Your voice belongs to you.

CivicVoice helps you prepare personal correspondence to elected officials. It has no separate user accounts, advertising trackers, or database of political beliefs.

What stays on your device

Your message and selection stay in browser memory while you work, except when you request AI assistance, email review, or submission as described below. Choosing Save draft stores the subject, message, signature, and template settings in this browser’s local storage. Clear draft removes that saved draft and clears the editor. Theme preference is also stored locally. Recipient selections and your location are not included in persistent saved drafts. People with access to your browser profile may be able to read saved drafts.

If you choose Connect, CivicVoice temporarily keeps your unsaved message and selected offices in this tab’s session storage so they survive sign-in. The workspace discloses this before connecting. The temporary copy is removed on return; copies older than ten minutes are discarded when the workspace is next opened. Closing the tab removes this storage. No access tokens are stored in the browser, and this action does not create a persistent saved draft.

Texas map

The Texas pilot checks a user-supplied residential pin or coordinates against official district geometry in your browser. Manual coordinate fields are not submitted to CivicVoice’s API. If you enable the optional Texas street map, the visible map extent goes directly to the Texas Legislative Council map server and can reveal your location. That layer is off by default and turns off when the map closes. Location fields clear when the map closes and are excluded from saved drafts and sign-in storage. Static map-file requests reveal an approximate half-degree area to the hosting provider and may appear in infrastructure logs. Highway overlays are for orientation only. No GPS permission is requested.

If you choose Search address, CivicVoice sends your street, city and ZIP to Texas’s official Who Represents Me address service by default, or to the U.S. Census Bureau if you choose that alternative. This optional transfer is disclosed beside the Search button; typing alone sends nothing. CivicVoice does not log, cache or persist the address or returned location. The chosen service receives your address in a request URL and may retain infrastructure logs under its own policies. Texas ZIP fallbacks are rejected. Full Texas matches must agree with our district polygons and saved district-office names before selection. This is not a guarantee of rooftop accuracy or legal residence. Census supplies street-range estimates without that live Texas cross-check. No upstream email addresses are imported. Closing clears results and coordinates. Following the official lookup link leaves CivicVoice; see the Texas privacy policy.

Optional AI writing assistance

Clicking a writing action sends the selected passage (or the message body, up to 4,000 characters) and your chosen action to CivicVoice and Cloudflare Workers AI. Subject, separate signature, address field and recipient list are excluded. Personal details inside the passage are included, so remove anything you do not want processed. The sample button sends only its built-in example. Typing alone does not request AI processing.

Revisions stream back for your review and change the editor only when you choose Apply revision. CivicVoice does not store or log the AI passage or response. Cloudflare states that Workers AI content is not used for training and standard inference has zero data retention, subject to its documented exceptions. See Cloudflare’s data policy. A daily usage counter contains only a date and reserved usage; it contains no correspondence. AI can make mistakes: check facts, wording and meaning before use.

Connecting an email account

If configured, Google or Microsoft authenticates you directly. CivicVoice never asks for your email password. It requests permission to send mail and to identify the account: Google’s email identity permission and Gmail send permission, or Microsoft’s delegated User.Read and Mail.Send permissions. It does not request permission to read your inbox.

An HttpOnly session cookie identifies a session lasting up to one hour. Access tokens and the connected email identity are encrypted in short-lived server storage, expire within one hour, and are deleted on disconnection or session cleanup. No refresh tokens are retained. Disconnect deletes local authorization immediately and attempts Google token revocation. For Microsoft, remove the app’s consent in your Microsoft account settings to revoke provider-side access. Closing the tab does not revoke consent.

When you submit a message

For email submission, email content and selected email recipients are transmitted to CivicVoice’s server when you request final email review or confirm sending. Optional AI assistance separately transmits the passage you ask it to revise, as described above. The server renders the message for review and sends each confirmed message through your authenticated account’s provider API. It does not persist subjects, message bodies, or recipient lists. Short-lived keyed fingerprints and submission statuses prevent duplicate submissions during the session. These records expire with the session. Your email provider retains messages under its own policies.

Official contact pages

Opening an official contact page leaves CivicVoice. You decide what information to provide and submit it manually under that office’s privacy policy. CivicVoice does not automate these submissions, and does not verify that you completed them. Clipboard buttons copy text to your system clipboard.

Operational data

Cloudflare and the email providers process connection information to operate their services. CivicVoice temporarily stores keyed hashes of network addresses for rate limiting, for at most one hour. Application code does not log addresses, message content, OAuth codes, or tokens. Hosting providers may retain infrastructure logs according to operator settings; production operators must disable request-body logging and redact OAuth query strings. No data is used for advertising or political profiling.

Control and limitations

You can clear drafts, disconnect your account, remove provider consent, and clear site cookies at any time. Clearing a session cookie alone does not immediately delete server records; expiry removes them within one hour. Provider acceptance means only that a submission was accepted, not that an office received or read it. Directory snapshots show verification dates and warnings when stale. A template expresses its author’s viewpoint; you can replace it with your own.

For help, use How it works in the workspace. The operator should provide a monitored privacy contact before public launch and maintain this policy when data practices change.