1. Who we are
The Records Project is an independent, unincorporated records-accountability project based in Boston, Massachusetts, directed by Brian McCarter. In this policy, "we," "us," and "the Project" mean The Records Project. For any privacy question, write to [email protected].
2. What we collect
We collect personal information in two ways, and only these two.
What you give us. When you submit the question form on the Ask page, we receive your name, your email address, your affiliation if you choose to provide it, the text of your question, and any deadline you note. The affiliation and deadline fields are optional; the rest are required so we can reply.
What your browser sends automatically. When the form is submitted, our host records the IP address the request came from, the country that address resolves to, your browser's user-agent string, and the page that referred you. We use this only to prevent spam and abuse of the form.
We do not run advertising or analytics trackers, build profiles, or buy personal information about you from anyone.
3. Why we collect it
To answer your question and reply to you by email, and to keep the form usable by screening automated abuse. That is the entire purpose. If we ever want to publish your question and our answer so other people benefit from it, we ask your permission first.
4. Legal basis, for visitors in the EU or UK
If you are in the European Union or the United Kingdom, we process your submission on the basis of your consent in sending it, and on our legitimate interest in answering questions and protecting the service from abuse. You can withdraw consent at any time by asking us to delete your submission (see section 8).
5. How long we keep it
Each submission is stored for two years and then deleted automatically. A copy also reaches us as an email notification, which lives in our inbox under ordinary email retention; ask us and we will delete that too. We keep nothing longer than we need to answer you and maintain a basic record of correspondence.
6. Who we share it with
We do not sell, rent, or trade your personal information. We share it only with two service providers that operate the form on our behalf, and only to the extent they need to:
Cloudflare hosts this site and stores submissions. Resend delivers the email notification of your question to us. Both act as our processors and are bound to use the data only to provide their service. We may also disclose information if the law compels it, which for a project like this would be rare and which we would resist where we lawfully can.
7. Cookies, tracking, and Do Not Track
We do not set advertising or analytics cookies and we do not track you across other websites. Cloudflare may set strictly necessary cookies to keep the site secure and running. Because we do not track you in the first place, a browser "Do Not Track" signal does not change anything we do; we treat every visitor as not-tracked by default.
8. Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Write to [email protected] and we will act on the request, ordinarily within thirty days. We will not charge you or treat you differently for exercising these rights.
If you are a California resident, this is your right to know, delete, and correct under California law. We do not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of. If you are in the EU or UK, you also have the right to data portability, to object to processing, and to complain to your data protection authority.
9. Automated decisions
There are none. A person reads every question and writes every reply. We do not use automated decision-making or profiling that produces legal or similarly significant effects.
10. Children
This site is meant for journalists, researchers, and members of the public working with government records. It is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has sent us information, write to us and we will delete it.
11. Security
Submissions are transmitted over an encrypted connection and stored with our host. No method of transmission or storage is perfectly secure, but we keep the data we collect deliberately small to limit what is ever at risk.
12. Changes to this policy
If we change this policy in a way that matters, we will post the revised version here with a new effective date and note the change on the homepage for at least fourteen days. Continuing to use the site after a change means you accept the current policy.
13. Contact
Questions about this policy or your information: [email protected].