Privacy Policy

The short version

• Your answers are stored on your device. Anonymized sharing, which starts on and can be turned off in Account, contributes only counts (your answers, your stances on bills, and your choices on ballot measures), plus your state so results can compare states, never anything that identifies you.
• Location is optional. When you use it, we look up your state and U.S. House district with the U.S. Census Bureau, using your coordinate rounded to about 1 kilometer, then discard it. It goes nowhere else.
• If you share answers, your state is attached to that anonymous count so the app can show how states compare. You can turn that off on its own in Account and keep sharing answers, and turning it off also withdraws the state from counts you already contributed, except ballot measure choices: a ballot measure appears on only one state’s ballot, so its results are that state’s either way.
• We do not use advertising identifiers, third-party ad networks, or tracking SDKs.
• Anonymous crash reports are on by default so we can fix bugs; they carry the device model, OS version, and the crash itself, never your answers, location, or identity. Turn them off any time in Account.
• Concord Plus is an optional subscription bought through Apple. Apple handles the payment; Concord receives no name, email, or payment details, and the subscription is not linked to any answer you share.
• We do not sell or rent your personal information.
• You can delete everything stored on your device at any time from Account → “Delete my answers and start over,” or by uninstalling the app. Anonymous counts you already shared carry no identifier, so they cannot be removed.

Information you provide

Your responses to issue questions, and your stances on bills and ballot measures, are saved locally on your device so your civic profile persists between sessions. Unless you turn anonymized sharing off, answering also contributes an anonymous count (see “Anonymized sharing” below).

If you choose to set a voting location, we store only your state and (optionally) your U.S. House district number, locally on your device.

How location works

Setting your location is optional and you can use the app fully without it. If you tap “Use my location,” your device provides a GPS coordinate that we round to two decimal places (about 1 kilometer) and use, in memory, to look up your state and congressional district through the U.S. Census Bureau’s public geocoder.

The coordinate is rounded before it leaves your device, used only for that lookup, and is not stored by Concord and not sent to our servers. The Census geocoder is the only service that receives it: Concord does not use your phone’s built-in address lookup, which would send it to Apple or Google. Only the resulting state and district are saved on your device. You can also set your state manually without granting location permission.

Your state, and only your state, is sent with a shared answer if you have turned on “Where others stand.” Your district is never attached to a shared answer, and the coordinate never reaches our servers at all.

To load the races, candidates, ballot measures, and local news for where you vote, the app asks our server for that state and district. For example, “show me the races in CA district 11.” That request carries no account, device identifier, or answers, and we do not store it against you.

Information we do not collect

• No name, email, password, or account (the app is anonymous in this version; an email address reaches us only if you choose to email us feedback).
• No contacts, photos, microphone, or background location.
• No advertising or cross-app tracking identifiers.

How we use information

Your answers are used on your device to compute your civic profile and your overlap with candidates and movements. Your location is used to show the races on your ballot. We use this information only to provide the app’s features to you.

Anonymized sharing (on by default, with a full off switch)

Anonymized sharing starts on, is disclosed on first launch, and can be turned off at any time under Account → “Where others stand.” While it is on, answering contributes to the aggregate results the app shows after each question: the question, the chosen value, and, if you have set one, your state, with no account, device identifier, name, timestamp, or precise location attached. When you change an answer, the previous value (and the previous state and lean group it was counted under) is sent with the new one so the old count is corrected rather than doubled. Each change also carries a random one-time token, so a retry after a dropped connection is not counted twice; the server holds these tokens in memory for about half an hour, never stores them with the counts, and forgets them on restart.

Your state is sent so results can show how your state compares with the country. It is stored only as a count for that question and state, never as a record of your answer. A state’s own results, and even how many people in it answered, stay hidden until at least 25 people there have answered that question, so a thin state can never reveal how or where someone answered.

Shared answers may also be grouped by a coarse lean - left, even, or right - computed on your device from your own answers, as counts only, so results can show how people with different overall views answered. The same 25-answer minimum applies to each group, to its size as well as its results, and the lean never accompanies anything that could identify you.

Bills and ballot measures work the same way. While sharing is on, your support or oppose stance on a bill, and your Yes, No, or Not sure yet choice on a ballot measure, are sent as counts exactly like an answer: the item, the value, your state if “Include my state” is on, and the coarse lean described above. A ballot measure appears on only one state’s ballot, so its results are that state’s.

Story quizzes work the same way: if sharing is on, your multiple-choice pick is sent as an anonymous count so results can show how many people knew the answer. Whether you got it right is only ever shown to you, on your device.

We store only running counts per question and answer value. We do not keep individual submissions, so a contribution cannot be traced back to you. Turning sharing off stops further contributions; because past counts carry no identifier, they cannot be located to remove.

Results are published in batches. The counts anyone can see for a question, bill, measure, statement, or quiz change only after at least five new answers on it have come in from five different connections, so no single answer shows up as the difference between two readings. The published figures can trail the newest answers, your own included, until the next batch fills.

Like any server, ours sees the network address a request comes from. It uses that address only in memory: as it is, for about a minute, to limit how many requests one connection can send; and in a scrambled form it cannot reverse, different for each item, to limit how much one connection can add to any one result in a day and to count a report once per connection. The address is never stored with any count or report, and it is gone from memory within two days.

Aggregate results appear only once enough people have answered for the numbers to be meaningful.

Weighing in on a bill discussion statement works the same way when sharing is on: your agree or disagree vote is sent as a count, together with a coarse lean bucket (left, even, or right) computed from your answers on your device. The bucket exists so results can show how people of different leans received a statement. It is three broad groups, never your profile or your answers, and it is stored only as a count.

Crash reports (on by default, opt out any time)

To find and fix bugs, the app sends an anonymous report when it crashes or freezes. A report contains the device model, operating system version, the app version, and the technical details of the crash. It never contains your answers, your location, or anything that identifies you, and we scrub reports in code before they are sent: network requests are not recorded, web addresses are cut before any query, and every report carries the same fixed anonymous label instead of a device or install identifier.

Crash reports are processed by Sentry, an error-monitoring service, on our behalf. You can turn them off at any time under Account → “Crash reports,” and from that moment nothing further is sent. If you turn them back on, reports resume the next time you open the app. Deleting your data from Account keeps this choice as you set it.

Question, story, and estimate reports

If you report a problem with a question, a news story, or a candidate position estimate, the report is sent to our server as an anonymous count: the item reported and the reason category you chose. It carries no account, device identifier, name, or timestamp, and any note you type stays on your device. A report is counted once per connection per item per day. Reports work whether or not sharing is on, because a report describes our content, not your views.

Third-party services

Concord relies on a small number of external services. When you interact with these features, requests go directly to those providers, who handle that data under their own policies:

• U.S. Census Bureau Geocoder: receives a coordinate, rounded to about 1 kilometer, to return your state and district when you use location. It is the only service that ever receives the coordinate.
• Concord’s content API and public government sources (e.g., Congress.gov, the unitedstates project): provide candidate, legislative, and news data. We do not send your personal information to retrieve them.
• Sentry (error monitoring): receives anonymous crash reports as described above, unless you turn crash reports off.
• YouTube: provides thumbnails for outlet videos. When you choose to watch one, Concord loads YouTube’s embedded player in its privacy-enhanced mode (youtube-nocookie.com), and YouTube receives technical and playback information under Google’s privacy policy. The embedded player does not load until you tap a video.
• News outlet and public image hosts: lead images on news briefs, candidate portraits, and video thumbnails load directly from the publisher that provided them (a news outlet’s image servers, the unitedstates project’s image host, Wikimedia Commons, Open States or a state legislature’s website for state legislators, or YouTube’s thumbnail service). Like any web image, the host sees a standard image request from your device; Concord sends it nothing else about you.
• Apple (Concord Plus): if you subscribe, the purchase is made through Apple’s in-app purchase system under Apple’s terms and privacy policy. Apple tells the app only whether a subscription is active on your Apple ID. Concord receives no name, email, or payment details, keeps no record of the transaction on its servers, and never attaches your subscription to any answer you share.
• Official voting sites (vote.gov, usa.gov, house.gov): open in your browser when you tap a readiness link. Leaving the app, you are subject to those sites’ privacy practices.
• Followed-bill alerts: while reminders are on, the app wakes in the background about once a day and fetches the latest bill statuses from Concord’s content API, then compares them with the bills you follow on your device. The request is the same for everyone and does not say which bills you follow.
• Feedback email: if you choose “Send feedback” in Account, your mail app sends us an ordinary email, so we receive your email address and whatever you write. We use it only to read and reply to your feedback.

Sharing and disclosure

We do not sell, rent, or trade your personal information. We do not share it for advertising. We may disclose information if required by law, or to protect the rights, safety, and security of our users and the service, but in this version there is no personal account data on our servers to disclose.

Data retention and deletion

Because your answers and location live on your device, they remain until you delete them. Use Account → “Delete my answers and start over” to erase everything Concord stores on your device: answers, stances, followed items, saved location, and reminders. It keeps your privacy choices (crash reports and sharing) as you set them, so a reset never turns back on something you turned off, and it does not restore the one free Concord Plus preview. Uninstalling the app removes all local data. Anonymous counts you already shared carry no identifier, so they cannot be located to remove.

Children’s privacy

Concord is intended for users 13 and older and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will address it.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to opt out of its “sale” or “sharing.” Because Concord keeps your answers on your device and does not sell personal information, you can exercise the core of these rights directly through the in-app delete control. For any other request, contact us.

Security

Your data is stored using your device’s standard app storage. No method of storage or transmission is perfectly secure, but we limit risk by keeping personal data on your device and collecting as little as possible.

Accounts and future changes

A future version may add optional sign-in and cloud sync so your profile can follow you across devices. If and when that ships, this policy will be updated to describe what is stored on our servers, how it is secured, and the additional choices you will have. We will note material changes in the app.

Changes to this policy

We may update this policy as the app evolves. The “last updated” date above reflects the current version. Continued use after an update means you accept the revised policy.

Contact

Questions about privacy? Contact Side Yard Studio LLC at contact@sideyardstudio.co.