Open Civic Systems — Legal Document
| Organization | Open Civic Systems (OCS) — 501(c)(3) nonprofit |
| Platform | Factkeeper (factkeeper.org) |
| Version | 1.0 |
| Effective Date | [January 2026] |
| Last Reviewed | [January 2026] |
| Approved By | OCS Board of Directors |
The short version:
| Topic | What You Need to Know |
|---|---|
| Anonymous submissions | We can't identify you. Your IP is hashed immediately (irreversibly) and deleted in 30 days. We don't ask for your name or email. |
| Registered users | Chronicle Admins see your full info (name, email). The public only sees your display name — which you control — if your Chronicle enables attribution. |
| Your display name | You choose it. Use a pseudonym, your real name, or "Anonymous." |
| Multi-Chronicle privacy | Separate account per Chronicle. Your activity in one Chronicle isn't visible to admins of other Chronicles. |
| We don't sell data | No advertising. No third-party tracking cookies. No Google Analytics. |
| Logs are minimal | Masked IPs kept 30 days for analytics. Full IPs only captured on errors, deleted in 48 hours. |
| AI features | Optional. Document content goes to AI providers; your personal info does not. |
| Account deletion | Your personal info gets deleted. Your contributions remain part of the historical record (anonymized). |
| Content is permanent | Chronicle Content is archived for historical preservation. That's the point. |
Read the full policy below for complete details, legal disclosures, and your rights.
Open Civic Systems ("OCS," "we," "us," or "our") operates Factkeeper (factkeeper.org), a platform for community-managed historical archives ("Chronicles"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.
We believe in radical transparency about data collection. This policy tells you exactly what we collect, why, and how long we keep it.
By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
We collect different information depending on how you interact with the Service.
When you submit an event through the public submission form, we collect minimal information and protect your anonymity:
| Data Type | How Stored | Retention | Purpose |
|---|---|---|---|
| Submission content | Plaintext in database | Indefinite (if processed into Chronicle) | The event information you're reporting |
| IP address | Salted and hashed (SHA-256, practically irreversible) | 30 days maximum | Spam prevention only |
| User agent | Salted and hashed (SHA-256, practically irreversible) | 30 days maximum | Spam prevention only |
| Submission timestamp | Timestamp | Indefinite | Record keeping |
| Tracking ID | Random string | Indefinite | So you can check submission status |
What we do NOT collect from anonymous submissions:
Your tracking ID (like "CS1729845abc") is a random string that contains no identifying information. It's provided so you can check your submission's status, not to identify you.
When a Chronicle Administrator creates an account for you (as a reviewer, curator, or administrator), we collect:
| Data Type | Required | Who Can See It |
|---|---|---|
| Email address | Yes | Chronicle Admin, OCS |
| First name | Yes | Chronicle Admin, OCS |
| Last name | Yes | Chronicle Admin, OCS |
| Username (login) | Yes | Chronicle Admin, OCS |
| Public display name | Yes (user-controlled) | Depends on Chronicle settings (see Section 4) |
| Password | Yes (hashed) | No one (stored as irreversible hash) |
Your public display name is controlled by you. You may use:
Multi-Chronicle accounts: If you participate in multiple Chronicles, you will have a separate account for each. Your activity in one Chronicle is not automatically visible to administrators of other Chronicles.
When you access the Service, our servers automatically collect:
| Data Type | How Stored | Retention | Purpose |
|---|---|---|---|
| IP address (access logs) | Masked (e.g., 12.34.56.0) |
30 days | Analytics, service operation |
| IP address (security logs) | Full IP, only on errors/blocked requests | 48 hours | Immediate threat response |
| Pages visited | Log files | 30 days | Analytics |
| Browser type | Log files | 30 days | Service optimization |
| Timestamp | Log files | 30 days | Analytics |
Cookies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
session_id |
Essential | Maintains your login session | Session |
csrf_token |
Essential | Security (prevents cross-site request forgery) | Session |
preferences |
Functional | Stores your display preferences | 1 year |
We do NOT use third-party tracking cookies, advertising cookies, or analytics services like Google Analytics.
We will never sell your information or use it for advertising.
Your public display name may be visible to the public if your Chronicle enables contributor attribution. This is controlled by:
If your Chronicle displays attribution, the public may see:
The public will NOT see your real name, email, username, or other account details (unless you choose to make your public display name match your real name).
Other registered users in your Chronicle may see:
If we implement collaboration features (such as discussion pages), Chronicle users may see your public display name in those contexts as well.
Chronicle Administrators can see all information about users in their Chronicle:
This visibility is necessary for Chronicle Administrators to manage their teams and maintain accountability.
OCS staff can access all information across all Chronicles when necessary for:
OCS does not routinely monitor individual user activity but may access records when required.
We share information with service providers who help us operate the Service:
| Provider Type | Purpose | Data Shared |
|---|---|---|
| Cloud hosting (AWS) | Infrastructure | All data (encrypted in transit and at rest) |
| Email service | Account notifications | Email address, name |
| AI providers | Document analysis (when you use AI features) | Document content only (not personal info) |
Service providers are contractually required to protect your information and use it only for the services they provide to us.
We may disclose information if required by law or if we believe in good faith that disclosure is necessary to:
For anonymous submissions: Because we hash IP addresses immediately and irreversibly, we cannot identify anonymous submitters even if legally compelled to do so. We do not have that information.
We take special care to protect the anonymity of people who submit events through our public submission form. This section explains our technical and operational protections.
We cannot identify you from a submission, even if legally compelled. The one-way hash means there is no mathematical way to recover your IP address from what we store.
Your tracking ID is a random string — it contains no information about you and cannot be used to identify you.
While we cannot identify you, others might be able to:
If you're submitting sensitive information:
We welcome submissions via Tor and will never block Tor users.
If you're submitting information that could put you at legal or professional risk, please take extra precautions. Consider consulting with a lawyer or press freedom organization. For highly sensitive material, dedicated platforms like SecureDrop may be more appropriate.
When you use AI-powered document analysis:
We utilize enterprise/API settings that are designed to prevent your data from being used for model training, subject to the provider's terms.
Refer to each provider's privacy policy for their specific practices.
| Log Type | Retention |
|---|---|
| Access logs (masked IPs) | 30 days |
| Security logs (full IPs on errors only) | 48 hours |
| Hashed submission data (IP, user agent) | 30 days |
Chronicle Content (events, sources, people records) is retained as part of the historical record, potentially indefinitely. This is fundamental to the archival purpose of the Service.
Backup copies may retain deleted data for up to 90 days.
You may:
You may:
You may request deletion of your account at any time by contacting your Chronicle Administrator or emailing privacy@opencivicsystems.org.
Upon deletion:
Anonymous submissions contain no personal information to access, correct, or delete. Your tracking ID cannot be used to remove submissions that have been processed into Chronicle Content.
Registered users may:
You cannot opt out of essential service communications (security alerts, legal notices, account-related messages).
Most browsers allow you to refuse cookies or alert you when cookies are being sent. Note that if you disable essential cookies, you may not be able to log in or use certain features.
We implement reasonable security measures including:
No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
In the event of a data breach affecting your personal information, we will notify you as required by applicable law, typically within 72 hours of discovery.
The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it promptly.
If you believe a child under 16 has been given an account, please contact us at privacy@opencivicsystems.org.
The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.
If you are located in the European Union or European Economic Area:
To exercise your GDPR rights, contact privacy@opencivicsystems.org.
If you are a California resident:
To exercise your CCPA rights, contact privacy@opencivicsystems.org.
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Your continued use after changes take effect constitutes acceptance of the updated policy.
For questions, concerns, or requests regarding this Privacy Policy or your personal information:
Open Civic Systems Email: privacy@opencivicsystems.org Website: opencivicsystems.org
For general support: Email: support@opencivicsystems.org
| Data Type | How Stored | Retention | Can Identify You? |
|---|---|---|---|
| Submission content | Plaintext | Indefinite | Only if you include identifying details |
| IP address | SHA-256 hash | 30 days max | No |
| User agent | SHA-256 hash | 30 days max | No |
| Timestamp | Plaintext | Indefinite | No |
| Tracking ID | Random string | Indefinite | No |
| Data Type | How Stored | Retention | Who Sees It |
|---|---|---|---|
| Encrypted at rest | Life of account | Chronicle Admin, OCS | |
| Real name | Encrypted at rest | Life of account | Chronicle Admin, OCS |
| Username | Plaintext | Life of account | Chronicle Admin, OCS |
| Public display name | Plaintext | Life of account | Potentially public (Chronicle setting) |
| Password | Bcrypt hash | Life of account | No one |
| Contribution history | Plaintext | Indefinite | Chronicle Admin, OCS; public if Chronicle enables |
| Data Type | How Stored | Retention | Purpose |
|---|---|---|---|
| IP (access logs) | Masked | 30 days | Analytics |
| IP (security logs) | Full (errors only) | 48 hours | Threat response |
| Pages visited | Log files | 30 days | Analytics |
| Browser type | Log files | 30 days | Optimization |
| Version | Date | Summary of Changes |
|---|---|---|
| 1.0 | [January 2026] | Initial adoption |
Effective Date: [January 2026]