Privacy Policy

Introduction

This Privacy Policy explains how Collin's Software LLC, a Washington limited liability company doing business as "OlympiaTrack" ("OlympiaTrack," "we," "us"), collects, uses, shares, and protects information in connection with the OlympiaTrack service at olympiatrack.com (the "Service"). It should be read together with our Terms of Service.

This Policy covers personal information about you as a user of the Service, and about people who contact us through the Service or by email and people who receive email the Service sends at a user's direction (such as a scheduled report or an invitation). It does not cover the public legislative and public-record information the Service aggregates from governmental and third-party sources (bills, votes, committees, legislators, lobbying filings, elections, statutes, hearing sign-in records, city and county records, and public officials' disclosure filings). That information originates from public sources, is not information we collect about you, and is addressed in Section 6.

1. Who We Are

The Service is operated by Collin's Software LLC, a Washington limited liability company doing business as OlympiaTrack, located in Washington State. For privacy questions or to exercise your rights, contact us at support@olympiatrack.com (see Section 13).

2. Information We Collect

We collect the following categories of information:

2.1 Information you provide or that is created through your use

• Account and identity information. When you register, our identity provider (Auth0) collects and provides to us your email address, name, and a unique account identifier, and manages your login credentials. We store your email, name, and account identifier. Auth0 sends the emails that confirm your address and reset your password, and we record whether your email address has been confirmed. If you sign in through your organization's single sign-on, your organization's directory (for example, Microsoft Entra ID) supplies your name and email address, and we also record the sign-in connection you used and, where your directory provides it, its tenant identifier.
• Your Content. Information you create in the Service, including: bill lists and their names and descriptions; bills, rules, and local government matters you add to lists; notes you write about them; the keywords you write for a list to guide its AI suggestions; the position you record on a bill, rule, or matter (for example support, oppose, monitor, or neutral), and the position, priority, and action labels you create, including any you share with your organization; vote counts you build, on a bill or on an issue that has no bill yet, meaning the assessment you record of how an individual legislator is expected to vote, together with any note you attach to it; scorecards; reports you save, and who you share each one with; personal calendar events; testimony records; compliance-log entries you record for preparing a disclosure filing, including activity dates, descriptions, and expenditure amounts; team bill analyses, which members of your organization edit together, division analyses, personal analyses, and analysis templates, with their saved versions; assigned work: the item assigned, to whom and by whom, its directions, expected result, priority, and due date, and what is later recorded on it (its progress, what was submitted and any note with it, review notes, and reasons given for handing it back); the divisions of your organization and who sits in and leads each one; review marks on intro sheets; watches you set on bills, keywords, topics, committees, agencies, statutes, rules, cities, and counties; suggestions you dismiss; private notes you keep about a legislator, meaning entries you log against a named legislator recording a meeting, call, commitment, or observation, with a date and an optional follow-up date; your organization's branding, such as a logo you upload and an accent color; and notification, calendar-sync, sharing, and display preferences (including which dashboard tiles you show, how you arrange them, which kinds of events your calendar feed carries, whether AI suggestions, companion tracking, and rule tracking are enabled, whether you have turned AI features off for yourself, whether you receive email about assigned work, and whether your calendar feed carries its due dates).
• Reports, links, and invitations you send. If you schedule a report, we store the email addresses of the recipients you enter (who need not have an account), the report's settings, a record of each report sent, and a token for each recipient that lets them unsubscribe. If you save a list of recipients to reuse, we store its name and the addresses on it, and it is seen by you alone unless you share it with your organization. If you create a report link, we store the link, what the report includes, and how many times and when it was last opened. If you invite someone to your organization, we store the address you invite and a token for the invitation, and we email that person; an invitation expires after 14 days.
• Material you generate with AI features. The questions you ask the Service's AI assistant and the recent conversation context sent with them, documents you upload to be summarized, and the drafts the Service generates for you (such as draft testimony, position letters, talking points, and client memos), together with the inputs you supply to produce them. Drafts are stored so you can return to them, and older drafts for a given bill are automatically discarded. Documents you upload for summarization are not stored: they are processed to produce the summary and then discarded. If you rate an answer from the AI assistant, we store your rating together with the first 200 characters of the question it answered; ratings are read by us only and are never sent to the AI provider.
• Addresses you look up. If you use the legislative-district lookup, the address you type is sent to the geocoding services named in Section 5.3 to find its district. We keep the address and the district it matched in our server's memory for a short time so a repeated lookup is faster; we do not store it in our database, and we do not keep the map coordinates.
• Payment and trial information. If you start a free trial or purchase a subscription, our payment processor (Stripe) collects your payment details directly. We do not receive or store your full payment-card number. Because sales tax on this Service is calculated from where the buyer is, a billing address is required at checkout, including at the start of a free trial, and is used to compute the tax shown to you; Stripe collects it and stores it on your customer record with them. We store a customer identifier and subscription information returned to us by the processor: plan, status, renewal date, cancellation flag, the price and billing interval, when a free trial started and ends, and whether the first charge after a trial has been paid. To hold each payment card to one free trial, we store the card's fingerprint, a value Stripe derives from the card number that identifies the same card again without revealing its number, together with which organization's trial used it.
• Communications and feedback. If you use the in-app feedback form or the Support page, we receive what you send: your name, email address, organization, the kind of request, your message, any screenshot you attach, and the page you sent it from, and, if you are signed in, your account, organization, and plan. We do not store these messages in our database; they are delivered by email to the mailbox OlympiaTrack staff use for support, and email you send to support@olympiatrack.com is forwarded to a mailbox we use for support. If you use the Support page without signing in, a security check provided by Cloudflare (Turnstile) runs in your browser to tell people from automated abuse. If you ask for a new confirmation email without signing in, we receive the email address you type, and we limit how often that can be done from one address or network.

2.2 Information collected automatically

• Technical and log data. Like most web services, our infrastructure and hosting providers automatically process technical information such as IP address, browser and device type, and request/log data for security, debugging, rate limiting, and operation of the Service.
• Sign-in security records. When you use the Service while signed in, we record the IP address your requests come from and a random identifier your browser keeps for the Service (in its local storage, with a cookie as a fallback), with when we first and last saw each, to protect the Service and to suspend accounts that abuse it; the identifier is a random number we create, not a fingerprint of your device, clearing your browser's site data replaces it, and these records are deleted 13 months after we last saw them.
• Usage analytics. We record how the Service is used so that we can understand which features are useful and improve them. This includes the buttons and links you click and a label identifying them, the pages you visit and when, the width of your browser window, rounded to 10 pixels, and a periodic signal sent while a page is open and in active use, which lets us measure how long a page was actively used and when you were last active. We use the window width to find and fix pages that do not fit on a phone screen. These records are associated with your Account, and OlympiaTrack staff can review them for a single account: which pages it visited, how long it spent on each, which controls it used, and when. We record only a label for a control you press, never the value of anything you type. Controls that display something you created, such as the name of a list, are recorded under a generic label rather than that name; records made before that change are deleted under the 90-day retention in Section 9. We do not capture reading, scrolling, keystrokes, or screen recordings. We collect this ourselves, first-party: we do not use third-party analytics providers, advertising networks, or tracking cookies for it, and it is not shared with anyone outside the providers listed in Section 5.3.
• Diagnostic and error records. When something in the Service fails, we record what failed so that we can fix it without waiting for you to report it. This includes the error message and technical detail about where it happened, the address of the page or request involved (which can include what you typed into a search box on that page), and, where you were signed in at the time, your Account identifier. For errors that happen in your browser we also record the type of browser you were using. For a problem with signing in, single sign-on, or joining an organization, the record can also include your email address, its domain, the sign-in connection, and your directory's tenant identifier. These records are stored by us and sent by email to OlympiaTrack staff. They are used only to diagnose and fix problems with the Service.
• How you first found us. On your first visit, before you have an account, we record the hostname of the site that referred you (for example linkedin.com), any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), and the page you landed on. This is stored in your browser and attached to your Account if you later register, so we can understand which channels bring people to the Service. We record only the referring hostname, never the full referring address, because a referring web address can contain a search term you typed, which is yours and not ours. Only your first visit is recorded; later visits do not overwrite it.
• AI usage records. Some AI features have a daily limit per account, and AI use has a monthly limit per person. To enforce these limits and to account for what AI costs us, we keep a count of how many times you used those features each day, and a record of each AI request made for your account: the feature, the AI model, the amount of text processed, and its cost. These records do not include what you asked or what was generated.
• A record of alerts and notices sent to you. When we send you a digest, an alert, a notice about assigned work, a free-trial email, or a billing notice, we keep a short record of what it covered so the same message is not repeated and so you can see recent activity inside the Service. It is limited to your most recent activity and is trimmed automatically.
• Product updates you have seen. We record which product-update announcement you last saw, so the same one is not shown to you again.
• Automatically created records. Some features create records in your account on your behalf. For example, if you switch on companion tracking for a list, the Service adds the matching House or Senate bill to that list and marks it as having been added automatically, and if you switch on rule tracking for a list, it adds the agency rules that name a bill on that list. These are stored the same way as anything you add yourself, and you can remove them. If you leave your organization, work that was assigned to you by name stays with the organization, unassigned, with your name (or, if your account has none, your email address) recorded as the person it was assigned to.
• When you last opened a list. We record when you last opened each list, so the Service can show what changed on it since your last visit.
• Authentication tokens and a calendar-feed token. We use authentication tokens to keep you logged in, and, if you enable calendar sync, an opaque token embedded in your personal calendar-feed address so that your subscribed calendar application can retrieve your feed. Anyone who has that address can read everything the feed carries, including your personal events if you choose to include them; you choose which kinds of events it carries, and you can replace the address at any time. The feed also carries the due date of work assigned to you, naming the item, the division it was assigned to if any, and who assigned it, unless you turn that off or your organization has turned assigned work off.

2.3 Cookies and similar technologies

The Service and its providers (including Auth0 for authentication) use cookies and browser storage necessary to operate the Service, keep you signed in, and maintain security, and the Service uses browser storage for preferences you set. See Section 7.

2.4 What we do not collect

We do not collect, process, sell, or share consumer health data as that term is defined by Washington's My Health My Data Act (Chapter 19.373 RCW). The Service is not directed to collecting information about any individual's health status, and we do not attempt to infer it. Please do not record health information about yourself or others in notes or other free-text fields.

3. How We Use Information

We use the information above to:

• provide, operate, maintain, secure, and improve the Service and its features;
• authenticate you and manage your Account and your organization's membership, including placing you in your organization when you sign in through its single sign-on;
• create, store, and display Your Content and preferences;
• generate AI Output (see Section 4);
• send you the notifications, reminders, and calendar feeds you opt into, and transactional or service messages, including free-trial, billing, and renewal notices;
• send the scheduled reports and invitations you direct, and serve the report links you create;
• tell the people involved about work assigned within your organization, including work you assign to yourself: in the Service's activity feed at each step, and by email when work is assigned, submitted, or overdue, unless the recipient has turned those emails off, and never while your organization has turned assigned work off;
• process payments, manage subscriptions and free trials, enforce one free trial per organization, owner, and card, and comply with tax and accounting obligations;
• enforce usage limits and account for the cost of AI features;
• understand which channels bring users to the Service, and which features are used;
• respond to your feedback, requests, and support inquiries;
• monitor, prevent, and address security incidents, fraud, abuse, and violations of our Terms; and
• comply with legal obligations and enforce our agreements.

Some features generate AI Output. To do this, we transmit relevant information to our third-party AI provider (currently Anthropic) for processing. The AI provider processes this information to return generated output to us, which we may cache or store to avoid regenerating it. By using AI features, you consent to this processing. See the Terms of Service, Section 9, for the accuracy disclaimer, and note that factual assertions in AI-generated content should not be relied upon without independently checking their accuracy.

Training. We do not use Your Content to train artificial-intelligence models. Separately, our AI provider's published commercial terms state that by default it does not use inputs or outputs from its commercial products, including its API, to train its models. That second statement describes our provider's own terms rather than our conduct; those terms are theirs to change, and we will update this Policy if the position we rely on changes.

Retention by our AI provider. Our AI provider's published data-retention policy for its commercial API states that it automatically deletes inputs and outputs within 30 days of receiving or generating them, except where it keeps them longer to enforce its usage policy (up to 2 years for content its systems flag), to comply with law, or under another arrangement. Like the training statement, this describes our provider's policy rather than our conduct. What we ourselves keep is described in Section 9.

Human review. No person at OlympiaTrack reviews the content you send to AI features as a matter of routine. We may look at specific content if you ask us to for support, or where we must investigate abuse or a security incident.

How much of Your Content is transmitted depends on the feature:

• Bill summaries and impact ratings. Public Legislative Data only (the bill's text). These are generated once and shared across users; nothing of yours is sent.
• Rule summaries. The agency's published rulemaking filings. Nothing of yours is sent.
• Local government matter and ordinance summaries. The council's own published documents and record for that matter. Nothing of yours is sent.
• List and intro suggestions. Public Legislative Data plus your list names, the keywords you wrote for them, and a short profile of each list, so that bills can be matched to what a list tracks. The profile is itself written by the AI from the list's name, its keywords, and the numbers and summaries of the bills already on it, so those are sent too.
• Draft documents (draft testimony, position letters, talking points, client memos). Public Legislative Data for the bill, plus the context you have recorded about it, which may include your position on the bill, your notes, and any instructions you provide.
• Document summaries. The text of the document you upload, and its file name. The document is not retained by us after the summary is produced.
• The AI assistant ("Ask OlympiaTrack"). The question you type, up to three of your recent questions and their answers for continuity, which page you are asking from (for example, the bill or list you have open), and what the assistant looks up to answer. It looks up public information through the Service's own features and, when it looks up your lists (as it may when you ask about your bills or lists, and does when you ask from a list), the names of the lists you can open and the bills on them, including lists your colleagues share with you. A list is sent only while AI features are on for the person who created it. List names are often client names; if you would rather a client's name not be sent, do not ask the assistant about your lists. The assistant does not send your notes or the positions you record.

We do not transmit your email address, name, payment information, usage analytics, or acquisition data to the AI provider. We also never transmit the private notes you keep about a legislator: that content is not used by any AI feature.

Turning AI off. An organization's owner or an administrator can turn AI features off for the whole organization. An administrator, or the lead of a division or of the division above it, can turn them off for that division and the divisions under it; only an owner or administrator can turn a division's AI back on. Each person can also turn AI features off for themselves. The strictest setting wins: a person's AI features are on only when none of these is off. While a person's AI features are off, nothing of theirs is sent to the AI provider, a list is sent only while AI features are on for the person who created it, and no AI-written text is shown to that person, including summaries written earlier. Every change to any of these settings is recorded with who made it and when, and the organization's owner and administrators can see that record. The AI Use Statement explains all of this in plain language.

5. How We Share Information3 changed

We do not sell your personal information, and we do not share it for advertising. We share it only as described here.

5.1 Your organization

Every Account belongs to an organization; for a single user, their own. If you are invited into someone else's organization (for example, a firm that pays for several seats), or join one through its single sign-on:

• The owner of that organization holds the subscription, and your access to paid features comes from theirs. Ownership can be transferred to another member, in which case the billing relationship moves with it.
• The organization's administrators (the owner, plus anyone the owner or another administrator has made an administrator) can see the name and email address of every member of the organization, and can remove any member (only the owner can remove another administrator). Only the owner can reach billing.
• Each list and each report says who may open it: only the person who created it, people that person chooses, or the whole organization, and, when it is shared with the organization, whether the organization may only view it or may also edit it. The person who created it, or an administrator, decides. An administrator can set whether new lists start out shared with the organization and can lock that choice. Scorecards, vote counts, and scheduled reports are seen only by the person who created them unless that person shares them with the organization. Only the owner and administrators can see another member's calendar, including personal events.
• An administrator on a paid plan can open a view of your work that shows: your lists (their names, descriptions, and how many bills each holds) and, through the organization's shared workspace, every part of every list in the organization, including the notes, positions, vote counts, and keywords recorded on it; an administrator can also open and change any list or report in the organization, including one you have not shared; your private notes about a legislator, your compliance-log entries, and your personal calendar events (the 200 most recent entries of each); your scorecards and the bills on them; your vote counts, including those on issues that have no bill yet, and the mark and note you recorded for each legislator; your scheduled reports, including their schedule and the email addresses they go to; your notes on city and county matters; and, while assigned work is turned on, every assignment in the organization, including what was submitted on it and its review notes. Administrators can also see the organization's change log: who invited, removed, or changed the role of whom, who changed a division, an AI setting, or a shared label, who changed who may see a list or report, who handed out, passed on, handed back, accepted, sent back, or cancelled assigned work, and who turned assigned work on or off, with when. Administrators are not shown the questions you ask the AI assistant or the drafts the Service generates for you. This is not limited to content you have shared, and there is no setting that withholds it from an administrator.
• So if your Seat is on an organization you do not control, treat the account as your employer's rather than as private. Anything you would not show your employer should be kept elsewhere. You are told this when you accept an invitation or first sign in through single sign-on, and again on the pages where such content is recorded.
• If you join through single sign-on, an account that already existed with exactly your organization's email address is linked to your organization's sign-in and joins the organization with everything it holds, which then becomes visible to its administrators as described above. An account that has its own paid plan or free trial stays in its own organization, with its own billing, until that plan or trial is cancelled, and joins on a later sign-in. An account on a different email address is never moved.
• Team bill analyses are shared documents: every member of the organization who can open one can read it and its saved versions, which record who saved each version and when. A division analysis can be edited by the people in that division and read by everyone in the organization. A personal analysis is your own working copy.
• Divisions and assigned work. Your organization may place you in one or more divisions; being in a division does not let anyone see your work. An assignment can be seen by the person who made it, the person or division it was given to (for a division, the people in it and in the division directly above it), the leads of the division concerned and of the division directly above it, and the owner and administrators. What you submit on an assignment is shared, by submitting it, with the person who assigned the work and the owner and administrators, who review it; a note you send with it, and the review notes, can be seen by everyone who can see the assignment. When the work asked for is an analysis, submitting shares a copy of your personal analysis as it stands then; if the submission is accepted, that copy becomes the organization's team analysis of the item, saved as a new version naming you and the person who accepted it, with the previous version kept. An owner or administrator can turn assigned work off for the organization; while it is off, nothing about it is shown or sent, and nothing is deleted.
• Labels you share. A position, priority, or action label you share with your organization can be used by everyone in it, and administrators can rename, change, limit, turn off, or delete it.
• If you are removed, you lose access to the organization's content, though lists, reports, scheduled reports, scorecards, and vote counts you created leave with you, and the administrators stop being able to see what you do afterwards. Work assigned to you by name stays with the organization, unassigned.

Sharing is always something you or a list's owner chooses to do; we never share Your Content with another user on our own initiative.

Shared lists. You can share a tracking list with another OlympiaTrack account. Sharing requires a paid plan on both sides. When a list is shared:

• Everyone on it can see the list, the bills and local matters on it, and the name and email address of everyone else on it.
• When you share a list, you choose which of your notes, positions, and vote counts on its items are shared, and the parts you choose are shown to the others on the list under your name. Nothing is merged, and each person can only edit their own. The people who control the list decide whether each person can change it or only view it, and can remove anyone from it.
• If you leave a list or are removed from it, you lose access to it and your alerts for it stop. If the plan of the person who shared it ends, sharing pauses; if your plan ends, you stop seeing lists shared with you. Nothing is deleted.

Turning off sharing, leaving a list, or removing someone changes who can see content; it does not delete anything anyone wrote.

Report links. If you create a report link, anyone who has the link can open the report without signing in, until you revoke it. It shows whatever the report includes, which may include your notes and positions if you chose to include them. We record how many times the link was opened and when it was last opened, and show you how many times.

Scheduled reports and invitations. If you schedule a report or invite someone, we send email to the addresses you enter, and the report or invitation carries what you chose to include and your name or your organization's name. The recipient's email provider receives it.

We use the following third-party service providers to operate the Service. Each receives only the information needed to perform its function and is expected to protect it:

The mailboxes we use for support, which receive messages from the Support page and email sent to support@olympiatrack.com, are hosted by a third-party email provider, which stores those messages and any screenshots attached to them.

If your organization uses single sign-on, your organization's own identity provider (for example, Microsoft Entra ID) supplies your identity to us. That provider is your organization's, not ours.

OlympiaTrack staff operate the Service through an administration panel. It is protected by sign-in and a separate code, and it shows:

• Accounts: each account's name, email address, sign-up date, identity-provider identifier, payment-processor customer identifier, subscription status and renewal date, and counts of what it holds (lists, bills tracked, local matters, rules, bill notes, testimony records, followed committees, and alert opt-ins). Staff are not shown the names, descriptions, or contents of your lists, except that usage records made before this Policy's date may carry the name of a list you clicked, until they are deleted under Section 9.
• Usage: the usage analytics described in Section 2.2 for a single account, and usage and sign-up figures across accounts, including how each account first found us, whether it has made a list, tracked a bill, set an alert, or subscribed, and when it was last active.
• Organizations: each organization's name, owner email, members, plan, seats, free-trial dates, and single sign-on domains, and the ability to change a plan we manage or extend a free trial. At an organization's request, staff can also make or remove an administrator, remove a member, rename the organization, and, on a plan we manage, make another member the owner. Each of these changes is recorded with the staff member who made it and when.
• Sign-in security: for a single account, the sign-in security records described in Section 2.2 and how many other accounts used the same address or browser, and the ability to suspend the account, its email address, and those addresses and browser identifiers. Each suspension and each lift is recorded with the staff member who made it, when, and why.
• AI usage: the AI usage records described in Section 2.2, by account.
• Errors: the diagnostic and error records described in Section 2.2.
• Content we publish: site news, product updates, and corrections to public legislative data, with how many accounts have seen an update.

Staff do not see, through this panel, the contents of your lists, notes, positions, vote counts, calendars, compliance logs, drafts, uploaded documents, or questions to the AI assistant. Staff can see content you send us yourself (for example, a support message or a screenshot), and content you ask us to look at. Separately, the person who operates the Service has direct access to the database for maintenance, and uses it only to operate, secure, and repair the Service, or where Section 5.5 requires.

5.5 Other disclosures

We may also disclose information: (a) to comply with law, legal process, or a governmental request; (b) to enforce our Terms or protect the rights, safety, or property of us, our users, or others; (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy or notify you; and (d) with your direction or consent.

The Service aggregates public legislative and public-record data from governmental and third-party sources. This information is created and published by those sources, not by us, and is presented for informational purposes.

This includes, among other things: bills and their text, history, amendments, versions, and fiscal notes; roll-call votes; committee information, membership, meeting schedules, executive-session actions, and nonpartisan committee staff contact details; legislator information; hearing records, including committee bill reports naming those who testified and hearing sign-in records naming those who registered a position; floor calendars; statutes (RCW) and administrative rules (WAC) and agency rulemaking filings; agency profiles and state contracts; state budgets, and payments made by state agencies as the state publishes them in its Open Checkbook, which name who was paid, including individuals; attorney-general opinions; election candidate filings and results; organizations that employ registered lobbyists, and lobbying disclosure data; personal financial-affairs disclosures filed by public officials; city and county ordinances, resolutions, meetings, agendas, councils and councilmembers; recordings of legislative proceedings; and headlines and short excerpts from news publishers, which link back to the publisher.

Sources include the Washington State Legislature's web services and leg.wa.gov / app.leg.wa.gov / apps.leg.wa.gov, the Legislature's committee sign-in system, the Washington Public Disclosure Commission and data.wa.gov, VoteWA.gov and the Washington Secretary of State, the Office of the Governor, the Office of Financial Management, the Legislative Evaluation and Accountability Program Committee (fiscal.wa.gov), the Washington State Attorney General's Office, the Office of the Code Reviser, TVW and its video vendor, the Municipal Research and Services Center, the Seattle Ethics and Elections Commission, city and county council systems and their vendors, and news publishers' syndication feeds and news aggregators (including Google News).

If you are named in such public data, that information originates from the applicable public source, not from us. This may include people who are not public officials: for example, a member of the public who signed in to register a position at a committee hearing, which the Legislature publishes as part of the hearing record. We show who testified or signed in on a bill in the context of that bill, and, from a name shown on that bill, where else that same person testified or signed in. There is no search of hearing records by a person's name. Separately, state payment records show each recipient as the state's Open Checkbook names them, which includes people the state paid (for example, travel reimbursements and grants), and they can be searched by the recipient's name. We do not sell this information or use it to build marketing or contact lists.

Corrections. We mirror what the source publishes. If a record about you is wrong, the correction has to be made at the source that published it, and our copy will reflect it the next time we synchronize with that source, which for most sources is daily. You may also contact us at support@olympiatrack.com and we will consider what we can reasonably do within the Service.

7. Cookies, Tracking, and Do-Not-Track

We and Auth0 use cookies and browser storage that are strictly necessary to authenticate you, keep you signed in, and secure the Service. We also use your browser's local storage to remember how you first found the Service (Section 2.2) so it can be attached to your Account if you register, and for functional preferences you set, such as how a page is arranged, which sections you have collapsed or dismissed, calendar display choices, and your light or dark theme.

We also collect first-party usage analytics as described in Section 2.2. These do not rely on cookies, are not shared with advertising networks or third-party analytics providers, and are not used for cross-site or cross-service tracking: they record only how the Service itself is used, by a signed-in Account.

Do Not Track and Global Privacy Control. Some browsers can send a "Do Not Track" (DNT) signal, and some send a "Global Privacy Control" (GPC) signal. The Service does not respond differently to DNT or GPC signals. The reason is that there is nothing for them to turn off here: we do not track you across other companies' websites or services, we do not sell or share personal information, and we do not engage in cross-context behavioral advertising.

We do not currently use third-party advertising cookies or non-essential cookies. If we introduce any, we will update this Policy and provide any legally required notice or consent controls.

8. Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information, which may include the right to: access the information we hold about you; correct inaccurate information; delete your information; obtain a copy/export of your information; and opt out of certain processing. Washington does not currently have a comprehensive consumer-privacy statute of general application, but residents of certain other states may have such rights, and we honor applicable rights requests regardless of whether we are legally required to.

To exercise any right, contact us at support@olympiatrack.com. We will respond as required by applicable law. We will not discriminate against you for exercising your rights. Where Your Content is kept in a feature or on a page you cannot open without a paid plan (for example, your calendar events, compliance log, vote counts, reports, team bill analyses, or lists shared with you), you can ask us for a copy of it.

You can also directly: edit or delete Your Content within the Service; manage notification and calendar-sync choices and replace or disable your calendar-feed address; revoke report links and remove report recipients; export your lists and logs; and manage or cancel your subscription or free trial through the billing portal. There is not currently a self-serve button that deletes your entire Account: email us and we will do it, and we will confirm when it is done.

If you received a scheduled report from an OlympiaTrack user and do not want more, use the unsubscribe link in that email.

9. Data Retention

We retain your account information and Your Content for as long as your Account is active and as needed to provide the Service. We may retain certain information after Account closure as necessary to comply with legal, tax, and accounting obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. Cached AI Output and aggregated public data may be retained and are not personal to you. Backups and logs may persist for a limited period under our providers' standard retention.

Some records are limited by design rather than by request:

• Usage analytics are deleted after 90 days.
• Diagnostic and error records about a problem that has been marked resolved are deleted once the problem has not recurred for 90 days. A record of an unresolved problem in our own servers is kept until it is resolved. A record of an unresolved problem reported from a browser is deleted once it has not recurred for 30 days. If the number of records ever exceeds a fixed limit, the least useful ones (resolved problems first) are deleted to stay within it.
• AI usage records: the daily counts are deleted after 30 days, and the per-request records after 13 months.
• Sign-in security records (IP addresses and browser identifiers, Section 2.2) are deleted 13 months after we last saw them. A record that an account was suspended is kept while the suspension lasts and afterwards, so that a lifted suspension stays on record.
• Draft documents are pruned automatically so that only your most recent drafts for a given bill are kept.
• Team, division, and personal analyses each keep their 100 most recent saved versions; older versions are deleted.
• Documents you upload for summarization are not stored at all.
• The in-app activity feed keeps only your most recent entries.
• Invitations expire after 14 days.
• Card fingerprints used to hold a card to one free trial are kept for as long as we offer free trials, so that the rule can be applied.

If your Account is deleted, analytics records and diagnostic records are disassociated from it.

10. Data Security

We rely on reputable providers and reasonable technical and organizational measures to protect information, including: authentication managed by a specialized identity provider (Auth0); payment-card data handled directly by a PCI-compliant processor (Stripe) so that card numbers do not touch our systems; encryption of data in transit (HTTPS); and access controls on our hosted database and our administration panel. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials, and any calendar-feed address or report link you create, confidential. If we become aware of a breach affecting your information, we will notify you and the authorities as required by applicable law, including RCW 19.255.

11. Data Location, Children, and Email

• Location. The Service and its providers are operated in the United States. The Service is intended for users in the United States and is not offered to individuals in the European Economic Area or the United Kingdom. If you access the Service from outside the U.S., you understand your information will be processed in the U.S.
• Children. The Service is intended for professional and business use by adults and is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn we have collected such information, we will delete it.
• Service and billing email. Messages that are part of the Service (alerts you opted into, receipts, free-trial emails, renewal reminders, and other billing or account notices) are transactional and are sent for as long as you have an Account, a free trial, or a subscription.
• Marketing email. Any commercial email we send will identify itself as such, will include a working unsubscribe mechanism and our postal address, and will comply with applicable law including CAN-SPAM.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the updated Policy with a new "Last updated" date and, where appropriate, notify you within the Service.

If we make a material change (for example, collecting a new category of information, using your information for a materially new purpose, or sharing it with a new kind of recipient), we will notify you and ask you to accept the updated Policy before you continue using the Service.

We will not apply a materially changed Policy retroactively to information we already collected under an earlier version without your consent.

13. Contact

To contact us about privacy or to exercise your rights:

Collin's Software LLC (d/b/a OlympiaTrack) support@olympiatrack.com