Privacy Policy

Heard is operated by Michael Scott Hayes (“Heard,” “we”). We are responsible for the personal information described here. Questions go to privacy@heard.one.

When you create an account:

• Email address and display name — to identify your account and contact you
• Password — stored only as a one-way hash, never readable
• If you sign in with Google — the name, email address, profile photo, and account ID Google shares with us. We get no password and nothing else from your Google account.
• Street address, town, state, and district (optional for password sign-up) — used only to match you with your elected officials
• Optional bio — shown on your public profile

We do not ask for your phone number, date of birth, or government ID. Earlier versions of Heard asked for a phone number; we never used it, and any number still on file is deleted with your account, or sooner if you ask.

As you use Heard:

• What you create and do: posts, comments, likes and reactions, polls and poll votes, petitions and signatures, caucus memberships and messages, testimony, follows, reports you file, and saved Explorer views or dashboards
• Account records: when you joined and last signed in, your notification and two-factor settings, and each time you accepted these policies (with the version)
• One-time sign-in codes, stored hashed and expiring within minutes

Technical information:

Your IP address is used to rate-limit requests and block abuse. It is kept in short-lived counters that expire on their own, usually within 15 minutes, and is not stored with your account. Our hosting provider keeps standard server logs for security and troubleshooting.

• Match you to your representatives — your address is turned into map coordinates to find your federal, state, and local districts (see section 04 for who does that).
• Run the platform — show your public profile and content, send verification codes and password resets, and deliver notifications you've turned on.
• Keep it safe — prevent spam, abuse, and account takeover, and enforce our Terms.
• Understand usage — aggregate counts only (e.g. how many members live in a district), never published in a way that identifies you.

We don't use your information for advertising or to build profiles about you.

We don't sell or share your information for anyone else's purposes. A few service providers handle it on our behalf, only to run Heard:

• Hosting and database — Railway runs our servers and stores our database.
• Email delivery — our email provider sends verification codes, password resets, and account notices to your address.
• Abuse protection — Upstash stores the short-lived rate-limit counters described above.
• Address matching — your street address is sent to the U.S. Census Bureau's public geocoder. If the Census can't place it, we send only your town and state, or ZIP code — never your street address — to OpenStreetMap's Nominatim service.
• Google — only if you choose to sign in with Google, which then knows you used it to sign in to Heard.

Contacting officials. Heard never sends your information to elected officials. When you use a “contact” button, it opens your own email app or phone; what you send is up to you.

Legal requests. We disclose information only when the law requires it (for example, a valid subpoena or court order), we ask for the narrowest disclosure the law allows, and we notify you first unless we are legally prohibited from doing so.

If Heard changes hands. If Heard is ever transferred to a new operator, this policy — including the promise never to sell your data — goes with it, and we'll notify you before the transfer so you can delete your account first.

• We do not sell your data — not now, not ever.
• We do not share your data with advertisers, data brokers, or political campaigns.
• We do not show ads, and we run no third-party analytics, tracking pixels, or advertising cookies.
• We do not show your street address, email, or password to other users or to elected officials.

Heard is a public-discourse platform. Anyone can see:

• Your display name, profile photo, and (optional) bio
• Posts, comments, and reactions you create
• Your town and state, shown next to your posts, comments, petitions, reactions, and testimony so officials can see who is local
• Polls and petitions you create. Signing a petition is private: your name appears on it only if you tick “Show my name as a signer”
• Bills and representatives you follow
• For elected officials and candidates: voting record, posts, office information, and campaign-finance data from public records

How you voted in a poll is never shown to other people; only the totals are. Messages in a private caucus are visible only to its members; questions and answers in an election caucus are visible to any signed-in member. Your street address, email, and password are never public.

Heard is not for children under 13. We ask everyone to confirm their age at sign-up and do not knowingly collect personal information from anyone under 13. Members aged 13 to 17 need a parent or guardian to agree to the Terms on their behalf. If you believe a child under 13 has an account, email privacy@heard.one and we will delete it.

Whoever and wherever you are, you can:

• See and edit your profile and address in settings
• Turn notifications on or off, and sign petitions privately
• Delete individual posts or comments
• Delete your account from settings (see section 09 for exactly what that removes)
• Email us for a copy of the data we hold about you, in a portable format, or to correct it

Some state laws — for example in California, Colorado, Connecticut, and Virginia — give residents formal rights to know, access, correct, delete, and port their data, and to opt out of its sale or use for targeted advertising. We extend those rights to everyone. We don't sell data or do targeted advertising, so there is nothing to opt out of, and we treat a Global Privacy Control signal as an opt-out regardless. We verify requests through your account email, answer within 45 days, and will never treat you differently for exercising a right. You may use an authorized agent.

We keep your account information for as long as your account exists. When you delete your account, we immediately and permanently delete your account record, email, password, address, bio and photo, follows, likes and reactions, poll votes, petition signatures, caucus memberships and messages, notifications, reports you filed, and policy-acceptance records.

Posts, comments, polls, and petitions you started stay up so the conversations and signature counts others joined remain intact, but they are reattributed to “Deleted User”, with your name and profile removed. If you want any of them gone, delete them before you delete your account. Copies can remain in our hosting provider's database backups until those backups expire on their normal schedule.

Representative, candidate, and administrator accounts are tied to public office or platform duties, so they are closed by emailing us rather than from settings.

We use only cookies that are strictly necessary to sign you in: a session cookie that lasts at most 7 days (or until you close your browser, if you sign in with a password and don't choose “remember me”), and short-lived cookies (15 minutes or less) that carry you through two-factor and Google sign-in. None are readable by page scripts or shared with anyone.

Your browser's own storage keeps a few preferences on your device — like your feed filter or a banner you dismissed — and briefly holds an address you looked up before signing up. That stays on your device.

We don't track you across other websites, so “Do Not Track” and similar browser signals have nothing to switch off.

All traffic is encrypted in transit (HTTPS). Passwords and sign-in codes are stored only as hashes, session cookies can't be read by scripts, and you can turn on two-factor sign-in in settings. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

When we change this policy in a meaningful way, we update the version and effective date above, and the next time you visit we ask you to review and accept the new version before continuing. You can decline and delete your account instead. We will never apply a change that loosens our never-sell promise to data collected before it.

Privacy questions and requests: privacy@heard.one. See also our Terms of Service.