Privacy

Resolve the ballot, not the person

You should be able to find out what you’re voting on without identifying yourself to anyone. That principle drove several concrete engineering decisions, not just a policy page.

We never ask for

Your name, date of birth, voter registration number, email, phone number, or party affiliation. There are no user accounts.

We don't store

Your address, your precise coordinates, or any record linking a lookup back to you.

What happens when you enter an address

Your address is sent to our server in the body of a POST request — never as a URL query string, so it cannot appear in browser history, a referrer header, or a web server access log.
The server passes it to the U.S. Census Bureau geocoder to determine which districts contain it.
We keep the resulting district identifiers and discard the address. It is not written to a database, a log, or an analytics event.
The response is marked no-store so no shared cache or CDN retains it.

Precise coordinates are discarded immediately

Geocoding returns a latitude and longitude precise enough to identify a single household. We use it for the point-in-polygon lookup and then drop it. It is never returned to the browser, stored, or logged.

Share links contain districts, not addresses

When you share a ballot, the link contains a jurisdiction signature — a state, a county, and district numbers. Every household in those districts produces the identical signature, often tens of thousands of them. There is nothing in the link to trace back to an address.

Third parties

The only external service that receives your address is the U.S. Census Bureau geocoder, and it receives the address alone — no identifier, no session, nothing else about you. We send the minimum required to answer the question.

Addresses are never included in prompts to any AI service. The explanation feature receives an office identifier and a district label — for example “District 5” — and nothing more.

Analytics

Product analytics measure behavior, not politics: whether a lookup completed, whether an explanation was opened, whether a page was shared. We do not record, infer, or ask about anyone’s political preferences, and we never ask how you voted or intend to vote.

Public voter records

Many states publish voter registration data, and some of it is public by law. That does not make it ours to aggregate. Ballot Explained does not build profiles of individual voters, and the address-first design exists specifically so that we never need to identify one.

Deployment note

This is a development build running locally. Before any public deployment, this policy should be reviewed by counsel alongside the data-licensing review described in the design document, and the no-retention claims should be verified against the production logging configuration.