Porch Politics Privacy Policy

Effective August 30, 2026

This Privacy Policy explains how Porch Politics LLC ("Porch Politics," "we," "us," or "our") collects, uses, discloses, and retains information through the Porch Politics mobile apps, website, campaign tools, and related support and managed services (collectively, the "Services").

Porch Politics is a manual, peer-to-peer campaign texting and relational-organizing service. Volunteers join campaigns, choose the people they want to contact, and decide whether to send a message through their own device's SMS composer. A participating campaign may provide its own privacy notice for information it controls. This Policy governs Porch Politics' handling of information through the Services.

Information we collect and where it comes from

• Account and campaign information. We process the phone number a volunteer enters for one-time-passcode verification. Telnyx uses the number to deliver the code; Porch Politics stores a non-reversible phone signature rather than the raw login number. We also store campaign membership, invite use, commitments, consent events, preferences, and related timestamps. Campaign organizers may provide private-invite phone allowlists; Porch Politics normalizes those numbers transiently to derive non-reversible phone signatures and does not store raw allowlist phone numbers.
• Optional email and support information. A volunteer may add and verify an email address and separately enable campaign-request emails. We store the address, verification state, a short-lived hashed verification token, and delivery state. A campaign-request email is sent only after the address is verified and the volunteer explicitly enables email invitations for that campaign. If someone submits a public “Talk with us” form, we store the submitted email address, form source, submission and confirmation timestamps, a short-lived hashed confirmation token, and a repeat-submission count. Support requests include the information the requester chooses to provide.
• Contacts a volunteer selects. Porch Politics never scans the full address book, never chooses who a volunteer texts, and never uses selected contacts to message or market to anyone. After a volunteer explicitly selects or manually enters a person, the reviewed contact card may include names, multiple phone numbers, email addresses, and postal addresses. The app encrypts that card inside a sealed envelope for the campaign vault before upload. The Porch Politics app and Cloudflare service do not open those envelopes. The app separately keeps the reviewed card in device-protected encrypted storage so the selected list can survive an app restart.
• Porch Butterfly Standing Circles. A member may independently choose 10 to 30 people they would personally be willing to text if they later accept a request. Names, contact labels, phone numbers, and contact cards remain in device-protected storage. The device sends only blinded values to a private evaluator and stores with Porch a campaign-independent opaque reach token, the member’s revocable edge and consent state, and renewal and expiry times. Butterfly invitations and mutual account linking are not active features. An edge is a statement of the member’s willingness to be asked; it is not evidence that the selected person supports a campaign or has agreed to receive a message.
• Outreach and conversation activity. We process commitments, selected-contact signatures and privacy tokens, message drafts and bodies, message-completeness results, app send-action status, do-not-contact suppression rows and reasons, and timestamps. We do not read a volunteer's SMS inbox and do not receive carrier delivery confirmation. A volunteer may submit campaign questionnaire answers, an optional campaign note, and follow-up state; those answers may concern political or civic views. Volunteers are told not to put identity or contact details in free text.
• Campaign chat and notifications. We store organizer and volunteer chat messages, reports, blocks, read state, notification preferences, APNs or FCM device tokens, opaque routing identifiers, and push delivery attempts for campaign coordination and opted-in alerts.
• Device, security, and operational information. Cloudflare and Porch Politics process ordinary request metadata, such as IP address, request time, route, browser or app information, error state, rate-limit state, and security audit events. Protected mobile requests use request-bound Apple App Attest or Google Play Integrity material. Provider tokens are processed transiently and are not written to the primary app database or application logs; the verifier may retain a non-reversible key identifier, public key, integrity result, and counter needed to prevent replay.
• Website and form activity. Cloudflare processes ordinary request signals to deliver and protect the site. Cloudflare Turnstile processes browser-verification signals to prevent automated form submissions.
• Information from campaigns and official or licensed sources. Campaigns provide campaign identity, disclosures, invitations, message guidance, questions, organizer content, and authorized-user information. The consent-bound voter-reconciliation process may use licensed voter records and official election-participation snapshots. Porch Politics does not infer or disclose ballot choice.
• Butterfly activation artifacts. For a separately authorized campaign activation, the private voter warehouse may compare the campaign’s scoped constituency universe with opaque Butterfly reach tokens and send Porch a signed, expiring eligibility artifact. Porch stores the activation, artifact digest, opaque target and reach references, route state, and a minimal cadence and suppression ledger. Porch does not treat voter registration, party registration, turnout, social activity, or merely knowing a member as proof that someone supports a campaign.

How we use information

We use information to authenticate users; provide campaign invitations, Porch Butterfly Standing Circles, commitments, manual texting workflows, chat, alerts, and support; preserve a volunteer's selected list on the device; perform consent-bound contact restoration, voter-record reconciliation, campaign-scoped relationship analysis (sometimes called social graphing), coverage analysis, and official election-participation intelligence; select an available human relationship route for a separately authorized activation; return aggregate progress and privacy-bounded conversation feedback; enforce consent, cadence, cooldown, and suppression choices; secure, debug, and improve the Services; prevent fraud and abuse; communicate about the Services; and comply with law and enforce our agreements.

Porch Butterfly boundaries

Porch Butterfly is campaign-independent until a member separately joins or opts into a campaign activation. A standing edge never causes an automatic message or campaign enrollment. For an authorized activation, Porch offers at most one expiring route for an opaque reach handle to an eligible member whose edge is active and whose cadence state permits contact. The member still decides whether to accept. Accepting a route does not authorize outreach or open the SMS composer; a separately verified, campaign-scoped contact claim for the same device-held contact is required first.

The campaign receives aggregate eligibility, route, and completion totals. It does not receive a member’s Standing Circle, the selected person’s identity or contact record, the opaque reach token, the member-to-person edge, or a reusable voter-to-network lookup. Supporter status, when an activation requires it, must come from authorized first-party evidence and exists only inside the expiring activation artifact.

Selected-contact processing and campaign boundaries

An authorized private voter warehouse may decrypt a consent-bound contact packet, retain its contact evidence within the applicable data-use scope, reconcile it to licensed voter records, and return a signed campaign-scoped match and official-participation artifact. It starts with the name and phone information already in the selected card; a postal address is not required. When several records remain plausible, the service may return no more than five signed candidate names and addresses to the selecting volunteer for review. Campaign organizers cannot retrieve those choices, and a fuzzy name or area-code signal never confirms identity by itself. A result that says an official record is “not recorded” means only that the named official snapshot contains no participation record; it does not prove that a person did not vote. Porch Politics does not infer or disclose ballot choice.

Campaign organizers receive task-completion notifications and aggregate participation and completion totals. They may also receive a volunteer's structured conversation answers, optional campaign note, and follow-up state as privacy-bounded feedback. Porch Politics does not attach the selected contact's name, phone number, email address, postal address, contact card, contact signature, POPRF token, outreach ID, or volunteer ID to that feedback. Processing a selected contact does not authorize a campaign to download or receive that person's contact record or a person-level outreach list.

How we disclose information

• Campaigns and authorized users. We disclose only the campaign-facing information described above, plus chat content to the participants authorized for the applicable thread.
• Service providers. Cloudflare provides Workers, D1, KV, R2, Turnstile, Email Service, network delivery, and security services. Telnyx provides phone verification. Apple provides App Attest and APNs. Google provides Play Integrity and Firebase Cloud Messaging. The authorized private voter warehouse performs consent-bound reconciliation. These providers receive only the information needed for their functions. We require providers handling user data for us to protect it consistently with this Policy and applicable law and to use it only for the contracted service.
• Legal, safety, and integrity. We may disclose information when reasonably necessary to comply with law or lawful process, protect rights or safety, investigate fraud or misuse, or establish, exercise, or defend legal claims.
• Business changes. Information may be transferred as part of a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and continued protection.

Porch Politics does not sell personal information, share it for cross-context behavioral advertising, or use selected contacts for advertising or unrelated marketing.

Infrastructure

Porch Politics uses Cloudflare Workers, D1, KV, R2, Turnstile, and Email Service for app backend/storage, public-form abuse prevention, email verification, and opted-in campaign-request messages. Telnyx is used for phone OTP. Apple App Attest and Google Play Integrity provide mobile app/device-integrity signals for fraud prevention. Opted-in iPhone alerts use Apple APNs; opted-in Android alerts use Google Firebase Cloud Messaging. Google processes the FCM registration token, notification title and body, and opaque campaign or request routing identifiers to deliver those Android alerts. The service-account credential remains an isolated Worker secret and is never embedded in the app.

Manual SMS

Porch Politics opens the native SMS composer. The volunteer chooses the recipient, reviews or edits the message, and decides whether to send it. Porch Politics records app action status but does not read SMS replies or claim carrier delivery.

Information we do not request from the device

The app does not request device location, financial information, government identification, health information, audio, files, calendars, or advertising identifiers. Camera access, when enabled, is used on device to scan an invite QR code; Porch Politics does not save or upload camera images. The decoded invite text is used to open the selected campaign invite.

Retention and deletion

We retain information only for the period reasonably necessary for the purposes described in this Policy, the applicable campaign retention setting or agreement, security and dispute prevention, and legal obligations. Raw OTP and private-invite allowlist phone inputs are transient. Short-lived verification and rate-limit records expire or are deleted according to their operational purpose.

Porch Politics keeps a client-encrypted contact packet only while its campaign consent lease is active. Campaign completion, campaign departure, consent withdrawal, or account deletion removes the Worker's packet and current signed artifact. Signed artifacts expire and are bound to the packet digest, consent lease, source versions, and projection version. The private warehouse treats expired consent-leased cards as ineligible for active views. Aggregate or de-identified results may be retained when they no longer contain a contact card, account identifier, or reusable person-level lookup.

Porch Butterfly consent receipts and edges expire unless renewed. A member may pause or withdraw their Butterfly profile and may pause, resume with current consent, or revoke an individual edge. Butterfly invitations are not active. Closed route history is retained for a bounded operational period, and expired eligibility artifacts are removed after their bounded retention window. The protected cadence ledger may remain long enough to honor cooldown and do-not-contact choices without retaining a name, phone number, supporter label, or voter record.

Volunteers can delete their account in the app or start a web deletion request at https://porchpolitics.org/account-deletion. Account deletion removes volunteer-owned campaign data, campaign-request email, consent events, client-encrypted contact packets, signed registration artifacts, active claims, conversation feedback and answers, notification preferences, APNs and FCM device tokens and delivery attempts, chat reports filed by the volunteer, reports attached to volunteer-authored chat, chat blocks involving the volunteer, volunteer-authored chat where applicable, current KV session state, and volunteer-scoped rate-limit counters. We may retain a non-identifying deletion event and information required by law, to protect security, or to resolve a dispute. A public-form or support email can be removed by contacting us.

Your choices and privacy requests

• Use device settings to control Contacts, camera, and notification permissions. Revoking a device permission stops new access but does not by itself delete information already processed.
• Use campaign settings to disable campaign-request email, push alerts, or in-app organizer messages, and leave a campaign to end that campaign's active consent lease.
• Use Porch Butterfly controls to pause or withdraw a Standing Circle, pause or revoke an edge, pause or withdraw from an activation, decline a route, or record a do-not-contact outcome.
• Use the in-app deletion control or the external account-deletion page to delete a volunteer account.
• Contact us to request access, correction, or deletion of information associated with you, to withdraw consent where applicable, or to appeal a privacy-request decision. We may need to verify the requester's identity and authority. Rights vary by location and may be subject to legal exceptions.

Security

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information, including encrypted transport, device-protected storage, client encryption for selected-contact packets, access controls, scoped service bindings, audit events, and rate limits. No system is completely secure, and we cannot guarantee absolute security.

Children

The Services are not directed to children under 13, and we do not knowingly create accounts for or collect personal information directly from children under 13. Contact us if you believe a child under 13 has provided personal information through the Services.

Processing locations

Porch Politics is based in Louisiana. Information may be processed in the United States and other locations where our service providers operate, subject to the protections described in this Policy.

Changes to this Policy

We may update this Policy as the Services or legal requirements change. We will post the revised Policy with a new effective date and provide additional notice when a change is material or consent is required by law.

Contact us

Privacy and support requests may also be started at https://porchpolitics.org/support. See the Porch Politics Terms of Service for the contact-processing terms that govern use of the Services.