Privacy Policy

1. Introduction

Community PACT LLC ("Community PACT," "we," "us," or "our") operates the Community Accountability Tracker platform (the "Platform"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have regarding your information. This Policy should be read together with our Terms & Conditions.

2. Information We Collect

We collect the following categories of information:

• Account information — display name, email address, password (stored as a salted hash, never in plain text), account type (community member, stakeholder, staff, admin).
• Location information — the zipcode(s) you provide, used to map you to your community, congressional, assembly, city council, and community board districts.
• Stakeholder profile information — for stakeholder accounts: organization, title, bio, website, and social media links you choose to add.
• User-submitted content — commitments, votes, comments, evidence uploads, official updates, and messages you submit to the Platform.
• Site usage information — pages visited, referring domain, device type, and an anonymous visitor identifier generated by hashing your IP address together with a daily-rotating salt. We do not store your raw IP address.
• Technical/session information — a session cookie used to keep you logged in (see our Cookie Policy). We do not use session-replay, screen-recording, or third-party chat/analytics tools that would let a third party observe or record your individual browsing session or communications on the Platform.
• Payment information — for paid subscriptions, billing is processed entirely by Stripe. We do not receive or store your full card number; we retain only a subscription/customer reference ID.

3. How We Use Your Information

• Operate, maintain, and secure the Platform and your account;
• Map commitments, legislation, and community engagement to your neighborhood and political districts;
• Send transactional emails (verification, password reset, subscription receipts) and, if you opt in, alert emails about new commitments, legislation digests, or official updates;
• Display your display name, and — for stakeholders — your public profile information, on the Platform;
• Analyze aggregate, de-identified site traffic to understand how the Platform is used;
• Enforce our Terms & Conditions and investigate abuse, fraud, or violations of law.

4. How We Share Your Information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We share limited information only with the service providers that help us operate the Platform, each acting on our behalf and under obligations to protect your data:

• Stripe — payment processing for paid subscriptions;
• Resend (or our configured SMTP provider) — transactional and alert email delivery;
• Anthropic (Claude API) — AI-generated plain-language bill summaries and community impact tags for legislation (does not involve your personal account data);
• Railway — application hosting infrastructure.

Content you choose to make public on the Platform — such as your display name, comments, votes, and stakeholder profile — is visible to other users and the general public by design, since Community PACT is a public accountability platform. We may also disclose information if required by law, subpoena, or to protect the rights, property, or safety of Community PACT, our users, or the public.

5. Do Not Sell or Share My Personal Information (CCPA)

Community PACT does not sell or share personal information, as those terms are defined under the California Consumer Privacy Act (CCPA), and has not done so in the preceding 12 months. California residents have the right to know what personal information we collect, request deletion of that information, correct inaccurate information, and not be discriminated against for exercising these rights. To exercise any of these rights, contact us at info@communitypact.org.

6. Your Rights & Choices

• Access & correction — you can view and update most of your account and profile information directly from your Profile page.
• Deletion — you can permanently delete your account and associated personal data at any time from your Profile page (Danger Zone), or by emailing us. See Section 7 for retention timing.
• Email preferences — you can opt out of alert and digest emails at any time from your notification settings, or via the one-click unsubscribe link included in every alert email. Transactional emails (e.g., password reset) cannot be opted out of, as they are required to operate your account.

7. Data Retention

We retain your account information for as long as your account is active. When you request account deletion, we permanently delete your personal account data (email, password hash, profile details) and anonymize or remove content that directly identifies you within 30 days. Some content you submitted — such as commitment records or comments relevant to the public accountability record — may be retained in de-identified or anonymized form to preserve the integrity of the Platform's public record. Anonymous site-usage data (Section 2) is retained in aggregate form for analytics and is not linked back to an identifiable person.

8. Data Security

In accordance with the New York SHIELD Act, we maintain reasonable administrative, technical, and physical safeguards designed to protect your personal information, including password hashing, HTTPS/TLS encryption in transit, and httpOnly session cookies. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Breach Notification

In the event of a security breach affecting your personal information, we will notify affected users and, where required, relevant state authorities without unreasonable delay, consistent with our obligations under the New York SHIELD Act and other applicable law.

10. Children's Privacy

The Platform is not directed to, and is not intended for use by, children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly. See our Terms & Conditions for our full age restriction policy.

11. International Visitors (GDPR)

Community PACT is based in the United States and primarily serves New York communities. If you access the Platform from the European Economic Area or United Kingdom, our lawful basis for processing your information is your consent (for optional features like email alerts) and our legitimate interest in operating a public accountability platform. You may exercise your GDPR rights (access, rectification, erasure, portability, objection) by contacting us at the email below.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a revised effective date, and for material changes, we will make reasonable efforts to notify registered users by email.

13. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, contact us at info@communitypact.org.