Privacy

Spurna works without an account. An account is optional, and only keeps what you follow and how your profile looks. We do not use advertising or cross-site tracking, and do not sell or share personal data. This page says exactly what the site does touch.

The short version

• Accounts are optional. If you make one, we keep your email, a scrambled (hashed) form of your password, your display name and avatar, your state and district, the issues you pick and what you follow — nothing else. We never store your ZIP code.
• One cookie, and only while you are signed in: it keeps you signed in. No other cookies.
• No analytics, advertising, or social-media trackers. The site is built so that it cannot load scripts, fonts, images or data from other companies' servers.
• Beyond an account you choose to create, the only things we hold are what you email us and the short-lived technical logs kept by our host.
• You can delete your account yourself, from Settings, at any time. It is gone straight away.

What stays in your browser

If you follow members, races or candidates, or choose your state, without an account, we save that choice in your browser's local storage so it is there next time. It is used only to personalize the page for you, never leaves your device, and we cannot see it. Clearing your browser data removes it. When you are signed in, your browser also remembers that you are signed in and your display name and avatar, so the page header appears straight away; signing out clears them. Because all of this is stored at your request and is needed for the feature you asked for, it does not require a consent banner.

If you create an account

We store your email address, your password in hashed form (PBKDF2 with a unique salt — we never see or store the password itself), your display name, your avatar choices, your state and congressional district, the issues you tell us you care about, the members, races and candidates you follow, and, if you take the quiz, your latest result (your answers and where they place you on the scale). A quiz taken while signed out stays in your browser until you sign in or sign up, when it is saved to your account; signing out removes the browser’s copy. If you enter a ZIP code, it is looked up in your browser against a public Census table to find your district; the ZIP code itself is never sent to us or stored. We also keep a record of each signed-in session (when it started and when it expires), stored under a one-way hash of the session cookie. To slow down password guessing we count recent sign-in attempts for a short time; those counters are kept under a one-way hash too, never your email address or IP address in plain form.

We use this only to run your account. We do not send marketing email, and we do not share any of it. Deleting your account (Settings → Delete account) removes the account, its location and issues, its follows, its quiz result and its sessions immediately. You can also remove just the quiz result from your profile. Account data is stored with Cloudflare, our host.

What our host records

The site is delivered through Cloudflare. Like any web host, Cloudflare processes your IP address and basic request details (page requested, browser type, time) to deliver pages and block abuse, and keeps short-lived logs. We use this only to keep the site running and secure. Cloudflare may process this data in countries outside your own; see Cloudflare's privacy policy for its safeguards. We do not receive or keep a copy of visitor IP addresses.

Cookies and tracking

• We set one strictly necessary cookie, and only when you sign in: a session cookie that keeps you signed in for up to 30 days. It cannot be read by scripts on the page and is removed when you sign out. Nothing else.
• We do not use advertising or cross-site tracking.
• We do not use fingerprinting.
• We honour browser Do Not Track and Global Privacy Control signals by default, because there is nothing to opt out of.
• If we ever add analytics, it will be cookieless and privacy-preserving, and this page will be updated first.

When you email us

If you write to [email protected], we receive your email address and whatever you send. We use it only to reply and to check a correction, and we keep it as long as needed for that purpose and then delete it. Please do not send passwords or sensitive personal information.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or the California Consumer Privacy Act) you may have the right to know what we hold about you, ask us to correct or delete it, object to its use, and complain to your data protection authority. Because we hold almost nothing, the answer will usually be short, but ask at [email protected] and we will respond within 30 days. We do not sell or share personal information and do not make automated decisions about visitors. Where the GDPR applies, our basis for processing the technical logs is our legitimate interest in running a secure website, and for correspondence it is your request.

Children

Spurna is aimed at a general adult audience. We do not knowingly collect personal information from children under 13 (or 16 where local law sets that age).

Public information about members of Congress

Everything we show about members of Congress comes from public records and public statements, such as votes, sponsored bills, and posts from official accounts. The scores are computed from that record. If you think something is wrong, or you are a member or staffer and want to ask about a record, tell us at [email protected]; we check every report against the underlying records and correct errors.

Security

The site is served over HTTPS only, with strict security headers and a content policy that blocks third-party code. Passwords are stored only as salted PBKDF2 hashes, session cookies are HttpOnly and Secure and stored on our side only as hashes, every change to an account must come from Spurna's own pages, and repeated wrong passwords are throttled.

Changes

If this page changes in a meaningful way we will update the date at the top. Contact: [email protected]