Privacy
What we hold, and how to make us stop
The short version: this website carries no analytics and no trackers of any kind, and we receive no visitor logs. Whatever a page keeps for you — the filter you set on a feed page, and a sign-in session if you sign in — stays in your browser, on your device. The app needs no account to read anything. An account does three things — it makes a vote count once per person, it keeps your followed bills and docket keywords the same on every device you sign in on, and it keeps your settings the same on every device — and it can be deleted in two taps, from inside the app or from your account page on this website.
This website
billtracking.org collects nothing from you
There is no analytics anywhere on this site. No Google Analytics, no Cloudflare, no pixel, no tag manager, no advertising and no tracking SDKs — on any page, of any kind. We do not record what you read in the feed or on bill pages, what you search for or where you arrived from, we do not sell or share anything about you, and we build no profile of you.
Some pages do keep things for you, deliberately — the feed pages (/us and /eu) most of all. Whatever a page keeps — the posts it has already shown you, so that it opens quickly the next time, the filter you set on a feed page, and your sign-in session if you sign in — stays in your browser, on your device, and none of it is transmitted to us. We are not told which pages you opened, what you read, or where you arrived from. From this website, the only things that ever leave your device are a vote you deliberately cast and — if you sign in — the bills you choose to follow, your docket keywords, your settings and what you do in your notifications list, as described below.
One honest caveat, because the alternative would be a false claim: the site is hosted on GitHub Pages, and any web host necessarily handles your IP address at the network layer in order to send you a page. GitHub does not surface those logs to us and we have never seen them — but we will not tell you no IP address is processed anywhere, because that would not be true.
The app — reading
Reading needs no account and sends us nothing
The feed and bill timelines all work without signing in. The app and this website both fetch the published record as static files from GitHub Pages, the same infrastructure this site is hosted on; reading the feed and bill pages, and searching, report nothing back to us. Your saved filters, display settings and docket keywords are kept with your account when you are signed in, so the app and this website show you the same set-up; signed out, nothing is kept about you. Following a bill needs an account: your follow list is kept with it, so the app and this website show you the same bills. It is a list of bills, nothing more, and deleting your account deletes it.
Notifications. If you have an account, we keep your notifications for 30 days so you can see them wherever you sign in. We also store which ones you have read, when you last opened the list, and when you last turned on a notification setting or a legislature. A notification you delete is gone for good. Your notifications are not backed up, and they are deleted with your account.
Push notifications. If you allow push notifications, we keep your phone's push address with your account, along with the type of phone, its time zone and when it was added. Pushes go through Expo and Apple or Google to reach your phone. We keep a delivery receipt for up to two days. Turning push off, signing out on that phone or deleting your account removes the address. On Android, Google's push service registers the app when it first opens, even if you never allow push.
The app contains no advertising, no third-party analytics and no tracking SDKs.
The app also checks for updates when it starts. That request carries a random identifier for the installation and the app's version — sent to Expo, the service that delivers our updates. It identifies the installation, not you. If the app failed to start the last time it ran, the request also carries the text of that error — the app's own crash message, shortened — so that a broken release can be spotted.
The app — accounts and votes
An account exists so your vote counts once
You can mark a bill with a thumbs up or down. Because a reader's position on a bill is a political opinion — a specially protected category of personal data under EU law — we are deliberately narrow about this.
- Voting requires signing in with Google or Apple; reading never does. The account is what makes one vote per person per bill possible. Without it, the counts would be meaningless.
- All we act on from the sign-in is an account identifier and an email address. If you use Sign in with Apple and choose Hide My Email, we only ever see Apple's relay address.
- A vote record is: which bill, thumbs up or down, when, and — only if you choose to set it — a country and, for the US, a state. That location is optional, you choose it yourself, and nobody verifies it. Leaving it unset is a normal and fully-supported way to use the app.
- Who voted which way is never published, shown to anyone, or attached to a profile. There are no public profiles and no public vote histories: your own votes are shown to you alone, on the Your votes page in the app and on this website, where you can change or withdraw any of them. What is published is counts: how many voted each way overall, and how many from each country or state.
- You can change or withdraw your vote at any time, or withdraw all of your votes at once, and deleting your account deletes every vote with it.
What we ask you to understand about published counts
Counts are exact — we never round, estimate or randomise them, because the whole point of this project is that its numbers can be checked. Every place we show also shows how many people voted there, so a small number is visibly small rather than dressed up as a percentage.
We are not going to claim that nobody could ever guess how you voted. If a bill is very one-sided, or very few people from your country have voted on it, someone who already knows you voted could make a reasonable guess. That is true of any published total anywhere and no threshold removes it. What we can tell you is that we never publish, display or share which way any individual voted, that setting a location is optional, and that you can withdraw a vote or delete the account entirely.
Where it is stored, and on what legal basis
Votes are held in a database in Frankfurt, Germany, chosen so that this data does not leave the EU. The legal basis is your explicit consent (GDPR Article 9(2)(a)), given by choosing to vote after being told what a vote records. Withdrawing that consent and deleting your account are the same action — there is no state in which you have withdrawn consent and we still hold your votes.
Our database provider is Supabase, acting as a processor on our instructions. If you sign in with Apple, we also store a token from Apple used for one purpose only: to properly disconnect BillTracking from your Apple ID when you delete your account, as Apple requires.
Deleting
Deleting your account
In the app: You → Delete account. On this website: your account page. It is immediate and permanent. Your account, every vote you cast and your follow list are erased; there is no recovery window. Your docket keywords, saved settings and notifications go with them. We keep no working copy. Our encrypted backups hold the votes, consent records, follow lists, when you last opened your notifications, docket keywords and saved settings, and are only read to recover from a failure. Deleting your account removes all of it from the live database at once. In the backups it is put beyond use on the rotation: we keep every snapshot from the last 90 days and never fewer than two, so deleted data is normally gone from the archive within 90 days, and a very quiet spell can hold the second-oldest snapshot a while longer. When votes leave with a deleted account we record how many left each bill, from which place, and how many were for and against. It's a count with nothing that identifies a person, and it's there so a bill's history can say that votes left rather than that people changed their minds.
If you can no longer sign in in either place, use the account deletion page.
One thing we will not pretend about: counts that were already published — in a post, or in a file someone downloaded — are not retrospectively rewritten. They were true when published and they contain nothing that points to you. Your vote is removed from our database and from every count produced afterwards.
Email, and everything else
The rest of it
- Email. contact@billtracking.org and accuracy@billtracking.org are aliases on a single mailbox and receive mail. If you write to us, we hold your message and your address for as long as needed to deal with it. Please don't send us anything sensitive — it's an ordinary mailbox.
- Legislators. The feeds republish the official legislative record, which names Members of Congress and MEPs and records how they voted and what they sponsored. That is public record information, republished on the basis of legitimate interest in making the legislative process followable.
- We sell nothing and share nothing. No advertisers, no sponsors, no data brokers, no "partners". There is no revenue.
- Children. The app is not directed at children and we do not knowingly collect anything from them.
- AI. Plain-English bill summaries are AI-written and carry an explicit [AI-Generated] label. Dates, vote tallies, bill numbers and procedural facts are copied from the official record and are never AI-written.
Your rights
If you are in the EU or UK you have the right to access, correct, erase, restrict or object to our processing of your personal data, and to receive it in a portable form. You also have the right to object to processing based on legitimate interests, at any time. For votes, the fastest route to all of this is the app or your account page on this website: both let you see and withdraw your votes, all at once if you want, and delete your account outright.
Otherwise, write to contact@billtracking.org. We will respond within one month. If we refuse a request we will tell you why, and you can complain to your national data protection authority or go to court.
Who we are
BillTracking is an independent project run by one person, not a company. The data controller is Thomas Vanhoutte, who can be reached at contact@billtracking.org; a postal address is available on request.
Changes
If we change how any of this works we will update this page and change the date below. We will not quietly start collecting something this page says we do not collect.
15 October 2026. Our backups are encrypted now. The weekly copy is locked before it is stored, with a key that only we hold and that is kept outside the service storing the copy. The deletion sentence in the app and on this website says "encrypted backups" again, as it did before 29 September, because it is true now.
8 October 2026. Your votes have a page of their own now, in the app and on this website, listing every vote you have cast with the same controls to change or withdraw any of them, and a button that withdraws all of them at once, there and on the delete some of your data page. The sentence above that said there are no vote histories now says there are no public ones. Nothing new is collected.
8 October 2026. Added that on Android, Google's push service registers the app when it first opens.
7 October 2026. We now keep your notifications with your account for 30 days. We have kept when you last opened your notifications since August, and this page now says so. This page now also says what we keep if you allow push notifications.
29 September 2026. Our backups now also hold docket keywords and saved settings, on the same 90-day rotation as the rest. The account deletion screens in the app and on this website still called the backups encrypted, which our backup process does not do. That word is gone there too.
20 September 2026. Your saved feed filters, display choices and docket keywords are now kept with your account when you are signed in, alongside your notification settings and legislatures, and are deleted with it. Following a bill now needs an account in the app, as it always did on this website. Signed out, none of it reaches us.
9 September 2026. Your notification settings and your choice of legislatures became part of your account rather than of one device, so that setting them in the app sets them on this website too, and the other way round. Two sentences here had to change with that: an account was described as doing “exactly two things”, and this website was described as sending nothing but a vote and the bills you follow. Both were meant as complete lists and both had stopped being complete. (The 23 August entry below records this page dropping a mention of notification settings because the app did not ship them yet; this is the same page following the product the other way.) Nothing new is collected about you — settings that already existed on your device are now kept with your account instead, and they are deleted with it. Signed out, none of it leaves your device at all.
7 September 2026. The deletion section now says what we keep when votes leave with a deleted account: a count of how many left each bill, from which place, and how many were for and against. It is a count and nothing else — no account, no name, no time finer than the day — and it is there so that a bill's published history can show that votes left, instead of leaving a fall to be read as people changing their minds. Nothing about the erasure itself changed: your account and every vote you cast still go immediately and completely.
5 September 2026. Sign in with Apple went live in the app on iPhone. Nothing new is collected by it beyond what this page already describes: an account identifier and an email address (Apple's relay address if you hide yours), and one token from Apple kept for a single purpose — to disconnect BillTracking from your Apple ID when you delete your account, as the deletion section says. Later the same day, Sign in with Apple went live on this website too — the same account, the same token, the same disconnect at deletion.
26 August 2026. The bullet above about signing in used to open "We ask for no profile. No name, no photo". That was not accurate and it has been removed, along with the list of things it went on to say we do not ask for. Nothing about what the product does changed and nothing new is collected — what changed is that this page no longer says something untrue, and says less. Later the same day, three more descriptions were corrected to match the product exactly: the update check's request also carries the previous run's crash message when there was one — it always did, and the page now says so; the deletion section describes the backups as they are — they hold the votes, the consent records and the follow lists, on a 90-day rotation that never keeps fewer than two snapshots, and a word about encryption that the pipeline does not support is gone; and the list of what a feed page keeps on your device now includes your docket keywords. As before, nothing about what the product does changed — the page stopped saying three things inexactly.
23 August 2026. Voting, with Google sign-in, went live on this website, and the what-exists-today note now says so. The note's Apple sentence was also corrected: the button is live and answers when pressed, not "visibly switched off". The deletion section states the backup reality: we keep no working copy, and deleted data ages out of encrypted disaster-recovery backups within 90 days. The app's update check is also disclosed — it has worked this way since over-the-air updates were wired in; what changed is that we wrote it down. And we dropped a mention of notification settings, which the app does not ship yet.
22 August 2026. The "Who we are" section now names the data controller, Thomas Vanhoutte. Nothing about what is collected or how it is handled changed.
20 August 2026. If you sign in, the bills you follow are now kept with your account so they follow you across devices, and the website can show you new actions on them. Signed out, nothing changed: follows stay on your device and are not transmitted to us.
19 August 2026. Signing in, voting and deleting an account are built into this website as well as the app, and switch on when sign-in is enabled — this page now covers them. Nothing new is collected, and nothing that was kept on your device moved off it.
Last updated 15 October 2026.