Privacy Policy

This policy explains what information Legislate.dev (“Legislate.dev”, “we”, “us”) collects when you use the website at legislate.dev, the account service at accounts.legislate.dev, and the Legislate mobile app (together, the “Service”). It also explains what we do with that information and the choices you have.

What we collect and why

When you browse

You don’t need an account to read bills, votes, members, or anything else on the site. When you visit, we and our hosting providers receive the standard information any website gets: your IP address, browser and device type, the page you asked for, and the page that linked you to it. We use it to deliver pages, keep the Service fast and reliable, and protect it from abuse. Our providers keep these logs for a limited time.

Reading counts

To rank trending bills, a bill page tells our server that it was viewed. We count unique readers with a one-way hash of your IP address and browser, mixed with a random value that changes every day. The hash is held in memory for that day only, it can’t be reversed, and it can’t link your visits across days. We save only the totals for each bill.

Accounts

Accounts are optional. If you create one, we collect your name, email address, and, if you choose one, a profile picture. We also keep a record of your sign-ins and the session that keeps you signed in. We use this to run your account, to save things like the bills and members you follow, and to email you about your account. If you turn on email alerts, we also use it to send them.

Signing in with Google

If you sign in with Google, Google shares your name, email address, and profile picture with us. We use them only to create and sign in to your account and to show your name and picture in the Service. We don’t ask for access to your contacts, files, or any other Google data. We don’t use information from Google for advertising, sell it, or share it with anyone except the providers who help us run the Service. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can remove Legislate.dev’s access at any time from your Google Account settings.

The mobile app

The app keeps your follows, your district, and your settings on your device. If you turn on alerts, we store an identifier for your device, its push notification token, the app version, and the items you follow, so we can tell you when they change. We use your device’s built-in checks to confirm that requests come from a genuine copy of the app. The app doesn’t ask for your location, contacts, or photos.

When you contact us

If you email us, we keep the message and your address so we can reply and follow up.

Cookies and local storage

We use a small number of cookies and browser storage entries. None of them are used to track you across other websites.

• Preferences: remember whether you picked light or dark mode. This stays in your browser.
• Features: a random identifier, kept for up to a year, that keeps new features consistent for you while we roll them out gradually.
• Sign-in: keep you signed in. Set only if you sign in.

Our advertising partner may set its own cookies on pages that show ads. See Advertising below. Most browsers let you block or delete cookies. If you block the sign-in cookies, you won’t be able to stay signed in.

Who we share information with

We don’t sell your personal information. We share it only in these cases:

• Service providers that run parts of the Service for us and may use the information only to do that: hosting and content delivery, database hosting, web fonts, email delivery, and push notifications.
• Legal reasons: when the law requires it, or when we need to protect the Service, our users, or the public from harm, fraud, or abuse.
• A change of ownership: if Legislate.dev is ever transferred to someone else, your information would go with it, and this policy would still apply to it.

Our AI-generated bill summaries are made from the public text of bills. We don’t send your personal information to AI providers.

Advertising

Some pages may show ads from a third-party advertising partner. The partner may use cookies or similar technologies to show ads, limit how often you see one, and measure results, under its own privacy policy. We don’t give advertisers your account information, and we never use information from Google sign-in for advertising.

How long we keep it

• Server and security logs: a limited time, then they are deleted by our providers.
• Reading counts: only per-bill totals, which contain no personal information.
• Account data: for as long as you have an account. When you delete it, we delete your data within 30 days. Copies in encrypted backups are removed as those backups expire.
• App alert data: until you turn alerts off or delete the app’s data, or after a long period with no activity from the device.

How we protect it

All traffic to the Service is encrypted with HTTPS. Access to our systems is limited to the people who need it to run the Service, and our backups are encrypted. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects it, as the law requires.

Your choices and rights

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, or give you a copy of it. You can also object to how we use it. You can delete your account and its data at any time from your account settings, or by emailing us. We may need to confirm your identity before we act on a request, and we’ll respond within 30 days.

Depending on where you live, laws such as the EU and UK GDPR or the California Consumer Privacy Act may give you these rights formally. Where the GDPR applies, we process your information to provide the Service you asked for, for our legitimate interests in running and protecting it, and with your consent where we ask for it. You also have the right to complain to your local data protection authority. We won’t treat you differently for exercising any of these rights.

Where your information is processed

We and our providers process information in the United States and the European Union. If you use the Service from somewhere else, your information will be transferred there, with the protections described in this policy.

Children

The Service is meant for a general audience and isn’t directed at children under 13. We don’t knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we’ll delete it.

Changes to this policy

We’ll update this policy when our practices change. When we do, we’ll change the date at the top of this page. If a change is significant, we’ll also tell account holders by email or with a notice in the Service before it takes effect.

Contact

Questions or requests about your privacy can be sent to [email protected].