Privacy Policy

Instant Initiative (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at instantinitiative.comand use any features or services we offer (collectively, the “Platform”).

By creating an account or using the Platform, you agree to the collection and use of information described in this policy. If you do not agree with these terms, please do not use the Platform.

This policy covers:

• Information we collect when you create an account
• How we use that information to operate the Platform
• When and how we may share information with third parties
• Your rights regarding your personal data
• How we protect your information
• Cookies and tracking technologies we use

2.1 Information You Provide Directly

When you create an account or use our Platform, we collect information you provide voluntarily, including:

• Account information: Email address, username, display name, and password (stored as a secure hash — we never store your plain-text password).
• Profile information: Optional details such as your name, location, and biography that you choose to add to your public profile.
• Initiative and campaign content: Text, titles, descriptions, updates, and other content you create and publish on the Platform. Public campaigns are visible to all visitors.
• Support and contact submissions: Any information you provide when you contact us for support or feedback.

2.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical information, including:

• Log data: IP address, browser type and version, pages visited, time and date of visits, and referring URLs.
• Device information: Operating system, device type, and screen resolution.
• Usage data: Features you use, actions you take (e.g., creating an initiative, joining a campaign), and civic XP and progress events.
• Session data: Authentication tokens and session identifiers managed through our authentication provider.

2.3 Information We Do Not Collect

We do not collect:

• Payment or financial information (we do not charge for use of the Platform)
• Government-issued identification numbers
• Sensitive categories of personal data such as health, biometric, or racial data
• Private messages between users (the Platform does not currently offer direct messaging)

We use the information we collect for the following purposes:

• To operate and maintain the Platform: Creating and managing your account, authenticating your identity, and enabling core features such as initiative creation, campaign management, and civic progress tracking.
• To personalize your experience: Displaying your profile, XP level, badges, and campaign activity. Showing you relevant initiatives based on your jurisdiction.
• To communicate with you: Sending account-related emails (e.g., email verification, password reset), platform updates, and — only if you opt in — notifications about initiative activity.
• To improve the Platform: Analyzing aggregate usage patterns to identify bugs, improve features, and develop new civic tools.
• To enforce our policies: Detecting and preventing abuse, spam, fraud, and violations of our Terms of Service.
• To comply with legal obligations: Responding to lawful requests from government authorities or as otherwise required by applicable law.

We do not use your personal information for targeted advertising, nor do we sell your data to advertisers.

Instant Initiative is a civic platform built on transparency. By design, certain information you create is public by default:

• Public campaigns and initiatives: If you publish an initiative or campaign, its title, description, updates, supporter count, milestones, and progress are visible to all visitors — including those who are not logged in.
• Your username and display name: These are visible on any campaign or initiative you create or support, and on your public profile page.
• Supporter activity: When you publicly support a campaign, your username may appear as a supporter. You can choose to support anonymously if that option is available on a given campaign.

Your email address is never displayed publicly and is not shared with other users. Your civic XP, badge history, and profile details are visible only to the extent you choose to display them on your public profile.

Think carefully before publishing. Content you make public may be indexed by search engines and is accessible to any person on the internet.

We do not sell your personal information. We share it only in the limited circumstances described below:

• Service providers: We use trusted third-party providers to operate the Platform, including Supabase (authentication and database), Vercel (hosting and edge delivery), and email delivery services. These providers process your data only on our behalf and are bound by data processing agreements.
• Legal requirements: We may disclose your information if required to do so by law, court order, or valid government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Instant Initiative, our users, or the public.
• Business transfers: If Instant Initiative is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
• With your consent: We may share your information in ways not described here if you have given us explicit consent to do so.

We do not share your personal information with political organizations, advocacy groups, or any third parties for commercial marketing purposes.

Account authentication on the Platform is powered by Supabase Auth, a third-party authentication service. When you create an account or sign in, your credentials are processed through Supabase's infrastructure. We encourage you to review Supabase's Privacy Policy to understand how they handle authentication data.

Your password is never stored in plain text. It is hashed using industry-standard cryptographic methods before being stored.

We implement reasonable technical and organizational security measures to protect your information from unauthorized access, loss, or disclosure, including:

• HTTPS encryption for all data transmitted between your browser and our servers
• Row-level security policies enforced at the database level
• JWT-based session tokens with expiration and rotation
• Access controls limiting which personnel can access production data

No security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

You are responsible for maintaining the confidentiality of your account credentials. Do not share your password with others. If you suspect unauthorized access to your account, contact us immediately.

We use cookies and similar technologies to operate the Platform and improve your experience:

• Essential cookies: Required for authentication and to maintain your login session. Without these, you cannot remain signed in.
• Preference cookies: Used to remember settings or preferences you have chosen on the Platform.
• Analytics: We may use privacy-respecting analytics tools to understand how users navigate the Platform in aggregate. We do not use Google Analytics or Meta Pixel. Any analytics we use do not track you across other websites.

You can configure your browser to refuse cookies or alert you when cookies are being sent. Note that disabling essential cookies will prevent you from staying logged in.

We do not use tracking pixels, fingerprinting, or cross-site behavioral advertising technologies.

We retain your personal information for as long as your account is active or as needed to provide the Platform's services. Specifically:

• Account data: Retained for the life of your account. When you delete your account, your personal information (email, display name, profile) is removed from our active systems within 30 days.
• Public content: Initiatives and campaign content you have made public may be retained in anonymized or archived form even after account deletion, to preserve the civic record. You may request full removal of your content at any time.
• Log data: Automatically collected technical logs are retained for up to 90 days for security and debugging purposes, then deleted.
• Legal holds: We may retain information for longer periods if required to comply with legal obligations or resolve disputes.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information. You can update most profile information directly in your account settings.
• Deletion: Request deletion of your account and personal information. Submit a deletion request through your account settings or by contacting us.
• Portability: Request an export of your data in a machine-readable format.
• Objection: Object to certain processing of your data, including any analytics.
• Withdraw consent: Where we process data based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@instantinitiative.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

If you are a resident of California, the European Union, or another jurisdiction with specific data protection laws, you may have additional rights under those laws (e.g., CCPA, GDPR). Contact us to learn more.

The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

Users between the ages of 13 and 18 should use the Platform only with parental or guardian consent.

The Platform may contain links to external websites — such as state government portals, official initiative guides, or civic resources. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policy of any external site you visit.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page with a new effective date, and — for significant changes — by sending a notification to the email address associated with your account.

Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy. If you do not agree with the changes, you should stop using the Platform and may request deletion of your account.

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please visit our Contact page to get in touch with our support team.

We take privacy concerns seriously and will work to resolve any issue promptly.