Privacy

If you only read the civic pages

We collect nothing about you. The pages for the election and county services have no sign-in and no form that asks for your name or email address. They show no ads, use no analytics or tracking tools, and set no cookies.

If you make an account

We keep what you give us and what you do here:

• Your page: your name, @username, community area (shown to others only if you choose), and, if you add them, a short bio, a website, a profile photo and a cover photo.
• Your account: your email address, which other members never see, and your password in a scrambled form that we cannot read.
• Sign-in protection, if you turn it on: for two-step sign-in, the key your authenticator app uses, kept sealed (encrypted), and your recovery codes in a scrambled form; for a passkey, only its public half and the name you give it. The private half of a passkey never leaves your device.
• What you do: your posts and replies, the earlier words of a post you change in its first 15 minutes (only moderators can read them), your likes, the events you say you are going to, the groups you join, and who you follow, mute or block.
• Your choices: the issues you pick, the posts you save, the words you mute, your notification settings and quiet hours, and your voting plan if you make one (how you mean to vote, so we can remind you of its dates). Only you can see these.
• Your devices: the kind of phone or browser that is logged in, when it was last used, and a scrambled code made from its network address, which lets us warn you about a login from somewhere new.
• Safety records: reports you send, the decisions we make about posts and accounts, and which version of the terms you accepted and when.
• A badge request, if you send one: the name on your photo ID and the times that suit you for a short video call. Our staff read it. On the call a staff member looks at your photo ID; we keep no copy of it and write down only that it was checked.
• A request to list a business, if you send one: the business's details (its phone and address, not yours), how you know it, and your note. Our staff read it; the business's details appear in Local services only if staff list it.
• A request to list an organization, if you send one: the organization's details (its phone, website, hours and address, not yours), how you know it, and your note. Our staff read it; the organization's details appear in Community services only if staff list it.
• A message to us, if you send one with Report a problem: what you write, the topic you pick, the app’s version, and whether you use an iPhone or an Android phone with its system version (from the web version, only that you wrote from there), tied to your account. A person on our staff reads it; a child safety concern only the specially trained admins.

We do not ask for your phone number, your contacts, your location, or your street address.

In Settings you can download a copy of your account and everything you wrote, at any time.

Messages, polls, photos, documents, links and views

• Views: each post shows how many members saw it. When a post is on your screen for a moment, or you open it, the app tells our server, and you count once a day for each post (never for your own). We keep only the number. To count you once a day we keep a scrambled note for two days that holds no name and no post number, and then nothing says who saw what.
• Private messages are kept sealed (encrypted) on our server. Only the people in the conversation read them. Our staff read a message only when someone in the conversation reports it, and then only the messages that person chose to report.
• Unsending a message: You can unsend a message you sent, at any time. It disappears for everyone in the chat, with its photo or document, and a short line says you unsent it. People may have seen it already, and an alert that already reached a phone stays there. We keep it sealed for 30 days so someone else in the chat can still report it. In that time nobody can read it, you included, except our staff if someone reports it. A message someone reported, before or after you unsent it, stays with that report for as long as we keep reports. After the 30 days we erase its words, photo and document, unless the law or a safety report requires us to keep them longer.
• Polls: your vote is counted but never shown. Nobody, not the person who asked and not our staff, can see who voted or how. Thirty days after a poll closes we keep only the totals.
• Photos: before a photo is shown we draw it again and remove the place it was taken and everything else hidden in the file.
• Documents: a PDF, Word or Excel file you add is kept exactly as you sent it, with whatever its program wrote into it, such as the author’s name, so look before you share. Our server reads it only to refuse files with macros, scripts or hidden files. Whoever can see your post, reply or message can download it. Once you delete it nobody can, and we erase the file 30 days later.
• Links: When you post a link, our server opens the page, usually just once, to read its title, a short description and its picture, and keeps a cleaned copy of that picture so the card under your post can show it. Everyone who reads your post gets that picture from our server, so the other site sees our server, not you or your readers. It hears from a reader only if they open the link.
• The weekly email is off unless you turn it on, and every one has a one-click way to stop it.

Who can see it

Other members can see your page and your posts. People who have no account cannot, unless StoaSquare chooses to open reading to everyone, and the app tells you which it is. A private group's posts are seen only by its members, and a group's own moderators can see who is in it. Moderators, who keep the community safe, see names, usernames and areas but never email addresses. An administrator can look at an email address only to deal with a safety problem; each time is written to a log that cannot be changed.

What we never do

We never sell your information. StoaSquare shows no ads, has no advertising trackers and does not use an advertising ID. Our own server counts things like how many neighbors joined this week, and we do not follow anyone from one website to another.

Companies that help us run it

Our server is rented from DigitalOcean, in New York. Cloudflare protects the site and speeds it up. Postmark delivers our emails, such as your sign-up code and security warnings: it receives your email address and the email itself, and nothing else. Expo, whose tools the phone apps are built with, delivers phone alerts and app updates, with Apple and Google, as “The phone apps” below explains.

How long we keep it

When you delete your account (how to delete it), you have seven days to change your mind. After that your name, email, bio, sign-in records, follows, blocks and likes are removed, your posts become empty lines and your replies become “[deleted]”, so the conversations around them still make sense. Your private conversations are deleted for both people, your messages leave group chats, and your two-step key and passkeys are removed. Your @handle is not given to anyone else afterwards, so old mentions never lead to a stranger: we keep only a scrambled form of it, for a year, or for good when a moderator removed the account. An account whose email is never confirmed is deleted after seven days. A private message is also erased once everyone in the conversation has deleted it. The words, photo and document of a message you unsend are erased 30 days after you unsend it, or sooner if the whole conversation is erased first. A profile or cover photo you change or remove stops showing at once, and we erase it 30 days later (not while a report about your page is still being decided). The copy of a picture on a link card is erased a day or two after the last post using it is deleted. If that post was taken down, or our staff took the picture down, we keep it out of sight for 400 days, then erase it (not while a report about it is still being decided). The earlier words of a post you changed go with the post. That you said you are going to an event is removed 30 days after the event. A message you sent us with Report a problem is deleted twelve months after you sent it, or with your account if that is sooner, except a child safety concern, which is kept the twelve months like a report. Reports, moderators’ decisions, strikes and appeals are kept for twelve months from when each was made or decided, then deleted. Our staff’s own record of what they did (each decision, its reason and the staff member’s note) is kept for at least three years, and nobody can change it. The record of which terms you accepted, and when, is kept for twelve months after you ask to delete your account, or after a moderator removes it. Where the law, or a child-safety report, requires us to keep something longer, we keep only that. The cookie page lists what is saved in your browser.

The phone apps

• Updates: each time the StoaSquare phone app opens, even when you are not logged in, it asks Expo’s update servers (u.expo.dev, and the servers that hold the update’s files) whether a newer version of the app is ready, and downloads it if there is one. Expo sees your phone’s internet address, whether it is an iPhone or an Android phone, the app’s version and a random number made for this copy of the app. It does not include your name, your account or anything you wrote.
• Phone alerts, if you turn them on: the app asks for a push address only after you turn alerts on in StoaSquare, on an Android phone too, where the phone may allow notifications without asking. To get one, your phone first gets its device token from Apple’s or Google’s push service. The app then sends that token, with an installation ID (a random number Expo’s alert tools make for this copy of the app), to Expo, whose server gives back the push address. The app asks Expo again each time it opens, and when someone logs in, for a member who turned alerts on. Expo’s alert tools inside the app never send the token to Expo again by themselves. The one exception is a phone that turned alerts on in one of the app’s first test builds: the first time it opens a newer build, it may send the token and the installation ID to Expo once more, and never after that. The app sends the push address to our server so we can reach that phone. Alerts go through Expo’s push service and then Apple’s or Google’s, which use the device token to find your phone. An alert carries a short title, such as “New reply on your post”, and a number the app uses to open the right screen, never the words of a post or reply. The one exception is message previews: if you turn them on in Settings, an alert about a private message also carries the sender’s name and the message’s first words, through those same services. Logging out of a phone asks our server to delete its push address. If the phone has no connection at that moment, alerts can keep coming to it until you log it out from another device, in Settings, Devices and sessions. We also delete a push address that has not been used for 60 days.
• Logging in: the app sends our server a random number made for this copy of the app. We keep it only in a scrambled form, so we can recognize the phone and warn you by email when your account is used on a device we have not seen before.
• Photos and documents: when you add one, the app opens your phone’s own picker, and only the photo or file you choose is sent.
• What the apps never use: your location, your contacts, your camera or your microphone. The apps show no ads and use no advertising ID, no tracking and no analytics tools.

What our servers see

Like any website, our server, and Cloudflare, the company that protects and speeds up the site, see the technical details of each request: your internet address, the page you asked for, the time and your browser type. We use them to keep the site running and safe. We do not sell them, and we do not use them to follow anyone across the web.

Links to other sites

When you open an official county or Supervisor of Elections page, that site's own privacy policy applies. StoaSquare never sees what you type there.