Legal
Privacy Policy
What Utah Civic Compact collects, how we use and protect it, and the choices you have.
The short version
We collect information only when you give it to us: when you send a tip, sign up for updates, sign a petition, or donate. We do not run advertising, tracking cookies, or behavioral analytics, and we never sell, rent, or trade your information. Tips are confidential. Everything else is used only to do the work you handed it to us for, and you can ask us to correct or delete it at any time.
Who we are
Utah Civic Compact ("UCC," "we," "us") is a 501(c)(4) social welfare organization based in Utah. We investigate government misconduct, publish civic journalism, run petitions, and advocate for community accountability across Utah. Our website is utahciviccompact.org. For anything in this policy, email info@utahciviccompact.org.
Information we collect, and why
Confidential tipline
When you submit a tip we collect your email address (required, so we can follow up), your name unless you choose to submit anonymously, the subject you give the tip, and the tip itself. Tips are used only to evaluate and, where warranted, investigate what you tell us, to follow up with you, and to keep an internal record of tips received for editorial accountability. Tipline email addresses are never added to our mailing list and are never used for fundraising.
If you tick "submit anonymously," your name is not recorded at all; the tip is stored under the name "Anonymous." Your IP address is not stored with your tip (see "Information collected automatically" below).
Updates mailing list
When you sign up for updates we collect your first and last name, your email address, and optionally your street address and ZIP code. We send one confirmation email; you are not added to the newsletter audience until you click the confirmation link in it. We use the list to send news, action alerts, and opportunities to get involved. ZIP code lets us tell Utah residents from out-of-state supporters when we send, so that, for example, a call to contact a Utah legislator goes to Utahns.
Petitions
When you sign a petition we collect your first and last name, email address, and ZIP code, and optionally your street address and phone number. Your signature is recorded under the campaign you signed. As the form says, signing a petition also adds you to the updates mailing list. Petitions are counted publicly as a number only, and only signatures with a Utah ZIP code are counted; no signer's name is shown on the site. Signatures are kept as the record of the petition and may be delivered to the officials or public bodies the petition addresses (see "Who we share information with").
Donations and memberships
Donations and monthly memberships are processed by Stripe on Stripe's own secure checkout pages. We never see or store your card number. From Stripe we receive and keep your name, email address, ZIP code, the amount and date of each gift, and a Stripe customer identifier so you can manage a membership later. We use this to process your gift, send receipts and billing links, keep the financial records the law requires of a nonprofit, and, if you leave the box ticked, to add you to the updates mailing list.
The donation form has a second box, ticked by default, to show your first name and gift amount on the recent-donors list on our homepage. Untick it and your gift is listed as "Anonymous." You can ask us to remove your name from the list at any time.
Information collected automatically
We keep this to a minimum:
- Abuse prevention. When you submit a form, your IP address is checked against a short-term rate limit and discarded within about an hour. It is not linked to your tip, signature, or sign-up.
- Bot check. Our forms use Cloudflare Turnstile to tell people from bots. Turnstile processes your IP address and browser signals under Cloudflare's privacy policy; we receive only a pass/fail token.
- Email statistics. Our newsletters contain a small image that counts how many times an issue was opened. The count is per issue only; it does not record who opened it. We also record when an email to you bounces or is reported as spam so we stop sending to that address.
- No visitor logs or analytics. We do not run analytics, advertising pixels, or tracking cookies, and we do not keep access logs of who visits our pages. Our hosting provider, Amazon Web Services, processes IP addresses as part of delivering the site.
- Browser storage. The site uses your browser's temporary session storage for two small conveniences: remembering that you closed a pop-up, and carrying your name, email, and ZIP code from the petition form to the donation checkout if you choose to give. This is cleared when you close the tab and is never sent to us for any other purpose.
Embedded video
Some pages embed videos hosted on YouTube. When a page with an embedded video loads, YouTube (Google) may set cookies and collect information under Google's privacy policy. We do not receive any of that information.
How we store and protect information
Everything you submit travels over HTTPS and is stored in an encrypted database hosted by Amazon Web Services in the United States (Oregon). Access to that data is limited to UCC staff who need it for their work, and tips are seen only by editorial staff and leadership. Encrypted backups are kept for 90 days and then deleted automatically.
No system is perfectly secure. If we learn of a breach affecting your information, we will tell you as quickly as we reasonably can.
Who we share information with
We do not sell, rent, or trade your information, and we do not share it for advertising. We share it only as follows:
- Service providers that process it on our behalf and may not use it for their own purposes: Amazon Web Services (hosting, database, and outgoing email), Stripe (payments), and Cloudflare (bot protection).
- Petition recipients. The point of a petition is to deliver it. The petition record we deliver may include signers' names and ZIP codes, and street address where you gave one. We do not include email addresses or phone numbers in what we deliver.
- Public donor list. Your first name and gift amount, only if you left that box ticked.
- Legal compulsion. If a court order, subpoena, or other valid legal process requires disclosure, we would be bound to comply. We would notify you in advance if legally permitted to do so, and we would resist any demand for a tipster's identity to the full extent the law allows.
- Your consent. If we want to publish or share anything attributable to you, we will ask you first.
Anonymity for tipsters
You may submit a tip without your name, and we take anonymous tips seriously. Your email address is still required so we can follow up. If true anonymity matters to you, use an email account not connected to your identity, such as one from Proton Mail, and do not include identifying details in the tip itself unless you want us to have them. Consider submitting from a network you do not normally use.
How long we keep information
- Tips: as long as needed for our editorial and investigative work. If you ask us to delete your tip and it has not yet informed published reporting, we will delete it. Once a tip has informed published reporting, we may keep it as part of our editorial record.
- Mailing list: until you unsubscribe or ask to be removed, at which point your entry is deleted. If you never confirm your sign-up, you receive nothing further; ask us and we will remove the entry.
- Petition signatures: kept as the record of the petition.
- Donor records: kept as part of the financial records a nonprofit must maintain.
- Bounce and spam reports: while the address is on our list.
- IP addresses used for rate limiting: about one hour.
- Backups: 90 days.
Your choices and rights
Whatever your location, you can ask us to:
- Tell you what information we hold about you
- Correct information that is inaccurate
- Delete your information, subject to the retention rules above
- Remove your first name from the public donor list
- Remove your signature from a petition we have not yet delivered
To make a request, email info@utahciviccompact.org with "Privacy Request" in the subject line. We may need to confirm you are the person the information belongs to before acting. You can also unsubscribe from updates at any time using the link at the bottom of every email we send.
Children
This site is not directed at children under 13, and we do not knowingly collect information from anyone under 13. If you believe a child has given us information, email us and we will delete it.
Changes to this policy
We will update this policy as our practices change, and the date at the bottom of this page reflects the most recent revision. If a change meaningfully reduces your privacy, we will say so prominently on this page and, where we can, by email.
Contact
Questions about this policy or about your information? Email info@utahciviccompact.org.