Threat model
What someone could learn about you from this site, who that someone could be, and what this site does and does not claim. Written before accounts exist, so that the description comes first and the collection second.
Today, with no accounts
- There is no account system yet, so nothing you do here creates a record about you on the operator's side.
- The site is delivered by Cloudflare, which receives the requests your browser makes. That is a record of what you read, held by a company the operator does not control. Every website has a host and this is what having one means.
- This site's own code stores nothing in your browser — no cookies, no saved data. That is a statement about today's code, not a promise about future code, and it does not cover anything Cloudflare may set.
- On the members explorer, what you type into the search box is copied into the page address as you type. It is not sent anywhere by itself, but it travels with the address — so it is in your history, and in any link you bookmark or share. The same is true of the member comparison page, whose address carries the members you chose.
When accounts ship
Accounts are planned, not built. When they arrive, the site will hold these things about you, and the operator can read all of them:
- Who you are: your email address, whether it has been confirmed, a scrambled form of your password, and when you signed up. Used to let you sign in and to tie everything below to you.
- An email address you have given but not yet confirmed, and the one-time code sent to confirm it. Used to check the address belongs to you; the code is deleted once you use it.
- What you follow: which bills, topics and members, and how often you want to hear about them. Used to decide which alerts to send you and which to leave out.
- Your settings and your answers to anything the site asks you — including the grade weights you choose and the stance questions you answer. Used to show you the site the way you set it up and to show you your own answers back over time.
- Which alerts have already gone to you and when. Used so the same alert is not sent twice, and so a failed send can be retried.
- Where to reach you: your email address, and a phone number only if text alerts are ever added. Used to address the message.
- A public profile, only if you choose to make one. Used to show what you chose to publish to anyone who visits it. Published means public.
An earlier design for this site scrambled your answers on your own device, so that even the operator could not read them. That was given up on 2026-09-23, for a plain reason: a server that cannot read your list of followed bills cannot send you alerts about them. Alerts were the point, so the scrambling went.
What a legal demand would produce
Once accounts exist: everything in the list above, in readable form. Your email address, what you follow, your settings and answers, and where you get notified. Not scrambled, not partial. Anyone who can compel the operator to hand over data gets the real thing.
Separately, and outside the operator's reach: Cloudflare delivers the site and will also send the email, so it holds its own records of both — your requests, your email address, and the text of the messages sent to you — and it can be compelled on its own. That it is one company rather than two is the reason it was chosen.
What is not promised
This section exists because the site used to promise these things and the promises could not be kept. As of 2026-10-07 the operator makes no privacy promises at all. In particular there is no promise that requests go unlogged, that no network address of yours is stored, that no cookie is ever set, that storage stays limited to the list above, or that your data will not be passed on or sold to anyone else — that last one was a standing promise on this site until 2026-10-07, when the operator withdrew it. A promise that cannot survive the next feature is worth less than an accurate description, so you are getting the description.
What the system does do
These are descriptions of how the software behaves, not pledges about how the operator will behave. This site makes no privacy promises.
- Deletion is real deletion. When accounts exist, asking for your account to be deleted removes its rows, rather than flagging them as hidden.
- A published figure has a floor. No figure on this site is derived from reader data today, because nothing is collected about readers today. The rule any future one has to clear is already written down: it covers at least 50 people, or it is not published at all.
Found something wrong here?
This page is a factual claim like any other on the site, and it can be wrong. The corrections page explains how to report it and how fixes are recorded.
Last reviewed 2026-10-07. The sections describing accounts will be rewritten as each feature actually ships, before it collects anything.