Privacy Policy
Last updated August 29, 2026
DRAFT — requires attorney review before launch.
Rallybase is nonpartisan civic infrastructure, operated by Rallybase LLC, a Texas limited liability company. That company is the one that holds the data described here: in this policy “we” and “us” mean Rallybase LLC, and “Rallybase” on its own means the website and the service it operates. This policy describes what data we collect, why, and what we do — and don't do — with it. It reflects what the product actually does today, not aspirational language.
What we collect
Account basics: email, an optional username, and a password (stored as a bcrypt hash, never in plain text). If you verify your phone (Tier 2), we store the last 4 digits and a one-way hash of the full number — never the number itself. If you request mail-based district verification (Tier 3), your street address is held only until we mail your verification postcard, then permanently deleted; only a hash remains, to prevent the same address being reused across accounts. Your IP address is stored as a one-way hash, never in raw form.
What we don't do
We never sell your data. We don't run third-party advertising trackers or analytics pixels — usage analytics, where used, are first-party only. We don't share your email with movement creators, other users, or anyone outside Rallybase. Your Civic Record (votes, letters, meetings attended) is private by default and is only ever visible to someone else if you explicitly generate a share link — and that link shows summary counts only, never individual actions.
The AI assistant
Rallybase’s optional assistant and the “Ask” search send the words you type, along with public civic data we have already assembled about your area, to Google’s Gemini API. We use the paid tier. Google’s terms for it say that Google “doesn’t use your prompts … or responses to improve our products”, and that prompts are kept only to detect abuse of their service (read 2026-08-29; ai.google.dev/gemini-api/terms, effective March 23, 2026). The unpaid tier, which we no longer use, allowed human reviewers to read submitted content — earlier versions of this page said so, and that is no longer accurate.
Rallybase itself keeps no record of what you ask. There is no table of prompts and no log of questions: the text goes to Google, the answer comes back, and nothing about the exchange is written down here. It is still a third party processing what you typed, so we would not put a medical detail or a specific person’s name into it either.
What is never sent to Google: the text of any letter you write, your street address, your email, your account, or anything from your Civic Record. Letters go to the printer and the post, and nowhere else.
The other companies in the path
Here is every company that receives something, what it gets, and why. Google is one of them and has its own section above.
Neon is our database provider. It runs the managed Postgres behind the whole site, so everything we store is stored there — your account, your Civic Record, the text of any letter you have written. Vercel hosts the site: it keeps ordinary server logs — request paths, timestamps, response codes, and the IP a request came from — for a short operational window, and counts page views so we know which pages get used. We attach nothing about your account to either, we build no profiles from them, and nothing in the product reads them. SendGrid is our transactional email provider: password resets, email verification codes, and the Monday digest if you opt in all go out through it, so it receives your email address and what those messages say.
Cloudflare runs the “are you human?” check on sign-up and a few other actions; we send it the challenge token and your IP address, which is what that check requires — no name, no email. Sentry receives crash reports: the error, the page it happened on, and a tag saying which deployment you were on. Every report goes through a scrubber before it leaves your browser that deletes cookies and headers outright and redacts anything shaped like an email, a phone number, a street address or a token. We do not run performance tracing or session replay, so nothing records what you typed or how you moved around the page. Stripe handles card payments for physical mail; card details go straight to Stripe and never touch our servers. Lob prints and posts the letters — necessarily, it receives your name, your return address, the recipient, and the text of the letter, because those are what a posted letter is.
The rest are fetched by your browser rather than by our servers, so they see your IP address the way any site you open does, and nothing else — we send them nothing about you. OpenFreeMap serves the map’s background tiles, which means it sees which tiles you asked for, and so roughly where on the map you are looking. GitHub serves the boundary files the map draws on top of them.
How long we keep things
Your account and its data stay until you delete them; we do not expire accounts for inactivity. One-time codes — sign-in, phone, password reset, address verification — are short-lived by design. Payment records for paid letters are kept as accounting records for as long as the books require, with the personal fields removed once the account that made them is deleted. When you delete your account the rows go immediately, but our database provider keeps point-in-time backups for a short window, and your data ages out of those on their schedule rather than ours. We would rather say that than imply a delete reaches backwards through every copy.
Cookies and sessions
We use one httpOnly session cookie to keep you signed in. It isn't readable by JavaScript and isn't used for tracking or advertising.
Your choices
You can export your full Civic Record as a CSV at any time, revoke any share link instantly, sign out of every device from one screen, or delete your account — all from the Civic Record page. Deleting is immediate and needs your password. Before you confirm, the page lists exactly what goes and what stays.
What deletion does not reach, stated plainly. Payment records for anything you paid for survive as accounting records, with your name and account removed. If you are a verified organization and created a movement, the movement stays up without your name on it, because other people joined it. If you used paid mail delivery, a letter that has already been printed and posted is held by our mail vendor independently of us, and deleting our copy does not reach into their system. Recent database backups age out on our provider’s schedule. If any of that is a problem for you, write to us before you delete and we will work out what can be done.
If you cannot sign in — or you bought a letter as a guest and never made an account — email us at support@rallybase.org and we will delete it by hand. The contact page lists what to include. We do not ask why.
Contact
Questions about this policy: support@rallybase.org.