SAVtracker is a public-record accountability tool. We collect the minimum personal information needed to mail or email a constituent letter on your behalf, and we delete it on a schedule. This page tells you exactly what, why, and for how long.
When you use the paid Contact Congress flow, we collect:
We do not collect credit card numbers — all payment is handled by Stripe; we only store the Stripe session ID.
If you join the AI phone-call waitlist, we collect your email address only.
Legal basis: performance of the service you asked us to provide (sending your letter) plus our legitimate interest in keeping an aggregate, anonymized record of how many letters were sent to which member of Congress.
We share the minimum necessary with three processors. Each has its own privacy policy linked below.
| Vendor | What they receive | Policy |
|---|---|---|
| Stripe | Email (to pre-fill checkout); payment details you enter on their hosted page. SAVtracker never sees card numbers. | stripe.com/privacy |
| Lob (physical mail) | Your name and return address; the destination office address; the printed letter contents. | lob.com/legal/privacy-policy |
| Resend (email) | Your name and email (as reply-to and receipt recipient); destination office email; the letter contents. | resend.com/legal/privacy-policy |
We do not sell your data. We do not run advertising trackers. We do not use your data to train any model.
| Data | Retention |
|---|---|
| Your name, email, return address, letter snapshot | 180 days from the send, then automatically nulled. |
| One-way hash of your email (for aggregate counts), member ID, channel, timestamps, send status, Stripe session ID | Indefinite. These columns are needed for the public "letters sent" counter and for audit. Email hashes and payment identifiers are pseudonymous, not anonymous; they may still be linked to an identity and are restricted internal records. |
| Phone-call waitlist email | 365 days from signup, then the row is deleted entirely. |
You can ask us to delete sooner — see below.
This first-party feature is currently disabled. When disabled, we do not store campaign attribution in your browser or add purchases to this optional measurement ledger.
When enabled after privacy review, we store only a broad approved campaign label (generic search, broad social, newsletter, podcast or partner) in tab-session storage and associate it with a checkout. We do not capture raw UTM values, referrers, political preferences or free text in this feature. Do Not Track and Global Privacy Control disable and clear this optional browser attribution. Storage restrictions or early checkout can leave a purchase unattributed. No advertising pixel or browser purchase event is used.
The optional server ledger records verified live payments and refunds, including unattributed purchases. It reuses an internal normalized-email hash to distinguish observed first and repeat payers; this is pseudonymous, not anonymous or proof of a unique person. Payment identifiers remain internal. This feature does not send these identifiers or hashes to advertising platforms. Existing payment providers and hosting analytics remain separate.
Campaign records, ledger payment identifiers and additional deduplication hashes are deleted by the existing retention job after 180 days. Verified deletion requests also remove associated optional measurement records. This limits historical reporting and first-time accuracy; it does not change the operational records retained as described above. Browser campaign labels expire with the tab session. This notice and storage mechanism are not themselves consent to advertising tracking.
This service is operated in and targeted at the United States.
Enter the email you used at checkout. We will send a confirmation link to that address; clicking it permanently nulls the personal information on every letter you sent and deletes any waitlist signup. Aggregate counts (which member, when, status) are kept — they no longer contain anything that identifies you.
Privacy questions: privacy@stockactviolations.com.
This policy is also published as PRIVACY.md in the source tree. When the policy materially changes, the version string at the top of this page changes and we record the new version against any new consents.
← Back to the Loserboard