Privacy Policy

What we collect

When you cast your vote, we collect your name, email address, zip code, and age range. We also collect your point allocations across the 14 federal budget categories, your subcategory allocations if you use them, and your Cut/Fix intent selections.

When you submit a contact form, we collect your name, email address, subject, and message.

We do not collect payment information directly. Donations are processed by Stripe, which has its own privacy policy.

How we use it

Your vote data is used to calculate the aggregate results displayed on the Results page. Individual votes are never displayed publicly — only aggregate totals and averages.

Your email address is used to send a vote confirmation, to deduplicate votes (one vote per email address), and to send platform updates if you opt in. We use Resend to deliver email.

Your zip code is used for regional analysis. It is never shared individually.

Your age range is used for demographic breakdowns of aggregate results.

localStorage and session data

Your browser’s localStorage is used to save your vote draft while you are allocating points, so your progress is not lost if you navigate away. This data stays on your device and is cleared when you submit your vote. We also store a hint of your name, email, and zip to pre-fill the form on return visits. No tracking cookies are set.

Bot protection

We use Cloudflare Turnstile to prevent automated submissions. Turnstile may process your IP address and browser signals on Cloudflare’s infrastructure. No CAPTCHA images are shown. Cloudflare’s privacy policy governs this processing.

Infrastructure and data storage

Vote data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure in the US West region. Results are served from Cloudflare R2 object storage. We do not use Google Analytics or any advertising trackers. We use privacy-first analytics (Plausible or Fathom) that collect no personally identifiable information.

Data sharing

We do not sell your data. We do not share your data with advertisers, political organizations, PACs, or any third party with a commercial interest in it. The only third parties who process your data are:

• Supabase — database and authentication infrastructure
• Cloudflare — CDN, DDoS protection, Turnstile bot detection, R2 storage
• Resend — transactional email delivery
• Stripe — donation processing (if you donate)

Each of these providers is bound by their own privacy policies and applicable data protection law.

Your rights

You can request deletion of your vote data or contact form submission at any time by emailing help@taxpoints.org. We will process deletion requests within 30 days. Note that aggregate results derived from your vote cannot be removed, as they do not contain personally identifiable information.

Children

Taxpoints is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has submitted data, contact us at help@taxpoints.org and we will delete it promptly.

Changes to this policy

We may update this policy as the platform evolves. Material changes will be noted with a revised effective date. Continued use of the platform after changes constitutes acceptance.