Privacy policy

The short version

Where I Stand matches a location to the people who represent it. That matching happens on your phone, against map data built into the app. No server is asked who represents your position — the boundaries are already on the phone. The app does not write your position to any file or database it controls, and does not give it to our advertising partner. The one exception is a diagnostic you can choose to copy and email to us, described below.

The app itself collects one thing: measurements of how quickly it runs, and reports of errors it did not catch. Those go to Expo, the company that hosts the app’s software updates, and they carry a code that identifies this installation of the app.

Five other things leave your device:

• Ads, served by Google AdMob.
• A check for a newer version of the app, sent to Expo at most once a day. It carries the same installation code as the measurements, so the two records can be matched to each other.
• Reference data, downloaded from GitHub: the lists of officials, spending figures and place descriptions.
• Feedback, if you send it, which goes to a form hosted by Tally.
• A diagnostic, if the app hits an error it cannot draw through. The app offers you a short report to copy and email to us, and it includes the map point you were last looking at, rounded to about 110 meters (360 feet). Nothing in it is sent unless you send it.

There is no account and no login. The rest of this page sets out each of these in full.

Who we are

Where I Stand is published by Boilerplate LLC. You can reach us at support@boiler-plate.com.

We do not operate a server of our own for this app. Everything the app contacts belongs to another company, and each of them is named below.

Your location

When you allow it, the app reads your device’s location to work out which state, county, city or town, congressional district, state legislative district and, in some cities, council district you are in, along with the people who hold those seats.

That matching happens entirely on your device, against boundary data bundled inside the app. No request goes out to resolve it. The app does not write your position to its own storage, and does not put it into any web address it builds. A check in our build system fails the build if the most direct ways of doing any of those appear in the code.

Two things sit beside that, and we would rather tell you than let you find them.

The diagnostic you can email us. If a screen fails to draw, the app offers a short report to copy and send. For a place screen, that report includes the point you tapped, searched for or followed a link to, rounded to about 110 meters (360 feet). That is enough to point at a neighborhood, not a building. Nothing is sent unless you send it. The full details are under If a screen fails to draw, below.

IP addresses. Every request a phone makes shows the address it came from. Google (for ads), Expo (for app updates and performance data), GitHub (for data files) and Tally (for the feedback form) each see your device’s IP address when they are contacted. An approximate area, typically a town or city, can be worked out from an IP address. Our app-store privacy disclosures list approximate location as collected by our advertising partner for that reason. We do not receive it, and we do not keep a record that your device asked.

Advertising

Ads in this app are served by Google AdMob, Google’s own software running inside the app. When a screen with an ad space opens, that software contacts Google directly, before any ad appears and whether or not one ever does. A loaded ad also fetches its own images from a server that Google’s ad response names.

What Google receives. We have not inspected everything Google’s software sends, and we cannot verify it. Google’s own privacy policy describes what Google collects, and that description is the one to rely on: https://policies.google.com/privacy. Google’s software can also store cookies and similar identifiers on your device. We do not read them.

What we can say about our own app is narrower:

• Your IP address. Any server the app contacts, Google’s included, necessarily sees your device’s IP address.
• Your advertising identifier. The app lets Google’s software read your device’s advertising identifier where your phone allows it:
  • On Android, the app declares the advertising-ID permission. You can reset or delete that identifier in your phone’s settings.
  • On iPhone, the app shows Apple’s tracking prompt. If you choose “Ask App Not to Track”, the identifier is not available to Google.
• What we attach to each ad request. The list is short:
  • which ad space is being filled;
  • a preferred shape for the image;
  • whether the ad may be personalized;
  • three fixed settings, applied to every request on every device: ads must be rated suitable for general audiences; the app is not directed at children; and the app is not being used by someone under the age of consent.

  Those last two are statements about the app as a whole, not about you. The app has no age check and asks you nothing.

When ads are personalized. A personalized ad is one Google chooses using your advertising identifier and your activity in other apps and websites. Whether the app asks for one depends on where you are and what you have chosen:

• In the European Economic Area and the United Kingdom, Google’s consent form appears before any ad is requested. Ads are personalized only if you agree to it in that form. If you do not agree, ads are non-personalized. If the form cannot be completed, no ad is requested.
• Elsewhere, including the United States, ads are personalized unless you have turned that off (see below). On iPhone they are also personalized only if you allowed tracking in Apple’s prompt.
• If the consent step fails, the app does not ask for a personalized ad. It requests a non-personalized one only where a consent answer from an earlier session permits it, and otherwise requests nothing.

Ads are shown either way; they are what pays for the app.

Your choices. The Advertising section of the app’s Settings holds two controls:

• The “Personalized ads” switch is always there. Turning it off marks every ad the app requests afterwards as non-personalized. It does not stop Google’s software from contacting Google, and we cannot promise it prevents any particular piece of information from being sent.
• “Ad privacy choices” appears wherever Google’s software offers a form for your region, once the app has opened a screen with an ad on it. It opens Google’s own form. In the EU and UK that is the consent form above, where you can change your answer. In US states with privacy laws it lets you ask that your data not be shared for targeted advertising, and Google’s software applies that choice itself.

You can also limit ad tracking in your phone’s own settings.

We never send Google your location, and we receive nothing back from Google about you.

Performance measurements and error reports

The app measures how quickly it starts and how quickly it moves between screens, and sends those measurements to Expo, the company that hosts the app’s software updates. This is the one thing the app itself collects.

What the measurements say about a screen. They record what kind of screen was opened, such as a place, a representative or the settings. It is recorded as a pattern such as /place/[lat]/[lng], with no values filled in. For screens reached inside the app, the coordinate, the representative’s identifier and the name of the place you came from are stripped out before anything is sent. The screen’s full address is dropped along with them.

That stripping works from a fixed list of names we keep, so it covers the links the app itself creates and nothing beyond them. If the app is opened by a link somebody else wrote, anything extra that link puts in the address is sent to Expo exactly as written, including the part after a #, and the address goes with it. That is whatever the link’s author chose to put there, not anything about you. We cannot currently prevent it, because the measurement tool we use offers no setting that would. We re-check this each time that tool is updated.

The state of your device. Once each time the app is started fresh, the startup measurement also records the phone’s condition at that moment. That is not on every screen, and not again while the app keeps running in the background. It includes:

• whether the phone was in low-power mode;
• how warm it was running;
• its battery level, and whether it was charging;
• what kind of connection it had: wifi, mobile data, a wired connection, or none.

Anything the phone does not report is left out. The same measurement also carries:

• counts of slow and dropped display frames;
• a summary of the app’s own network activity during startup: how many requests it made, how many failed, how many bytes moved, and the server of the slowest one.

On iPhone, if the system warns the app that memory is running low, the app also sends how much memory it was using at that moment, how much it still had available, and how many such warnings it had received since it started.

None of this can be switched off. The app has no setting for the timings, the device conditions, the network summary or the errors below. The software the app is built on has a single control that would stop all of it at once, and the app does not expose it. Nor does the app sample: every installation sends.

Errors. If the app hits an error it cannot recover from, Expo receives:

• the kind of error and its message;
• the technical trace of where it happened, and a note of where in the app it came from;
• whether it closed the app;
• if the failure happened while drawing a screen, the trail of components that were being drawn.

An error that closed the app is sent the next time you open it. If the app itself crashes, Expo also receives:

• what kind of crash it was;
• the reason the system gave for closing the app;
• on an iPhone, the name and message of the system exception involved.

Errors the app catches itself are not sent. When you see the “Something went wrong” screen, nothing has been reported, which is why that screen asks you to copy the details and email them to us.

Records are not always sent while you are using the app. They can be queued and sent after you have closed it.

What every record carries besides its own contents. Each measurement and each error report travels inside the same fixed description of the app and the device it came from:

• the app’s package name, version and build number;
• which software update it is running, and on which release channel;
• the operating system and its version;
• the device’s model name and model identifier;
• the language your device is set to;
• the versions of the development tools the app is built with;
• the installation code described below.

Nothing in that description names you or where you are, and none of it can be switched off.

Two codes, not one. Alongside the installation code, every record also carries a second code that labels one run of the app. It is created when the app opens and never reused, and it lets the measurements from one session be read together. That one goes when the app closes. The installation code does not.

The installation code. Everything the app sends to Expo automatically carries an installation code: the timings, the startup network summary, and the details of any error the app did not catch. It is a random code stored on this phone: not your name, not an account, not your advertising identifier. It is the same code on all of these records, and it is the same code the app’s check for a newer version sends. So Expo can tell that all of it came from one copy of the app, and can match the measurements and the update checks to one another.

How long the installation code lasts. It stays the same when the app is updated, and it can survive reinstalling the app, because your phone may restore it along with the app’s other data. Deleting the app removes the copy stored on your phone, and on Android you can also clear the app’s data. Neither is a guarantee the code is gone for good: if your phone’s backup already holds it, installing the app again may bring the same code back. The app has no setting that changes or removes it, and neither does the Expo software the app is built on.

A report you send us yourself from the feedback form carries no such code.

When this starts. Performance and error collection begins as soon as the app opens: every time, before anything is drawn on screen, and whether or not the terms have been accepted. Accepting them does not turn it on or off.

Keeping the data current, and updating the app itself

When the app starts, it may ask two servers whether anything has changed: one for updated reference data, and one for a corrected version of the app itself. On its own it asks each of them no more than once a day. It notes on the phone when a server last answered and does not ask again until a day has passed. A check that could not reach the server is not noted, so it is tried again the next time the app starts. The “Check for updates” button on the About screen asks both straight away. The daily limit is the normal behavior rather than a guarantee: if the note is lost or cannot be read, or the phone’s clock moves backwards, the app will ask sooner. When a check is due, it starts before the terms screen appears.

Reference data, from GitHub. The app asks for a fixed list of files from a public release on GitHub: a manifest, and up to seven data files. The request carries no identifier of any kind, no cookies and nothing that distinguishes one copy of the app from another, and the app keeps no cookies from it. GitHub, and whatever service it hands the download to, necessarily see your device’s IP address and the time of the request.

Updating the app itself, from Expo. The app can replace its own program code without a visit to an app store. It asks Expo’s update service whether a newer version exists, and downloads it if so. That request carries the installation code described above, and Expo sees your device’s IP address. Where the update software recorded a previous fatal error, the app also sends Expo the text of that error on this request.

Because the app sends performance and error reports to Expo each time it runs, contact with Expo is not limited to one check a day.

Sending feedback

The feedback form is hosted by Tally, who process what you send on our behalf.

Before the form opens, the app shows a confirmation box listing what will be attached, and a switch that turns those details off. When the details are on, they travel in the link itself. So they reach the form’s host, and whichever browser your phone opens the link in, as the page loads, before you have typed anything. They are twelve technical fields:

• the app version and build number;
• the update runtime version, channel and update identifier;
• the platform and operating system version;
• the screen you were on, as a pattern rather than a place;
• the data build;
• your appearance and display settings;
• the map layer you had selected;
• whether any database setting failed.

No coordinate, no place name and no representative’s identifier is among them. With the switch off, the link carries none of them at all.

Tally receives your device’s IP address in order to send the page, as any website host must, whether the switch is on or off. It is the one thing that switch does not govern. We do not receive it.

Everything after that happens on Tally’s page rather than in the app. What you type is sent when you submit, and the form lets you attach a screenshot. Because that page is Tally’s, we cannot promise exactly when typed text or an attached file leaves your device: treat anything you put on that page as reaching Tally. A screenshot of this app can show where you are, the place you looked up, or the people you were reading about.

If a screen fails to draw

If a screen fails to draw, the app shows an error screen with a short diagnostic and a “Copy diagnostic” button. The app has not crashed: “Try again” takes you back to the map. A failure severe enough to close the app shows no error screen and offers no diagnostic.

The diagnostic lists:

• the app version and build;
• your device’s operating system and version;
• up to the last eight screens from this run of the app;
• any database setting the app asked for and did not get;
• the error message, with the top of its technical trace.

Within those screen paths, a place screen’s coordinates are rounded to three decimal places, about 110 meters (360 feet), whether you reached it from the map, a search or a link. The identifier of a representative whose page you opened is kept as it is. Anything else is replaced with “(hidden)”.

None of it is written to storage: it is put together when the error screen appears and is gone when the app closes. Nothing is sent when you press Copy. The text goes to your device’s clipboard, and it reaches us only if you paste it into an email and send it. What other apps on your phone can do with your clipboard is governed by your operating system, not by us.

Links out of the app

The app offers links:

• to the feedback form;
• to Wikipedia, for a place description;
• to a representative’s own website or contact form;
• to the organizations that publish the data the app uses;
• to our own pages.

Tapping one opens your browser, and that site then receives a request from your device, like any other site you visit. Some of those links say something about what you were looking at: a representative’s own website, for example, or a Wikipedia article about a place. We are not responsible for the privacy practices of sites we link to.

Where your information goes

Google, Expo and GitHub are based in the United States; Tally, which hosts the feedback form, is based in Belgium, in the European Union. Each may process what it receives in its own country and in other countries. So feedback you send through the form leaves the United States, and if you use the app outside the United States, what it sends to Google, Expo and GitHub is transferred abroad too. Each of those companies describes, in its own terms and privacy policy, the safeguards it relies on for such transfers, such as standard contractual clauses. Contact us if you would like to know more.

What we hold, and your rights

There is no account and no login in Where I Stand. You never tell us who you are, and nothing you do in the app is filed under a name.

Two lasting codes are involved all the same, and neither is ours to erase. The first is the advertising identifier your phone gives to Google, described under Advertising. The second is the installation code created by the Expo software the app is built on, described under Performance measurements and error reports. The app never displays either one, and we hold no account, name or contact details to attach them to. We have not established whether the installation code can be traced back to you as a person, and we do not claim that it cannot.

We hold two kinds of record ourselves:

• Feedback: what you write, any file you attach, and (where the details switch was on) the technical fields listed above. Tally keeps these on our behalf.
• Emailed diagnostics: if you email us a diagnostic, that email is in our inbox.

We keep these for as long as we need them to answer and act on what you sent, and for no longer than 36 months, unless the law requires us to keep them longer. Those are the records we can look up, correct or delete for you. Contact us and tell us enough about what you sent for us to find it. We have no identifier to search on, so without that description we usually cannot find a submission.

Everything else is kept by the company that receives it, under its own policy and for its own period:

• the advertising identifier and ad data, by Google;
• the installation code and the performance and error reports, by Expo;
• request logs, by GitHub and Tally.

We cannot delete those records for you, and we do not set how long they are kept.

Settings you change in the app, such as text size, color scheme and plain language, are stored in the app’s own storage on your phone. They are not sent to anyone, with two exceptions: your display settings and map layer are among the feedback details above when you send feedback with that switch on, and your “Personalized ads” choice is applied to every ad request Google receives. Deleting the app removes them from the device, with the same caveat as the installation code: your phone’s backup may carry them to a restored device.

Subject to the law that applies to you, you may ask us:

• to tell you what we hold about you;
• to correct it or delete it;
• to object to or restrict how we use it;
• to withdraw a consent you have given.

You may also complain to your data protection authority. To exercise any of these, contact us using the details below. We will act on them to the extent the records described above allow.

Where the app is offered. Where I Stand is offered only in the United States and its territories, through the App Store and Google Play there.

For residents of US states with privacy laws. This part applies to residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Iowa, Maryland, Utah and Virginia, and to residents of any other state whose law gives similar rights.

In the last twelve months, the app’s software has collected the following categories of personal information, as those laws define them:

• identifiers: the advertising identifier, the installation code and your IP address;
• internet or other electronic network activity: interactions with ads, and the performance measurements described above;
• approximate geolocation: inferred by Google from your IP address, not read from your device’s location.

We do not collect sensitive personal information, and we do not use personal information for profiling that produces legal or similarly significant effects.

The app shares the advertising identifier and ad-interaction data with Google for cross-context behavioral advertising (personalized ads). Some state laws call that “sharing” or “targeted advertising”, and some may treat it as a “sale”. We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16.

Your rights, depending on your state, are:

• to know and to access the personal information we hold about you, in a portable form where that is possible;
• to correct it;
• to delete it;
• to opt out of its sale or sharing, and of targeted advertising. Where it appears, “Ad privacy choices” in Settings opens Google’s form for this. The “Personalized ads” switch asks Google for non-personalized ads only; it does not stop the advertising identifier or ad data from reaching Google;
• not to be discriminated against for using any of these rights. The app works the same way whatever you ask.

The app does not detect opt-out preference signals such as Global Privacy Control, because phone operating systems do not currently send them to apps. Use the controls in Settings described above, or email us, and we will act on your request.

The only personal information we hold ourselves is described above: feedback and emailed diagnostics. Records kept by Google, Expo, GitHub and Tally are theirs to answer for, and each of them accepts requests directly.

How to make a request. Email us at the address below. We will confirm we received it within 10 business days. You may also use an authorized agent, and we may ask for proof that they act for you. Because we have no accounts, we verify a request by matching what you tell us about your feedback or email to what we hold. We will answer within 45 days, or tell you within that time if we need up to 45 more.

Appeals. If we decline your request, you may appeal by replying to our answer with “Appeal” in the subject line. We will respond to an appeal within 60 days, explaining what we did and why. If you are not satisfied, you may contact your state’s attorney general.

Children

Where I Stand is not directed at people under 18, and we do not knowingly collect personal information from anyone under 18. The app has no age check. So the automatic collection described on this page (the performance measurements, the error reports, the installation code and the ad requests) happens on every installation, whoever is using it. If you believe someone under 18 has sent us feedback or a diagnostic, contact us and we will delete it.

Security

We do not run a server for this app, so none of your data is held on infrastructure of ours. What the app sends goes directly to the companies named on this page and is held under their own security arrangements. Every connection the app makes itself is encrypted: to Expo, to GitHub and to the feedback form. We cannot say the same for Google’s advertising software, which opens its own connections from inside the app, or for the images a loaded ad fetches, whose addresses Google’s ad response chooses. No transmission over the internet can be guaranteed to be secure.

If there is a data breach

If records we hold (feedback, or diagnostics emailed to us) are exposed through a security incident, we will investigate and will notify the people affected, and the authorities, where the law requires it. Because we hold no contact details for people who have not written to us, we would notify by email where we have an address, and otherwise by a notice on our website. A breach at Google, Expo, GitHub or Tally is theirs to report under their own obligations.

Changes to this policy

We may change this policy. When we do, we will change the “Last updated” date at the top of this page. The app carries that date too. When the policy has changed since you last accepted it, the app shows you a notice. That notice follows the app’s copy of the date, so it may appear a little after this page is revised rather than at the same moment.

Contacting us