Privacy

Keep Waterloo Waterloo · last updated 8 September 2026

The app has no accounts, no advertising, no analytics and no tracking of any kind. The only time it knows who you are is when you fill in one of the campaign's forms — to ask for a yard sign, to volunteer, or to send Andrew a message — and then it knows only what you typed. The record, the search and the assistant never ask.

The archive works without sending anything

Every document, the search index, the meeting calendar and the department directory are stored inside the app when you install it. Browsing and searching the record happen entirely on your phone and send nothing anywhere. The app works with no signal at all.

Four things do leave your phone

Only when you choose them:

• Questions you ask the assistant. The text of your question and the ID numbers of the documents on screen are sent to our answering service so it can produce an answer.
• An address you type into the voter eligibility check. It is forwarded to the United States Census geocoder, which reports only whether the address falls inside the village limits.
• Document summaries. A request carrying only the document's ID number.
• A campaign form you send. Your name, how to reach you and what the form is for — a yard sign, volunteering, or a message — go to the campaign. The next section says exactly what and where.

The campaign forms

Three forms on the campaign's screens ask who you are, because they cannot do their job otherwise: a yard sign has to be delivered somewhere, a volunteer has to be reached, and a message needs a reply. Each form says where your details go before you send it. Nothing on the record side of the app ever sees them.

What is sent: your name; your email address and, if you give it, your phone number (email is optional on the message form); for a yard sign, the street address where the sign should go; for volunteering, the kinds of help you picked; and anything you wrote in the message box.

Where it goes. Two places, and only these two:

• Andrew's inbox, as an email delivered by Postmark. Your email address is set as the reply-to, so a reply from the inbox reaches you without anything being re-typed.
• The campaign's lists at EZ Politix, the campaign-software company Andrew owns, so a yard-sign request lands in the campaign's yard-sign list, a volunteer in its volunteer list, and a message in its submissions — next to the ones the campaign's own website collects.

What it is used for. Delivering the sign, getting in touch about helping, or answering your message — and nothing else. It is not sold, not shared beyond the two recipients above, and not used for advertising.

What the service keeps. The service that carries the form from your phone to those two places stores nothing from it — not the name, the address or the message. It keeps a count of forms from your network address for the past hour, as a salted hash (see Limiting abuse), and a line in its log saying that a form of that type arrived and whether it was delivered. The email and the list entry are the campaign's copies, and they are deleted when you ask.

Keeping scripts out. The form carries a hidden field that a person never sees and a script fills in; a submission with anything in it is discarded. Beyond that there are the rate caps described below. There is no other checking of what you send.

To have it removed, write to andrewnorthwall@gmail.com, say which form you sent and roughly when, and the email and the list entry will be deleted.

What is kept, and for how long

Questions are kept for 90 days, without anything identifying who asked. We store the text of the question, the documents it was asked against, how long the answer took and what it cost. We do not store your IP address, a cookie, a device identifier, or any account alongside it — there is no key that could link a question back to a person, including for us. We keep them to see what residents want to know and to improve the assistant's answers.

Addresses are never stored. The address you type transits our service to the Census geocoder and is discarded once the answer is returned. It is not written to any log or database.

Document summaries are cached indefinitely and contain no information about you — a passed resolution does not change, so each document is summarised once for everyone.

Campaign forms are not stored by the service. The campaign keeps them — as an email in Andrew's inbox and an entry in its lists, as described above — and deletes them when you ask.

Limiting abuse

The assistant costs money to run and a form reaches a person, so both are rate limited. To count requests without identifying anyone, your IP address is converted to an irreversible salted hash and only that hash is stored, as a counter. The address itself is not written down, and the hash cannot be turned back into it. The assistant's counters reset daily; a form's counter covers the past hour, and there is a ceiling on how many forms the service accepts from everyone in a day.

Who else sees this

Answers are produced by a third-party language model provider, which receives the question text and the document excerpts in order to answer. Cloudflare and Microsoft Azure carry and host the service. The Census geocoder receives an address only when you use the eligibility check. When you send a campaign form, Postmark delivers the email and EZ Politix holds the campaign's lists; each receives what you typed into the form and nothing else. Nothing is sold, and nothing is shared for advertising — there is no advertising in the app.

Notifications

The app asks once, on first open, whether it may send notifications, and says before it asks what they are: Village alerts and meeting agendas, and updates from the campaign. If you allow them, your phone gives the app a notification token, and the app sends that token and the topics you have switched on to our service. That is all it stores about your phone: no name, no address, no account, and nothing connecting the token to any question you ask. It is used only to send the notifications you chose.

Every topic is its own switch on the Notifications screen, and campaign updates are separate from Village alerts: turning one on never turns on the other, and a campaign notification always names the campaign committee in its title. Turning every topic off deletes the token from our service. So does uninstalling the app, once the phone's platform reports the token dead. Notifications are delivered through Apple and Google's notification services, which receive the token and the message text.

Children

The app is rated 17+ on the App Store and Google Play. It is intended for adults and is not directed at children.

Who publishes this app

The app is published by EZ Politix LLC and sponsored by Andrew Northwall, a candidate for the Waterloo Board of Trustees. That sponsorship is disclosed on every screen. The app is independent. It is not affiliated with, endorsed by, or operated by the Village of Waterloo, Nebraska. It indexes documents the Village publishes and links to the originals.

Requests and contact

Because questions are stored without any identifier, we cannot locate or delete an individual person's questions — there is nothing connecting them to you. Every stored question is deleted automatically after 90 days. A campaign form is different: it carries your name, so it can be found and removed — write and say which form you sent and roughly when. For that and anything else, the address is andrewnorthwall@gmail.com.