App Privacy Policy

What this policy covers

This policy covers the Citizen Playbook app at citizenplaybook.app, which is the separate application with the civic tools in it.

The public website at citizenplaybook.com is a different thing with a much shorter policy. See the Website Privacy Policy for that.

This policy is published by Mike Webb, operating under the Citizen Playbook name.

Getting into the app

The app needs an account. The private test period has ended and beta access codes no longer work. Nobody was emailed about that; the app says so when an old code is used.

Sign-in is handled by Clerk, which holds your email address and your sign-in credentials. We store only Clerk’s identifier for you, and your email address where it is needed to contact you about your account.

If you held a beta code, anything you saved in your browser has not been deleted. It stays on that device under the code it was saved with. Subscribing starts a new workspace rather than moving it across, because a beta code could be shared by several people and this app will not hand one person’s work to another.

What the app keeps in your browser

Several things are stored on your own device and are not sent to us:

• Your access code, in the browser's local storage.
• Public records requests you have built, also in local storage, so you can come back to them.
• The document you are working on, in the browser's IndexedDB. The app keeps the extracted text of an agenda packet or an analysed document, together with any results, so that refreshing the page does not throw away your work.

Clearing this site's data in your browser removes all of it.

Documents you open in the app

This is the part worth being precise about, so here is the order things happen in.

• Reading the file. When you choose a PDF, the app reads it and pulls the text out inside your browser. The current app does not upload the original document through its active interface.
• Asking for analysis. When you then ask for an explanation or an analysis, the extracted text is sent to the Citizen Playbook server and on to the AI provider. That is the step that leaves your device.
• The result comes back to your browser.
• What is kept. The extracted text and the results are stored in your browser as described above. Nothing about the document is stored on the Citizen Playbook server.

Because the text of a document is sent for analysis, please do not put confidential, legally protected, or highly sensitive material into the app.

What passes through the Citizen Playbook server

When a tool needs AI, the app sends the text of the request to the Citizen Playbook server, which passes it to the AI provider and hands the answer back to you. The server holds it only for as long as the request takes. It does not store the text of your request or the answer.

The AI provider

AI requests currently go to Anthropic. Some tools also ask Anthropic to run a live web search as part of answering. Which tools do that is set out in the AI and Data Use Disclosure.

What Anthropic does with what it receives is governed by Anthropic's own terms, so these are linked rather than paraphrased:

• Anthropic Privacy Policy (opens in a new tab)
• Anthropic Commercial Terms of Service (opens in a new tab)
• Anthropic data retention article (opens in a new tab)

Two points from those documents, in their own terms. Anthropic's Commercial Terms of Service say that Anthropic may not train models on customer content from the services. Anthropic's retention article says that for API users it automatically deletes inputs and outputs on its backend within 30 days of receipt or generation, with the exceptions listed there. Check the linked pages for the current wording.

Looking up a meeting

When you ask the app to find an upcoming meeting, the Citizen Playbook server makes that request, not your browser. It contacts the public meeting system the jurisdiction uses, and may download an agenda document that the jurisdiction has already published. The request carries the place you asked about.

Exporting a Word document

When you export a representative profile, the information already on your screen is sent to the server, which formats it into a file and sends it back. No AI is involved in that step and the file is not kept.

Usage records

The server keeps a usage record so the cost of running the app can be understood. Each entry holds the time, which access code label made the request, which tool was used, whether a web search ran, whether it succeeded, how long it took, how much text went in and out measured in tokens, and the estimated cost. If a request fails, the error message is recorded.

The usage record does not contain the text of your request, the answer, or any part of a document. Those fields do not exist in it.

The server also writes ordinary operational logs of the kind any web service produces. Authorization and cookie headers are removed from those.

Those logs include your IP address. Every request to any website is seen by the server that answers it, and ours records the address alongside the time, the path requested and the response code. They are operational — faults, abuse, attacks — and are not joined to your account or used to build a profile. They are kept for 14 days and then overwritten.

We do not geolocate you, do not infer or store a city or a precise position, and do not read GPS or browser location. A country you tell us when subscribing, and a 14-day server log, is the whole of it.

How long things are kept

What is in your browser stays until you clear it.

• Usage records: at most 90 days. Removed sooner once an account deletion completes.
• Operational logs, including IP addresses: 14 days, then overwritten.
• Billing records: kept for accounting and tax purposes, and kept after an account is deleted. The exact period is being confirmed with an accountant and this page will state it once it is set. Nothing is currently deleted on a schedule, which means these records are kept indefinitely for now.

Backups, and when deleted data really disappears

The customer and billing records are backed up, encrypted before they leave the server, and the backups are checked by restoring them.

When you delete your account, the erasure runs after the seven-day recovery window described below. From that point, encrypted backup copies containing your data are pruned on a 90-day schedule, so in normal operation your data is gone from the backups within about 90 days of the erasure.

Two exceptions, stated because they are real. We always keep the most recent backups — currently the newest 14 — even if they are older than 90 days, because a failure of the backup system itself must not leave us with nothing to restore from. And pruning runs as part of the backup job, so if backups stopped running, old copies would not be deleted until they resumed.

In either case your data could remain in an encrypted backup for longer than 90 days. We are alerted when a backup stops, but we do not promise an absolute deletion deadline, because these two exceptions can exceed it. The backups are encrypted, are not browsable, and are restored only to recover from a failure.

Anthropic's retention of what is sent to it is described in its own article, linked above.

Government sources and other websites

The app points you at city and town websites, meeting portals, and public records systems, and it can open a draft in your own email program. Those are run by other people under their own policies. The app never sends an email, a comment, or a records request on your behalf.

Accounts, subscriptions, and payments

Payments are handled by Stripe, which is the merchant of record for the purchase. We never see or store your card number. We store Stripe’s identifiers for your customer and subscription record, and the totals for each billing period — what was allowed and what was used.

We record a country, twice. Subscriptions are sold only to customers in the United States, so checkout asks you to confirm that and we store your answer with the time you gave it. We also store the country Stripe collects from your billing address, so the two can be compared. That is the only location information connected to your account.

Stripe holds its own records of your purchase under its own policy. You can ask Stripe to delete your information directly; if you do, Stripe cancels the subscription and deletes those records, including the copies in our Stripe account.

Your choices

• Clear this site's data in your browser to remove everything the app has stored locally.
• Choose not to put sensitive material into a tool.
• Stop using the app. Nothing about you remains on the server except the usage entries described above, which hold no content.

Asking what is held, or asking for deletion

Email support@citizenplaybook.com to ask what we hold about you, to correct it, to object, or to complain. We answer these ourselves and there is no form to fill in. You may also complain to your local data protection authority if you have one.

Note that emailing us means Google receives the message, because that address is a Google Workspace mailbox. See the list below.

Deleting your account

You can ask for your account to be erased from within the app. What happens, in order:

1. At once, when you confirm: access stops and billing stops. You are not charged again and you cannot use the paid features.
2. Nothing is erased yet. For seven days everything is still there, because you can change your mind using a recovery code shown to you at the time. Keep it if you think you might. Recovery restores access to your account; it does not restart your subscription.
3. After seven days the deletion cannot be undone by anyone, including us, and the erasure runs.
4. The erasure keeps a billing record before deleting anything else. That order is deliberate: if it failed halfway we would otherwise lose both the data and the evidence of what you were charged.
5. Then your account data is deleted — your account record, your usage periods, your request history, your subscription record and your checkout records — and your identity is deleted last.

What survives, and what is in it. The retained billing record holds what is needed to account for money received: our identifier for your account, Stripe’s customer and subscription identifiers, the first and last billing period, how many periods were billed, and the total spent. It does not contain your email address, your documents, your questions or your answers. Saying your account is fully erased would not be true while that row exists, so we do not say it.

Your saved work lives in your browser and is not affected by any of this. Clear it yourself, or use the control in the app.

Who else is involved

These are the only companies that receive any part of your data, and what each one gets:

• Clerk — your email address and sign-in credentials, to sign you in.
• Anthropic — the document text and question you submit, forwarded by our server, to produce the summary or answer.
• Stripe (and Link) — your payment details, billing address and email, to take payment as merchant of record.
• Google — anything you email to support@citizenplaybook.com, including its contents, your address and any attachments. That address is a Google Workspace mailbox, so every support message is received and stored by Google under its terms. If you would rather a support conversation not sit in Google’s systems, there is no way around that with this address, and it is better that you know.
• DigitalOcean — hosting for the servers and the encrypted backups, in the United States, and the operational logs described above.

We also retrieve public records — agendas, packets, minutes — from government and public-data websites. Those requests are made by our servers, not by your browser, so those sites do not see you or your IP address.

Changes to this policy

This policy will change as the app changes, and the effective date at the top will be updated. The move out of the private test period, and the arrival of accounts and payments, are the revision you are reading.

If we change this policy in a way that materially affects you, we will give you at least 30 days’ notice, except where a shorter timescale is required by law or is needed urgently for security.

We do not claim a security certification, and no service can promise it will never be breached. If a breach affects your data, we will tell you. This page has not been reviewed by a lawyer.

Contact

Questions about this policy can go to support@citizenplaybook.com.