriptions of up to 15 bills other members have published. In ucracy’s live service the model is Anthropic’s Claude, run for us by Amazon Web Services (Amazon Bedrock) in the United States. We send no name, email address or account number with the text.
We keep the model’s answer, without your text, for about 30 days, so that the same text is not sent twice, and a suggested issue for about a day. The bill keeps a record of which model checked it, and when. Our logs record that a check ran and what it decided, never the text.
Nothing else you write, such as your comments, posts, reasons or profile, is sent to an AI model. Our servers check what you write for other members to read, such as a comment, a post, a reason or your bio, against a fixed list, with no AI, and refuse it if it contains a slur or calls for violence. ucracy also uses AI to read public records, such as the titles and summaries of bills in Congress; those readings use no member’s information. “How ucracy uses AI” explains each use.
4. SMS and text messaging
When you add a mobile number and request a verification code, we use SMS to send you one-time passcodes and account-security messages. You opt in by entering your number and tapping “Send code by SMS” — we do not send you SMS unless you take that action. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time; replying STOP unsubscribes you from further messages.
No mobile information — including your phone number and your SMS opt-in and consent — will be shared with or sold to third parties or affiliates for marketing or promotional purposes. We use it solely to deliver the account-related messages described above, through our messaging provider (Amazon Web Services).
5. What other members can see
Nothing on ucracy is shown to anyone who is not signed in, apart from the pages anyone can open: the home page, the sign-in pages, these legal pages, “How ucracy uses AI”, the takedown pages, and the support and account-deletion pages. The sign-up form does tell anyone who tries whether an email address, a phone number or a username already has an account.
Other signed-in members can see:
- your name, @handle, bio and interests;
- your city, state and congressional district, and who your officials are;
- whether you marked your identity as self-declared, and when you joined;
- how many people you follow and how many follow you, and who they are;
- your votes on members’ bills, with any reasons you gave, and your co-signs with their reasons;
- what you post, comment and repost, under your @handle.
When you vote on a bill, its author is told your @handle and how you voted. In a group, only its members see its posts and its member list. When you sign up for an event, only its creator sees your name; if you accept an invitation to an event, its page and its cards in the feed name you among its guests. When you answer an invitation, its creator sees your answer. When you publish an event, every signed-in member can see your name as its host, its place, its street address and its description, even if that address is your own; before you publish it, only the people you invite can. Members can search for one another by name, @handle or city. A file you attach opens through a link that works for one to two hours, for anyone who has the link.
Other members never see your street address, email address, phone number, party, citizenship answer, the bills, officials and topics you track, or the people you block or mute.
6. Who we share it with
We do not sell your personal information, and we do not share it for advertising. We share it only as follows.
- Amazon Web Services runs ucracy for us: its servers, database, file storage and backups, our sign-in service (Amazon Cognito), our emails (Amazon SES), our texts (AWS End User Messaging) and the AI checks in section 3 (Amazon Bedrock).
- Cloudflare runs Turnstile, a check that a person, not a program, is using a form. It runs in your browser on the sign-up page and on the intimate-image and copyright forms. For those two forms we also send Cloudflare the network address the form came from.
- The U.S. Census Bureau’s Geocoder, a public service of the federal government, receives your address (street, city, state and ZIP code) when we look up your districts, and the address of an event you create.
- When you choose “Open in maps” on an event, its address goes to the maps service you open: Google Maps on the website, Apple Maps in the app on an iPhone or iPad, and your device’s maps app on Android. That service’s own privacy policy covers what it receives.
- Persona, a company that checks IDs, runs the age check for members whose address is in Mississippi, Tennessee, Georgia, Nebraska, Arkansas or Texas. Our servers ask it to open a check, with no name, email address or account number, and you show it a photo ID and a live selfie on its own pages, which open in your browser. It tells us only whether you are 18 or older, and how and when it checked. For the age check, Persona and ucracy each act as an independent controller of your information: Persona’s privacy policy at https://withpersona.com/legal/idv-privacy-policy covers what you show it, and this policy covers what we receive from it.
- If you sign in with Google, Apple, Microsoft or Yahoo, that service learns that you signed in to ucracy.
- When an account that signed in with Apple in the app on an iPhone or iPad is deleted, we tell Apple, so that Apple no longer lists ucracy in your Sign in with Apple settings.
- The company that runs our email holds the messages we send from, and receive at, our ucracy.com mailboxes, such as a request you send to privacy@ucracy.com.
- When a member sends a counter-notice, we send it, with their name, postal address, phone number and any email address they gave, to the person who sent the copyright notice. We do not tell a member who asked us to remove an intimate image.
- We may disclose information when the law requires it, to respond to legal process, to protect anyone’s safety, or to protect ucracy’s rights.
When the app signs you out without your asking, it tells our servers, and we email our own admin mailbox a note that names your account by its internal number, says how long ago you signed in, and gives the page, the app and its version, and the likely cause, so that we can fix it.
7. How long we keep it
We keep your information while your account is open.
When you delete your account, it is deactivated at once and deleted 30 days later. While it is deactivated, nobody can see your profile, your posts and comments are shown without your name, and your votes on bills and your positions on the issues are not counted; an official’s or a candidate’s profile stays with its office, as they left it. Until the 30 days are up, you can sign in and restore your account.
When you delete your account, we delete your profile, name, email address, mailing address and phone number; your votes, and the totals they added to; your answers to the issue questions; who you follow and who follows you; your tracks, blocks, mutes, notifications and group memberships; your event sign-ups, the invitations you received and your draft events; your likes and dislikes, your cosigns, and your reposts without a note; and your sign-in. We keep a note that the account was deleted, with its internal number and the time, for 60 days. If you run a claimed profile, deleting your account gives the profile back to its office, and its followers and username stay with it.
Some things stay, without your name:
- the bills you proposed, your posts and comments, and the events you published (an upcoming one, or one under way, is cancelled), shown as written by “A former member”, because others voted on them, replied to them or took part in them;
- the notes on your reposts;
- groups you made — they stay for their members, with a former member as their owner;
- the reports you filed, which stay with our moderators (a request to remove an intimate image keeps the details given in it, as below).
Notices we sent other members about what you did, such as that you voted on or commented on their bill, stay with those members, and name the @handle you had. The pictures, videos and voice notes in what stays are still shown with it, under new links that don’t lead back to you, and we delete the originals, unless a moderator’s case or an open report involves them. Your other uploads stay in our storage.
A request to remove an intimate image, a copyright notice and a counter-notice keep the names, signatures and contact details given in them, even after an account is deleted, because they are the record of what we did and why; a member’s own request to remove an intimate image keeps their account’s email address where they gave none. When a moderator removes something, we keep a copy out of sight, as the record of what was removed, and our record of moderators’ actions names the accounts involved by their internal numbers. Evidence of child sexual abuse is preserved for at least a year, as the law requires.
When you agree to our Terms of Service, we record which version, when, on which screen, whether on the website or in an app (and which version of the app), the network address it came from and your browser’s or app’s description of itself, and keep that record while your account is open. When your account is deleted, we keep only which version, when and on which screen, with a one-way fingerprint of your email address that can be matched but not read back, for seven years, as the record of what you agreed to.
When you give your consent before an age check with Persona, we keep which version of its words you agreed to, and when, while your account is open. When your account is deleted, we keep only which version and when, with a one-way fingerprint of your email address that can be matched but not read back, for seven years, as the record of what you agreed to.
Our database backups keep copies for 35 days, so something deleted can stay in a backup until its copy expires. Section 1 says how long we keep logs, the security record and claim details.
8. Your choices
- In Settings you can see your details, and change your @handle, bio and interests, your party and your citizenship answer. You can change any answer to the issue questions, and your vote and its reason on any bill.
- You can remove a co-sign, a follow, a track, a block or a mute, and turn most kinds of notification on or off.
- Your name, mailing address, email address and phone number can’t be changed in the apps yet. To correct one, or to have a post or comment of yours removed, write to privacy@ucracy.com.
- ucracy has no download of your data yet. Write to privacy@ucracy.com, and we will send you a copy.
- You can delete your account at any time in Settings.
- You can stop texts at any time by replying STOP.
Depending on the state you live in, the law may give you more rights over your information. Write to privacy@ucracy.com to use them. We may need to confirm that a request comes from you before we act on it.
9. Do Not Track
Some browsers can send a “Do Not Track” signal. ucracy does not track you across other websites and shows no advertising, so it does nothing different when it receives one. The only service from another company that runs in your browser on ucracy is Cloudflare’s Turnstile check, on the sign-up page and the intimate-image and copyright forms. Cloudflare’s own privacy policy says what it collects there.
10. Security
We protect your information with encryption while it travels to and from ucracy and where we store it, and with access controls. Admin accounts must use two-step sign-in, and you can add an authenticator app for two-step sign-in in Settings. No way of sending or storing information is completely secure. If an incident affects your information, we will tell you as the law requires.
11. Children
ucracy is for people 18 or older. Everyone confirms they are 18 or older when they sign up, and we do not knowingly collect information from anyone younger. Members whose address is in Mississippi, Tennessee, Georgia, Nebraska, Arkansas or Texas also confirm their age with Persona (section 6). If you believe someone under 18 has an account, write to privacy@ucracy.com.
12. Where your information is kept
We keep your information in the United States. Copies of the files members attach may be held for a short time at the edges of our content network, which can be outside the United States.
13. Changes to this policy
When we change this policy, we post the new version here and change the date at the top. We may also tell you in the app or by email.
14. Contact us
Questions or requests about your privacy: privacy@ucracy.com, or by post to Ucracy Inc., 61 N Plains Industrial Rd, #300, Wallingford, CT 06492.