Privacy by design,
not by promise
The Civic Filament is designed to minimize what can identify you: transcripts stay in your browser, structured identifiers are redacted before anything reaches the AI or is stored, and published outputs contain only thresholded aggregates.
INTERVIEW LAYER
Conversation happens hereYour interview transcript is not stored on our servers. It stays only in your browser (IndexedDB) and is deleted there automatically after 30 days. During the interview each message passes through our server to Anthropic’s API to generate the mediator’s reply and, at the end, the summary of your perspective. Anthropic does not train on API data and retains it only under its commercial API data-retention terms.
REDACTION LAYER
Identifiers are removed hereBefore your text reaches the AI or anything derived from it is stored, structured identifiers are redacted by pattern: email addresses, phone numbers, SSN-style numbers, card numbers, street addresses and URLs. Personal names cannot be reliably detected by pattern, so the extractor is instructed not to carry names or identifying details into the stored summary — and we ask you not to share them.
SYNTHESIS LAYER
Consensus forms hereWhat we store server-side is the extracted perspective — position summary, stance, values, needs, conditions, engagement depth and a heuristic discourse-quality score — in Supabase Postgres (us-east-2), encrypted at rest (AES-256). Synthesis works on these summaries to find where concerns are shared, where conditions unlock agreement, and where groups genuinely diverge.
OUTPUT LAYER
Only aggregates are visibleThe Living Requirement Document contains aggregate statements and counts only — no transcripts, quotes or individual positions. Each version also publishes a one-way hash of every input perspective, so anyone can check which perspectives it was computed from without learning their content.
Our commitments to you
You own your data
Your transcript never leaves your browser for storage. Export or delete what the server holds about your session at any time from the Your Data page.
Privacy by architecture, not just policy
The system is designed to minimize identifiability: transcripts stay on your device, identifiers are redacted, session IDs are hashed, and outputs are thresholded. No system can promise re-identification is impossible — so we keep as little as we can.
Minimum viable data
We store only the extracted perspective the synthesis needs, plus — only if you choose to answer — an age band, housing tenure (rent/own) and area, used in aggregate to check whether the whole community is being heard. We do not ask for your name — please don’t include it in your answers.
Documented, verifiable method
The full methodology is documented on /methodology, and the provenance of every published synthesis version can be independently verified from its published hashes.
No surveillance capitalism
Your perspective data is never sold, shared with advertisers, or used for profiling. Revenue comes from the organizations who deploy Civic Filament, not from monetizing participants.
Right to withdrawal
Withdraw at any point from Your Data: your perspective is kept but excluded from future synthesis runs, and you can rejoin later. Or delete it: Deleting your data removes it from our database and excludes it from all future synthesis versions. Synthesis versions published before your deletion remain as published (they contain only aggregate statements, counts, and a one-way hash of your perspective).
Built around GDPR/CCPA-style rights. We have not obtained third-party certifications such as SOC 2 or ISO 27001.
What we collect & what we don't
Interview Transcripts
Your interview transcript is not stored on our servers. It is kept only in your browser (IndexedDB) and deleted there automatically after 30 days. While the interview is running, each message passes through our server to Anthropic's API, which generates the mediator's reply and, at the end, a structured summary of your perspective. Anthropic does not train on API data and retains it only under its commercial API data-retention terms.
Redaction Before Processing
Before your text reaches the AI or anything derived from it is stored, structured identifiers are redacted by pattern: email addresses, phone numbers, SSN-style numbers, card numbers, street addresses and URLs. Personal names cannot be reliably detected this way. The extractor is instructed not to carry names or identifying details into the stored summary, and we ask you not to share them. This is designed to minimize identifiability; it is not a guarantee that no identifying detail could ever pass through.
Evidence Submissions
If you submit to the evidence repository, we store the text you submit after the redactions you chose (we additionally remove ID, card and account numbers automatically; your original wording is never sent to us), your optional attachment, and the same one-way hash of your anonymous session. Attachments are images only (JPEG, PNG or WebP, up to 4 MB); PDFs are not accepted. Hidden metadata such as camera GPS location is stripped when the image is re-encoded; we cannot remove what an image visibly shows. Files sit in a private bucket and are shown only through short-lived links once a moderator approves the item. Approved items are public. You can delete your submissions, including files, on the Your Data page.
Information We Store
On our database (Supabase Postgres, us-east-2, encrypted at rest with AES-256) we store, per perspective:
- The extracted perspective: position summary, stance, values, needs, conditions and engagement depth.
- A Discourse Quality Index score — a keyword-based heuristic of how reasoned the contribution is. It is not AI-scored.
- A SHA-256 hash of your random anonymous session ID. The raw session ID is never stored.
- Your account ID — only if you chose to sign in.
- The issue ID, timestamps, and the perspective's provenance hash (your “receipt”).
- Separately, your IP address is used as a key for short-lived rate-limit counters. It is not attached to your perspective.
There is one perspective per participant per issue; a re-interview replaces the earlier one. After the interview you may optionally give an age band, housing tenure and area; these are stored with your perspective, are not part of its provenance fingerprint, are never shown individually, and are reported only as group totals with any group of fewer than five people suppressed. They are included in your data export and deleted with your perspective. We also record which language the interview was held in; the extracted summary itself is stored in English. Some analysis (argument structure, loaded-language indicators) is computed in your browser and kept only there.
Voice Input
Voice input uses your browser's built-in speech recognition. In Chrome and some other browsers the audio is sent to the browser vendor (e.g., Google) for transcription, under that vendor's terms; we never receive the audio, only the resulting text in your message. If you prefer, type instead.
Read-Aloud
Read-aloud sends the text being read (mediator messages, LRD text, blog text) to our text-to-speech server hosted on Modal, which returns the audio. It does not include your own messages unless you choose to have them read.
Transcript Verification
To prevent fabricated interviews, each mediator reply carries a server signature that your browser sends back with the transcript. Nothing extra is stored.
Bot Protection
If enabled, Cloudflare Turnstile may be used on submission forms. Cloudflare processes a challenge to tell people from bots; it sets no advertising cookies.
Publication Thresholds
No synthesis is published for an issue until at least 10 perspectives exist, and no statement or group is published with fewer than 5 supporters.
Cookies, Local Storage & Analytics
We use your browser's local storage and IndexedDB to hold your anonymous session ID, consent record, and local interview copy. If you sign in, authentication cookies keep you signed in. There is no advertising on this site and we do not use Google AdSense or Google Analytics.
We may use PostHog for optional product analytics (pages visited, feature usage); it is inactive unless configured by the operator. Sentry error tracking is set up to capture application errors and is likewise inactive until configured.
Data Sharing and Third Parties
We do not sell your personal information and there are no advertisers. We use service providers to operate the Service: Anthropic (AI processing during interviews and synthesis), Supabase (database and sign-in), our hosting provider, Modal (hosts our read-aloud text-to-speech server), and — if enabled — Cloudflare Turnstile, PostHog and Sentry. If you use voice input, your browser vendor handles the speech recognition. Published syntheses are public aggregates. We may disclose information if required by law or to protect our rights and safety.
Your Rights
Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict processing of your data; request data portability; and withdraw consent at any time. Most of these are self-service (below). For anything else, contact us through our Contact page.
Self-Service Data Rights
The Your Data page lets you: (a) see and export (JSON) what the server holds for your session; (b) withdraw— your perspectives are kept but excluded from future synthesis runs, and you can rejoin; (c) delete— your server-side perspectives, quick reactions, consent records and evidence submissions (with files) for your session are deleted, along with the local browser copy.
Deleting your data removes it from our database and excludes it from all future synthesis versions. Synthesis versions published before your deletion remain as published (they contain only aggregate statements, counts, and a one-way hash of your perspective). After a withdrawal, your perspective is likewise left out of future synthesis versions until you rejoin.
If you signed in, deleting your account from the Account page deletes all rows linked to your account, then your login.
Accountability Data
The accountability section is in development. Where populated, it uses publicly available government records (voting records, budget documents, campaign finance filings, meeting minutes), not participant data. Public-record data is not subject to deletion requests.
Age Requirement & Minors
Our Service requires users to be at least 17 years old. Before an interview begins, the Service asks you to state your age; users who state an age under 17 are blocked from participation. This is a self-declared check, not identity verification. Users who are 17 may be required to obtain parental or guardian consent depending on their jurisdiction. If we become aware that we have collected personal information from a user under 17, we will take immediate steps to delete that information. Parents or guardians who believe their child has provided data to the Service may contact us to request deletion.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us through our Contact page.
LAST UPDATED: SEPTEMBER 30, 2026