| Raw ballot lookup input | Street address or ZIP entered into the lookup. | Request-time processing, plus up to 7 days for encrypted normalized-address cache data when that optional backend cache is enabled. | Request-time handling, provider processing, and—when the encrypted cache is enabled—restricted backend access to authenticated ciphertext. | The current app flow avoids adding an exact street address to published source records, URLs, the saved-area cookie payload, or durable browser preference state. Encrypted backend cache records expire automatically; provider-side retention depends on the recipient's system and policy. |
| Saved lookup cookie | Authenticated encrypted first-party cookie containing public area-result continuity details such as an exact 5-digit ZIP when applicable, matched districts, representative matches, official actions, and lookup timing. Exact street-address input is omitted. | Up to 7 days. | Sent automatically to the backend as a first-party HttpOnly cookie; browser scripts cannot read it. | Clear browser cookies or submit a new lookup that replaces or clears the stored context. |
| Encrypted address lookup cache | Provider-normalized address geography, district matches, representative matches, and lookup metadata needed to avoid repeating the same provider calls. | Up to 7 days when the optional Postgres cache and its dedicated encryption key are configured. | Restricted backend database access; the payload is stored as authenticated ciphertext and the lookup identifier is keyed. | Records expire automatically after 7 days and are deleted on later cache access or replacement. Legacy plaintext rows are removed during schema migration. |
| ZIP-only lookup operations log | Timestamp, exact normalized 5-digit ZIP input, lookup result, guide-availability status, and whether a ZIP area selection was required. The log does not include raw lookup text, full street addresses, ZIP+4 entries, city names, mixed address strings, provider-normalized ZIPs, IP address, or user agent. | Short-term operational retention, generally days to weeks rather than permanent publication. | Operational access only for reliability, coverage planning, and abuse monitoring. | Removed through operational log rotation or retention cleanup; not published as civic content. |
| Display timezone cookie | First-party cookie containing the browser-reported timezone used for SSR-safe date display. | Up to 1 year. | Stored in your browser on the current device. | Clear browser cookies or override the stored timezone with a later visit. |
| Saved guide preferences | Selected public location label, compare list, ballot plan, issue filters, reading mode, and sanitized area-result details. Exact street addresses, address-specific ballot previews, and address-specific polling logistics are excluded. | Until you clear it or replace it on your device. | Stored in your browser on the current device. | Clear browser storage, use a private session, or overwrite the saved state. |
| Editorial access session cookie | Private editorial authentication cookie for editorial and operations access. | Up to 12 hours per session. | Stored in the editor's browser and private access-control layer. | Sign out, clear browser cookies, or allow the session to expire. |
| Operational request metadata | IP address, user agent, endpoint path, referrer, timestamps, pageview metadata, and similar request metadata. | Short-term operational retention, generally days to weeks rather than permanent publication. | Hosting, operations, security tooling, and the analytics service hosted at analytics.ballotclarity.org. | Managed through service settings, with longer retention permitted for active abuse handling, incident response, or legal obligations. |
| Contact form rate-limit metadata | Connection-derived rate-limit key, request count, and reset time for repeated contact or correction form submissions. | Short-lived in-memory retention, defaulting to about 10 minutes unless the operator changes the rate-limit window. | Backend memory only, for public form abuse prevention. | Cleared automatically when the short rate-limit window expires or the server process restarts. |
| Civic lookup rate-limit metadata | Connection-derived rate-limit key, request count, and reset time for repeated civic lookup requests. This does not add raw addresses to the ZIP-only operational lookup log. | Short-lived in-memory retention, defaulting to about 10 minutes unless the operator changes the rate-limit window. | Backend memory only, for lookup abuse prevention. | Cleared automatically when the short rate-limit window expires or the server process restarts. |
| Contact and correction submissions | Name, email address, subject, page URL, message, attachments, and source links you provide through email or the contact form. | Until the issue is resolved and the supporting review record is no longer operationally needed. | Project inbox, review store, and editorial reviewers handling the issue. | Archived or deleted when no longer needed for support, verification, auditability, or the public corrections process. |