Privacy

What we collect

When you create an account, we collect your username, email address, and current self-reported ZIP code, plus a password if you choose password signup. Email addresses are stored in lowercase so capitalization does not create separate accounts.

We store passwords only as secure password hashes. We also record sign-in session details: a hashed session token, expiration and use times, IP address, and browser user agent. Password-reset links expire after one hour, and we store their tokens only as hashes. A successful password reset invalidates all outstanding reset links and prior sign-in sessions, and revokes all API tokens. If your account is active, completing a reset starts a new session.

If you create an API token, we store its hash, name, display prefix, permissions, creation and expiration times, last-use time, and revocation time. The full secret is shown once and is not stored. Tokens let your chosen agent read and submit content as your account. Delegated submissions are stored and made visible under the same rules as browser submissions. We record token identifiers and requested routes in operational logs and use token identifiers in rate-limit records; we do not log the token secret.

If you choose Google sign-in, we receive and verify your Google account identifier, email address, and email verification status. We store the identifier, email at linking, and linking time with your Quoris account. We do not request access to Gmail or Drive, store Google access or refresh tokens, or import your name or photo. An existing account must be authenticated with its Quoris password before Google is linked. Google-created accounts can use email password recovery to set a Quoris password. Later Google email changes do not automatically change your Quoris account email.

When you use Quoris, we store the ideas, reasons, implementation suggestions, votes, reports, and account updates you submit. Reports can include a reason and optional details. Administrators' moderation actions are also recorded so we can operate the service responsibly. Deleting content closes its open moderation cases; associated reports and case records remain available for operational review. We may use automated safeguards to help identify content for moderator review and record the resulting moderation status. To protect sign-in, account recovery, and participation features from abuse, we also use account identifiers, email addresses, and IP addresses in rate-limit records and operational logs.

When another account engages with an idea, or an administrator approves a forwarding packet for it, we retain a copy of the idea's title and description as the initial version record. We keep that record if the later vote or contribution is removed, and we associate later contributions with the applicable idea version. Anyone can view retained wording for visible ideas. Hidden ideas and wording removed by moderation are unavailable in revision views. Version records are deleted when the idea is deleted.

Idea-update notifications store the recipient account, the revision, creation time, and read status. They are private to the recipient and are deleted with the idea or recipient account. Marking a notification read does not change your vote. After engagement or forwarding approval, each author edit retains a version and notifies every account currently voting on the idea, whether supporting or opposing it. Former voters and contributors without a current idea vote are not subscribed. These in-app updates are required; no edit email is sent. Before that boundary, corrections do not retain earlier wording. Moderators can remove wording from public history and previews while retaining it internally for moderation review.

If you request a representative lookup using a street address, we process the address you provide. We store the matched address, precise coordinates, geographic districts, and provider responses to resolve representatives and cache lookup results. These records are kept separately from your account ZIP; a cache expiration means a lookup may be refreshed, not that the stored address is deleted. We also maintain representative records using publicly available official rosters and the public OpenStates dataset, including names, offices, districts, party affiliations, public portrait URLs, public office phone numbers, and official profile and contact links. We retain source references and retrieval dates so these records can be reviewed and refreshed.

Your dashboard uses your account ZIP with locally stored public Census ZIP-area and district tables to suggest possible districts and states, and uses locally stored public records to suggest U.S. senators for those states. We do not send that lookup ZIP to an external provider or save it as a representative address lookup. These suggestions are approximate and do not verify your residence or exact district. Administrators can also look up a ZIP to review possible packet recipients using the same public tables.

Quoris also provides a public lookup service for WhoReps.us. This separate service requires no account and does not attach searches to Quoris accounts. WhoReps.us uses Google Places for address suggestions; typed text is sent to Google to provide those suggestions. Submitted ZIP searches use local public data. Address searches are sent to the U.S. Census Geocoder and processed in memory; this public service does not persist submitted or matched addresses, coordinates, or provider responses in a database, application log, or search cache. Client IP addresses are used in rate-limit records for abuse prevention. Matched addresses are returned temporarily for users to check their results. The stored-address lookup records described above belong to the separate account/admin lookup system, not this public service.

What other people can see

Public Quoris pages show visible ideas, reasons, implementation suggestions, usernames, dates, and aggregate vote counts. They do not show your email address, personal vote history, reports, or account ZIP code.

Inside the signed-in product, an idea's origin ZIP is shown with the idea. That is the ZIP attached when the idea was created; it may not be the creator's current ZIP. Do not put sensitive personal information in an idea, reason, or implementation suggestion: visible content can be read, copied, and shared by others. Public pages may also be indexed by search engines. Hiding or removing content in Quoris does not remove copies that other people or search engines already have.

How we use it

• to create and secure accounts, sign you in, and send password-reset emails;
• to tailor Local Trending using your current self-reported ZIP;
• to count votes, display public civic discussion, and operate your dashboard;
• to prevent abuse, rate-limit requests, moderate content, and investigate reports; and
• to operate and improve the service.

Public reading and private submissions

Visible ideas and their visible contributions can be read without signing in, including later pages of a discussion. Public pages may be discovered by search engines; we do not guarantee indexing. Rankings can change between visits.

Authors can read their own stored held submissions in a private dashboard view, with “Flagged for review” for pending moderation or “Hidden” after a decision to hide. Authorized moderators also retain access. This view does not reveal reports, reporter identities, internal notes, or another author's moderated text. If a parent idea is unavailable, the author can see their own retained contribution without the moderated parent title.

The private view is for reading only and adds no editing, deletion, appeal, or notification process. It does not preserve content already deleted under existing rules or promise a review deadline.

When an idea is forwarded

Quoris has a limited, admin-reviewed forwarding workflow. If an administrator approves a packet for a verified public contact, it can include the idea text, selected visible reasons or implementation suggestions, an origin or forwarding-cohort ZIP, and aggregate support and oppose counts. At approval, we save the packet, its destination, the reviewer, and an “as of” time for those counts. The notice links to the live idea; forwarding does not freeze that idea or its discussion. We retain delivery attempts, recipient information, and the packet sent so failed or uncertain deliveries can be investigated without sending duplicate packets. Saved notices and delivery records remain available to administrators if the live idea is later deleted; unattempted pending or approved notices are canceled. This does not create a general archive of deleted submissions. It does not need to include your email address or your username.

Service providers

We use Railway to host Quoris and its database, and Resend to deliver transactional email such as password resets and approved forwarding packets. If you choose Google sign-in, Google processes your authentication request under its own privacy policy and shares the identity information described above with Quoris. For street-address representative lookups, we send the submitted address to the U.S. Census geocoder, coordinates to OpenStates, and, when configured and needed, address/location information to Cicero. These providers process the information needed to provide their parts of the service. We do not give personal data to advertisers, data brokers, or analytics vendors.

Cookies and tracking

Quoris uses an essential, secure session cookie after you sign in. It keeps you signed in and is not used for advertising or cross-site tracking. API tokens provide a separate authentication path without a session cookie. Signing out does not revoke tokens; you can revoke them in Account, and password recovery revokes them all. Google sign-in also uses a temporary essential cookie, valid for up to ten minutes, to connect your browser to the sign-in attempt. It contains a random token, not your Google credentials. Google may use its own cookies on its sign-in pages. Signing out of Quoris does not sign you out of Google. We do not use advertising cookies or analytics SDKs. We do not change how Quoris works in response to a browser's Do Not Track signal because we do not conduct cross-site tracking.

Retention and your choices

Expired sign-in sessions no longer authorize access. Their complete database records, including token hashes, IP addresses, and browser user-agent details, are eligible for deletion when they expire. Hourly cleanup targets deletion from the active application database within 24 hours of expiry. Failures or a backlog may delay removal, and cleanup runs check for overdue records.

API tokens expire within 90 days. Expired or revoked tokens cannot authorize new requests; their database records become eligible for deletion by the same cleanup worker as expired sessions. Hourly cleanup targets removal within 24 hours of expiry or revocation; failures or backlog may delay removal.This does not set deletion timing for backups, operational logs, or rate-limit records.

Cleanup does not create a replacement per-session archive. It records aggregate job health, such as run times, deletion counts, and error codes. This session-cleanup rule applies to the active application database; it does not establish deletion timing for backups or provider logs.

Google sign-in attempts expire after ten minutes. During that time we temporarily store anti-forgery values and, after verification, the Google identifier and email needed to finish signup or linking. Used attempts are deleted when sign-in finishes; expired attempts are deleted when another Google sign-in starts. If no new attempt starts, expired records may remain stored but cannot authorize access. Linked Google identifiers remain part of your account records. We do not currently offer a self-service unlink control.

We keep other account, participation, moderation, and security records while they are needed to operate, secure, and moderate Quoris. We have not set separate retention schedules for those categories, added a self-service account deletion control, or set up a dedicated privacy-request channel yet. You can update your ZIP in your account settings and sign out at any time.

Children

Quoris is not designed for children under 13, and we do not knowingly create accounts for them.

Changes

If this policy changes, we will update the date at the top of this page.