Privacy Policy

Short Version

Your address is used to look up your ballot and (if you buy one) mail you a postcard. We do not sell your data. We do not run ads. We do not track you across the internet. Analytics are aggregated at the state/county/ZIP level with no personal identifiers.

1. Who We Are

VoteOut is operated by Bryan Weaver, a Texas sole proprietor. For privacy questions, contact support@voteouteveryone.com.

2. Information We Collect

Address you submit. The address you type into the ballot lookup form is used to geocode your location and query public election APIs (Google Civic Information, OpenStates, OpenFEC). The address is cached temporarily in our database so you can share a ballot link, and expires after the associated election date.

Order information, if you purchase a postcard. Your name, mailing address, email address, and order details. We do not see or store your payment card number. Payments are processed by Stripe, which receives your card number directly.

Aggregate usage stats. We log coarse statistics about site usage — state, county, and ZIP-code prefix of submitted addresses — with no names, full addresses, IPs, or account identifiers attached. This tells us which regions the site is serving without identifying individual users.

Session storage in your browser. Your current ballot address is stored in your browser’s sessionStorage under the key voteout-address so the navbar and representatives page can use it. This data lives in your browser, not on our server, and is cleared when you close the tab.

3. Cookies & Similar Technologies

VoteOut itself does not set tracking cookies or use advertising pixels. The site uses the minimum storage required to function:

• Session storage in your browser for the current ballot address (see Section 2).
• Stripe’s checkout sets cookies on its own domain for fraud prevention and payment processing while you are completing a purchase. Stripe’s privacy practices are governed by its own privacy policy.
• Vercel, our host, may set short-lived first-party cookies for load balancing and bot protection. These do not identify you personally.

We honor Global Privacy Control (GPC) and Do Not Track signals. Because we do not sell data or use cross-site tracking, these signals do not change your experience — but they are respected by default.

4. What We Don’t Collect

We do not use third-party advertising trackers, do not sell or rent any data, do not share data with political campaigns or parties, and do not build personal profiles about you.

5. How We Use Your Data

The address you submit is used only to: (a) fetch your ballot and representatives, (b) print and mail any postcard you order, and (c) generate aggregate, de-identified usage stats.

We do not use your data for marketing. We will not email you unless you specifically contact us for support or you opt in to a future notification.

6. Service Providers

We use a small number of service providers to run the site, each bound by their own privacy terms:

• Vercel — hosts the website.
• Supabase — hosts the database that temporarily caches ballot lookups.
• Stripe — processes postcard payments.
• Lob — prints and mails postcards.
• Resend — sends transactional order confirmation and delivery-status emails.
• Google Civic Information, OpenStates, OpenFEC — public data sources queried with your address to retrieve ballot information.

7. How Long We Keep Data

• Ballot cache entries — expire after the related election date.
• Order records — retained for 7 years to support refunds, tax reporting, and legal recordkeeping.
• Aggregate usage stats — retained indefinitely because they cannot identify you.
• Support emails — retained for 2 years after the ticket closes.

8. Your Rights

Depending on where you live, you have rights under privacy laws including the Texas Data Privacy and Security Act (TDPSA), the California Consumer Privacy Act / CPRA, and similar laws in other states. You can:

• Request a copy of data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal hold periods for order records).
• Opt out of any future data sale or targeted advertising (we don’t do either).
• Appeal a denial of a rights request (we will respond to an appeal within 60 days).

To exercise any of these rights, email support@voteouteveryone.com from the email address associated with your order, or describe what you submitted with enough detail that we can locate it. We respond within 45 days as required by the TDPSA; we may extend once by 45 days if reasonably necessary, with notice.

9. International Users

VoteOut is a U.S. civic-information service targeted at U.S. voters. The site and its data are stored on U.S. infrastructure. If you access the site from outside the United States, you consent to the transfer of any information you submit to the U.S. We do not intentionally serve users in jurisdictions that require additional data-protection commitments (including the EU/UK under GDPR); if you are such a user, please do not submit personal information.

10. Security & Breach Notification

We use HTTPS for all traffic, encrypt data at rest in Supabase, and restrict database access via role-based keys. No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify affected users by email as soon as reasonably possible and within any timeframe required by applicable law.

11. Children

VoteOut is a tool for registered voters and is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.

12. Changes

Material changes to this policy will be posted on this page with a new “Last updated” date.