What you are entitled to when you participate.
Civic Filament is a trust-first product. These are the rights that hold regardless of who is deploying it — a city government, a DAO, an employer, a research group.
Informed, up-front, revocable
Before an interview begins, you see a plain-language explanation of what data is collected, how it is used, who can see what, and how to withdraw. No dark patterns. Consent is revocable — see "Withdrawal" below.
Transcripts stay with you; identifiers redacted
Your transcript is not stored on our servers — it stays in your browser and is deleted there after 30 days. Emails, phone numbers, ID and card numbers, street addresses and URLs are redacted by pattern before your text reaches the AI or is stored. Names can’t be reliably detected, so please don’t share them. Your anonymous session ID is stored only as a SHA-256 hash. See the Privacy Architecture page for details.
Aggregate patterns, never individuals
A municipality (or DAO, enterprise, researcher) that deploys Civic Filament receives the Living Requirement Document — counted consensus, conditional agreement, divergence, and credible intervals. They do not receive your transcript (we don’t have it). They do not receive attribution. No synthesis is published until an issue has at least 10 perspectives, and no statement or group with fewer than 5 supporters is published.
Delete anytime, per session
From the "Your Data" page, delete your server-side perspectives, quick reactions, consent records and evidence submissions for your session, plus the local browser copy. Deleting your data removes it from our database and excludes it from all future synthesis versions. Synthesis versions published before your deletion remain as published (they contain only aggregate statements, counts, and a one-way hash of your perspective). If you signed in, deleting your account removes everything linked to it, then your login.
Withdraw from future re-synthesis
Distinct from deletion: you can withdraw without deleting. Your perspectives are kept but excluded from future synthesis runs, and you can rejoin later. Useful if you change your mind about a specific deployment.
One-click JSON export
Everything the server holds for your session exports as machine-readable JSON. No lock-in. If you want to feed your perspectives into a different tool, or archive them, you can.
A receipt for your perspective
When your perspective is saved you receive its hash as a receipt. On the LRD page you can check that a published synthesis version included it — the proof is verified in your own browser.
Public records & retention — defined before the first interview
When Civic Filament is deployed for a governmental entity, the interview corpus and derived synthesis may be subject to that jurisdiction’s public-records laws (often called FOIA, Sunshine, or Open Records laws) and its records-retention schedule. This is not a Civic Filament choice — it is a statutory reality of the deploying entity.
Because of that, every municipal or governmental pilot begins with a written Data Handling Addendum that answers, before any resident is interviewed:
- ◇Who is the data controller? The deploying entity, Civic Filament, or joint.
- ◇What is FOIA-able? Aggregate LRDs are typically public by design. Transcripts are not stored on our servers; stored perspective summaries receive whatever redaction the jurisdiction’s records law requires.
- ◇What is the retention schedule? Explicitly named — a deletion horizon, not “forever.”
- ◇What is disclosed to participants? The consent screen for that deployment discloses the jurisdictional posture in plain language before the interview begins.
We would rather turn down a deployment than run one without this in writing. The bike-lane demo issue on this site is a fictional city called Millbrook, OR — not a live deployment — which is why it doesn’t need this addendum.
Exercising these rights
Related: Privacy Architecture · Security & Data · Methodology