Privacy Policy
What we collect when you use civicaiaudit.org, why, and the choices you have.
Effective November 6, 2026.
Who we are
The Civic AI Audit is a project of the National Conference on Citizenship (NCoC), a nonpartisan 501(c)(3) at 601 13th Street NW, Floor 12, Washington, DC 20005. NCoC is responsible for the personal data described here. Questions go to contact@ncoc.org.
The short version
- You can read the whole public site without an account and without analytics.
- We use Mixpanel analytics only if you click Accept. We never record your screen or what you type.
- If you sign in with Google, we keep your name, email address and the pages you view while signed in.
- We don't sell personal data or use it for advertising.
What we collect
Every visitor
Our host, Heroku, briefly logs each request: your IP address, the page, the time and your browser type. We use these logs only to keep the site running and secure, and they are not kept beyond a few days.
We store your analytics choice (Accept or Decline) in your browser so we don't ask again. That stays on your device.
Analytics, only if you accept
If you click Accept, your browser loads Mixpanel, which records the pages you view, the links and buttons you click, how far you scroll and when you submit a form. Mixpanel assigns a random ID to your browser and stores it in your browser's local storage (not a cookie). It works out your approximate location (city, region, country) from your IP address and doesn't keep the address itself. It does not record the text on the page, anything you type, or video of your session. We use this only to learn which findings people read, so we can improve them.
If you sign in with Google
Signing in is optional and opens the data explorers and downloads. Google sends us your name, email address, profile photo and Google account ID; we ask for nothing else and get no access to your Google account. We also record when you sign in, the IP address and browser you sign in from, and the pages you view while signed in (with the page that referred you). Project staff can see this, and may add notes, for example why access was granted.
How we use it
- To run, secure and fix the site.
- To give signed-in members access, and to understand how our data is used.
- To learn which findings and pages are useful, in aggregate.
- To answer you if you contact us.
For visitors in the EU and UK, the legal bases are your consent (analytics), our agreement with you (accounts), and our legitimate interest in running a secure site (server logs).
Who we share it with
We don't sell or rent personal data. We share it only with the services that run the site for us: Heroku (hosting and database), Google (sign-in) and Mixpanel (analytics, only after Accept). We may also disclose information if the law requires it or to protect the site and its users. These services are in the United States, so your data is processed there.
How long we keep it
Server logs: a few days. Account and signed-in page-view records: for as long as the project runs, or until you ask us to delete them. Analytics: for as long as we need it to understand use of the project, and no longer.
Your choices and rights
- Analytics: click Decline, or change your answer any time through "Privacy settings" at the foot of every page.
- Do Not Track and Global Privacy Control: if your browser sends either signal, we don't load analytics and don't ask.
- Your account: email contact@ncoc.org to see, correct or delete what we hold about you. We'll reply within 30 days.
Depending on where you live, you may also have the right to object to or restrict our use of your data, to take a copy of it, and to complain to your data protection authority.
Security
The site is served only over HTTPS. Access to account data is limited to project staff. No system is perfectly secure, but we work to protect what we hold.
Children
This site is not directed to children under 13, and we don't knowingly collect their personal data. If you think we have, contact us and we'll delete it.
Other websites
Our findings link to many sources that AI products cited, and to NCoC's own site. Those sites have their own privacy practices, which we don't control.
Changes
If we change this policy, we'll post the new version here with a new effective date, and note significant changes on the home page.
Adapted from the Creative Commons Privacy Policy, which is dedicated to the public domain under CC0, and from NCoC's Privacy Policy. See also our Terms of Use.