Privacy policy

Reading the guide

You can browse and submit a correction without an account. The application does not use advertising trackers or analytics scripts, sell reader profiles or build dossiers of residents' political preferences. Search questions are processed to return evidence and are not saved in our application database. Hosting and security providers may process connection information and service logs.

Language and external services

An essential first-party cookie remembers your English or French choice for up to one year. Clearing it resets your preference. Comparison and filter choices may appear in page URLs. Official-source and social links take you to other publishers. Maps connect to OpenStreetMap only when you choose to load them. Those services have their own privacy policies.

If a page module fails to load, session storage remembers only a build identifier and reload time to prevent repeated automatic refreshes. Form text is never stored or transmitted by this recovery feature; a draft copy may remain in the current page until you close or reload it.

Corrections

We store the place, type, page, subject, description, evidence links, review status, dates and review history needed to assess and track a submission in Cloudflare D1. We store a hash of your private receipt, rather than the receipt secret. No name, email or account is required. Authorized editors can access private submissions. Staff access uses a verified identity and email. Do not include private addresses, family details, sensitive resident information or personal information about children.

Optional feedback

The feedback form asks for a message and a category. A usefulness response and reply email are optional. We save the page path you choose, without its search parameters or fragment, your interface language, a reference, and the dates and status of the submission. No name or account is required. We use this information to improve CivicPublic and respond only when you request a reply; we do not add you to marketing lists or infer political preferences from feedback.

Feedback is stored privately in Cloudflare D1 and mirrored to Nextcloud Forms on our own NAS for staff review and export. A separate service credential can transfer feedback, but cannot publish civic records or access correction submissions. Email notifications contain a reference, category and page, not your message or reply email. General feedback is not automatically sent to an AI provider or published. Authorized staff can view the private inbox.

A scheduled task removes feedback message text, optional email and private review notes from D1 after 180 days. The NAS service deletes its corresponding form response after that period when it is online; an outage can delay deletion there. Minimal reference, dates, status and delivery markers remain for accountability and safe retries. Backups and provider logs follow separate retention and operator maintenance. To request access or earlier deletion, contact contact@civicpublic.com with your submission reference.

If you email feedback@civicpublic.com directly, your message and sender address go to our private Mailcow inbox. Direct email is reviewed there; it is not automatically copied into the web feedback queue or sent to an AI provider. Web form deletion schedules do not delete mailbox copies. Mailbox retention and deletion are handled separately by the operator; contact contact@civicpublic.com to request removal.

Optional AI review

If you allow AI review, an authorized AI reviewer may process the submission. When our hosted processor is enabled, submission text and relevant public source excerpts may be sent to OpenAI. You can leave this option unchecked for editorial review only. We request that API responses not be stored as application state; this does not remove the provider's separate security or abuse-monitoring retention. Hosting and AI processing may occur outside your country. AI proposals and review records may be retained by CivicPublic as described below.

Security and retention

Private receipts reveal status and dates, not submission text. Keep the receipt secret. For submission limits, the application stores a daily salted hash of connection IP information, rather than a raw IP address in its database. The hourly maintenance task removes expired limit entries and redacts raw correction subjects, descriptions and evidence 180 days after receipt. It also removes related private review notes, excerpts and unpublished drafts, revokes pending review jobs and preserves minimal receipt and decision metadata. Published source-backed correction history remains available for accountability. If scheduled maintenance is unavailable, cleanup can be delayed until its next successful run. Provider logs and backups follow separate retention and operator maintenance.

Public information and your requests

We publish information relevant to public office, elections and community activity, with sources and dates. Public visibility does not make every personal detail appropriate to collect. We exclude private groups/messages, resident follower dossiers and inferred political beliefs. For access, correction, deletion, an objection to a published personal detail or withdrawal of AI-review permission, write to contact@civicpublic.com. We assess requests under applicable law and may need enough information to locate and verify the relevant record. Published evidence history or legally required records may need to remain. Technical and accessibility support: support@civicpublic.com. Changes to this policy will carry a revision date.