Privacy Policy

Last updated September 21, 2026.

The address you search

When you search, your address is sent to our server over an encrypted connection, converted into the list of districts you live in, and then discarded. It is never written to our database and never appears in the address bar of the page you are on.

What we keep is a cache entry so the next person on your street does not cost us a fresh lookup. That entry holds:

• a one-way keyed hash (HMAC-SHA256) of the normalized address — a fixed-length digest that cannot be turned back into an address, and that nobody without our secret key could even test a guess against;
• the districts that address falls in, which are public geography, not personal information;
• coordinates rounded to three decimal places — roughly a 110-metre square, a neighbourhood rather than a front door;
• which geocoder answered and which map version it used, so we know when redistricting has made the entry wrong.

There is no column anywhere in our database that holds an address, a name, an email tied to a search, or an IP address tied to a search. Cache entries expire and are deleted automatically after 180 days.

Who your address is shown to

We cannot work out your districts without a geocoder, and we do not run one ourselves. On a cache miss — that is, the first time anyone searches an address like yours — the address is sent to a geocoding service purely to get back a set of districts:

• the US Census Geocoder, a free US government service, which is what we use for essentially every search;
• Geocodio, a US geocoding company, only if the Census service is down or cannot match your address.

Those services receive the address and nothing else — no identifier of yours, and nothing linking one search to another. Your address is never sent to an advertising network, an analytics service, a social network, a mapping widget, or a data broker. We do not send it anywhere for any purpose other than finding your districts.

What we never do

• We do not sell, rent, trade or otherwise disclose your data to third parties. There is no commercial arrangement anywhere on this site involving anyone's information.
• We do not run advertising, and we do not make this site available to advertisers, ad networks or ad-tech intermediaries.
• We do not track you. There are no analytics, no tracking pixels, no fingerprinting, no cross-site trackers, no third-party cookies. The pages load no scripts, fonts, stylesheets or tags from anyone else's servers — you can check this in your browser's network panel, and our Content-Security-Policy header blocks them outright.
• We do not build profiles. We keep no history of what you searched, and we have no way to connect two searches to the same person.
• We do not sign you up for anything. Searching does not put you on a mailing list, because we have no mailing list.

If you report a correction

Result cards carry a "report outdated info" form. If you use it, we store what you wrote and — only if you choose to give it — an email address, so a volunteer can come back to you with a question. The email is used for that and nothing else: no newsletter, no forwarding, no resale. Please do not put your home address or anything else private in the message; we do not need it, and it will simply sit in the report.

Ask us to delete a report you filed and we will.

If you use the contact form

The contact page asks for four things, and we store exactly those four:

• your name, as you typed it — we do not verify it and it does not have to be your legal name;
• your email address, so we can reply;
• the subject you picked from the list; and
• your message.

Those four values are saved in our database so a volunteer can act on them. Nothing else about the submission is stored — not your IP address, not your browser, not which page you came from, and nothing linking the message to any search you made.

Your email address is used to reply to you and for nothing else. It does not go on a mailing list, because we have no mailing list. It is never sold, rented, shared or passed to a campaign, an advocacy group or anyone else.

The form accepts text only. There is nowhere on this site to upload a file, and our server is configured to refuse one outright, so please do not try to send documents or photographs — paste the relevant detail into the message instead.

Please do not put anything sensitive in a message: not your home address, not government identifiers, not health or financial details. We do not need any of it, a volunteer will read what you send, and it will simply sit in our records until it is deleted.

How long we keep it. We keep a message while we are acting on it and for a reasonable period afterwards so we have the thread if you write again. Ask us to delete a message you sent and we will — email [email protected] from the address you used, or say so in a new message.

The anti-spam check on the contact form

A public form that emails two real people is the most abusable thing on this site, so it carries a check that you are a person rather than a script.

That check is a short arithmetic question, served by this site and answered on this page. It is not a third-party CAPTCHA: nothing is loaded from anyone else's servers, no images or audio are used, no token is set in your browser, and no information about you reaches any other company. We do not learn anything about you from it beyond whether the answer was right.

The question is plain text on purpose, so that it works with a screen reader and does not require you to identify traffic lights in photographs. If it ever gets in your way, email [email protected] directly instead.

Both forms also carry a hidden field that a person never sees and never fills in, and we limit how many times one internet connection can submit them in a short period. The IP address used for that limit is held in memory for a few minutes and is never stored with your message.

Cookies

We set no advertising or analytics cookies, so there is no consent banner to click through. The only cookies this site can set are functional ones from the web framework: a CSRF token that protects the correction and contact forms from being submitted on your behalf by another site, and a session cookie that exists only for volunteers logged into the admin. Neither is used to identify or follow you.

Server logs and abuse prevention

Like any website, our host records ordinary web-server logs — the page requested, the time, a status code, a browser user-agent and an IP address. These are operational records used to keep the site up and to stop automated abuse; they are not joined to searches, not used to build a profile, and not shared with anyone.

We use your IP address as a short-lived rate-limiting key, held in memory for a minute at a time so that a script cannot hammer the search. It is never stored alongside what was searched.

The services that run the site

Running a website at all means someone hosts it. We use a hosting provider to serve these pages and a transactional email provider to send maintenance alerts to our own volunteers. Neither is given your search data, because we do not have it to give. They are not permitted to use anything they do handle for their own purposes.

How long we keep things

• Your address — never stored.
• Hashed cache entries — deleted automatically after 180 days, and flushed early whenever district maps change.
• Correction reports — kept while we act on them, and deleted on request.
• Contact messages — the name, email, subject and message you sent, kept while we act on them, and deleted on request.
• Server logs — kept for a short period by our host, per their standard retention.

Your rights

Most privacy rights — see what you hold on me, delete it, do not sell it — are satisfied here by there being nothing to act on. We cannot show you your search history, because none exists. We cannot delete your address, because we never had it. We do not sell personal information and never have, so there is no sale to opt out of.

Where you have given us something directly — a correction report, or a message through the contact form, or an email address with either — you can ask us to show it to you or delete it, and we will.

Children

This site is for everyone, including students. Because there are no accounts and we ask for nothing about you, we do not knowingly collect personal information from children or from anyone else.

Security

The site is served over HTTPS only. The address hash uses a secret key held in our server configuration, so the hashes are useless on their own. Contact details for officials are public information published by the officials themselves.

Changes to this policy

If we change this policy we will update the date at the top. If we ever changed the three promises in the summary above, we would say so plainly on the front page rather than quietly editing this one — but those promises are the point of the project, and we do not expect them to change.

Contact

Questions about this policy, or about anything above? Use the contact form and pick "Privacy request", or email [email protected] directly. For a wrong or missing official, the report form on any result card reaches a volunteer faster, because it tells us which record you were looking at.

More about the project and where the data comes from is on the About page.