Privacy Notice
Effective October 25, 2026. Version 2026-10-25.
Who runs Framers
Framers is an independent, non-commercial civic project operated by an individual under the pen name Silence Dogood (after the pen name Benjamin Franklin used in 1722). For privacy questions and requests, write to notifications@framersproject.org.
The short version
- To take part you give us an email address. We don't ask for a separate name, phone number, or postal address. (Your email address, or something you write in a Frame, may of course identify you.)
- The public sees Frame text and stage totals, never who wrote a Frame or how anyone voted.
- No advertising, no tracking or analytics cookies, and we don't sell data. We don't use anyone's proposals or votes for advertising, political profiling, or anything unrelated to the experiment.
What we collect
- Your account
- Your email address and a one-way hash of your password (Argon2), so we never store the password itself. Also the date you joined, when you last used the site, when you confirmed being 18+ and a US resident, which version of these documents you accepted, whether you're available for selection, and your email preferences. Staff accounts also store a two-factor secret.
- Frames
- The text, category, and time of each Frame you submit, and its progress through the stages. For every submission attempt, accepted or not, we record the outcome, the reason it was refused, and its length (not its text), to measure how well the submission rules work. Automated checks, run on our own servers rather than by an outside service, look at each Frame for personal information and abusive language, and compare it with the text of existing Frames to spot close rewordings, before it's published; a match holds it for a moderator. The comparison keeps no extra data: it only uses Frame text that hasn't been deleted. No one is profiled by these checks; they only decide whether a person looks at the Frame first.
- Reviewing
- When you're selected, we record the assignment and, if you vote, your Yes or No with the time it was cast. Each vote is stored with its assignment, and so with your account, so that every stage result can be recounted and checked against the votes and rules that produced it.
- Reports
- If you report a Frame, the reason and any note you add.
- Constitution questions
- When you answer a Constitution question while signed in (the Question of the Day, practice questions, or a question the rules ask before submitting a Frame), we record which question, your answer, whether it was correct, and when. Only you see your own results; staff see only totals per question, with counts of fewer than five people hidden. These answers are never published, never affect whether you're selected as a Reframer, and aren't a measure of legal knowledge. If you answer without signing in, nothing is recorded.
- The audit log
- A permanent, tamper-evident record of what happened and when: submissions, selections, results, and staff decisions. Entries can include internal account numbers and Frame and assignment references. They never contain email addresses, phone numbers, IP addresses, Frame text, or how anyone voted.
- Technical data
- Your IP address is used for a few minutes to limit repeated sign-in and sign-up attempts. Our host, Render, keeps the site's logs, which can include IP addresses, for up to 30 days and then deletes them.
Who can see what
- Everyone: Frame text (unless deleted or removed), category, dates, rules version, how many Reframers were assigned and how many have voted, each closed stage's Yes and No totals and outcome, and each Frame's history.
- You: your own Frames, assignments, and settings.
- Staff (administrators, moderators, auditors, analysts) sign in with two-factor authentication and see only what their role needs. Administrators can see who wrote a Frame and who sent a report; moderators see reports without the sender. No staff page shows how anyone voted. Analysts see only aggregate figures, and counts of fewer than five people are hidden. Staff actions are recorded in the audit log.
- The operator's database access: the person who runs Framers can access the database directly, where a vote is linked to the account that cast it. That access is used only to operate and secure Framers, verify results, and meet legal obligations, never to look up how someone voted out of interest.
Services we use
These providers process data on our behalf to run Framers. We don't sell data to them or anyone else.
- Render hosts the site and the database in the United States, so it stores everything described here, and its logs can include IP addresses.
- Google Workspace sends our emails: verification, selection notices, reminders, and staff checkpoints. It receives the recipient's address and the message. Emails name Frames by reference number, never by their text, and Google keeps a copy of each sent email in our mailbox; we delete those copies within 90 days.
- Cloudflare Turnstile checks for bots on the sign-up page only. It runs in your browser there and processes information about your browser and device to do so.
Cookies
Framers sets only the cookies it needs to work: a session cookie that keeps you signed in (for up to 14 days), a security cookie that protects forms against forgery, and a short-lived cookie that carries one-time confirmation messages after you act. Cloudflare's widget on the sign-up page may use its own browser storage for bot detection. There are no advertising or analytics cookies.
How long we keep it
| Data | Kept |
|---|---|
| Frame text | Deleted on this schedule under the current rules, counted from when the Frame finishes: failed at Stage 1, withdrawn, or cancelled before passing a stage, text deleted 7 days after the Frame finishes; failed or cancelled later, text kept permanently; Fully Framed, text kept permanently; removed by moderation, text deleted 30 days after the Frame finishes. Each Frame follows the rules version it was submitted under. A Frame a moderator rejects or removes because it contains personal information has its text deleted immediately. |
| Frame outcome records | Permanently: reference, category, dates, rules version, stage totals and results, and history. They are the experiment's results. |
| Assignments and votes | Permanently, so results can always be rechecked. If you close your account they stay linked only to a de-identified account record (see below). |
| Audit log | Permanently, by design: it can't be edited or deleted. |
| Account details | While your account is open; deleted when you close it. |
| Answers to Constitution questions | Kept with the experiment's records; linked only to a de-identified account record once you close your account. |
| Submission attempts, reports, email delivery records | Kept with the experiment's records; linked only to a de-identified account record once you close your account. |
| Host logs | Up to 30 days. |
| Copies of emails we sent | Up to 90 days, in our Google Workspace mailbox. |
| Backups | Render's recovery backups cover the last few days, and any copies we export are deleted after 30 days. Deleted data can therefore remain in backups for up to 30 days. |
Closing your account
You can deactivate your account in Settings. We then delete your email address, password, two-factor data, and roles from the live database straight away, and you can no longer sign in. What remains is a de-identified account record, a random internal number with no email address. Your Frames, assignments, votes, reports, and audit entries stay linked to that number so the experiment's results remain complete and checkable. Your Frames' text follows the retention schedule above. Copies of the deleted details can remain in backups for up to 30 days, and copies of emails we sent you for up to 90 days.
We describe these remaining records as de-identified rather than anonymous: they no longer contain your email address, but someone with database access and other information (for example, a copy of an email we sent you) could in principle connect them to you.
Your privacy rights
Several U.S. states have consumer privacy laws, but they generally apply to businesses that meet revenue or size thresholds. We believe Framers, a free, non-commercial project run by an individual, doesn't currently fall under them. We offer the following rights to everyone, wherever in the United States you live. If a state law does apply to Framers and gives you more, we'll honor it.
- Know and access
- You can ask what we hold about you and get a copy in a portable format (JSON): your account details, Frames, submission attempts, assignments, your own votes, reports you filed, your answers to Constitution questions, emails we sent you, and your audit history.
- Correct
- You can change your email address, password, availability, and email preferences yourself in Settings, or ask us to fix anything else that's inaccurate. Frames can't be edited after submission; you can withdraw one before it enters Stage 1.
- Delete
- You can close your account in Settings at any time, or ask us to do it, and your personal details are deleted as described above. Some records stay, de-identified, because they're the experiment's results and the audit trail that proves them; we explain these in "Closing your account." If a Frame you published identifies you, ask and we'll hide its text right away; it's then deleted on the schedule for removed Frames above. If the Frame is still in the process, hiding it ends its journey. Its recorded outcome stays.
- Opt out
- We don't sell personal data, share it for advertising, use it for targeted ads, or use it for profiling that has legal or similarly significant effects, so there is nothing to opt out of. We treat every visitor the same whether or not their browser sends a Do Not Track or Global Privacy Control signal, because we don't track anyone across sites. You can pause selection as a Reframer and turn off optional emails in Settings.
- Equal treatment
- Using these rights never affects how you're treated on Framers, except that a closed account can no longer take part.
How to ask. Write to notifications@framersproject.org from the address on your account. To protect you, we only act on requests we can confirm came from the account's own address, and we send any data only to that address. Someone acting for you must include your written permission, and we'll confirm it with you directly. We'll answer within 30 days. If we need longer, we'll tell you why within those 30 days, and won't take more than 30 further days. Requests are free.
If we say no. We'll explain why. You can ask us to reconsider by replying within 60 days, and we'll give you our final answer within 45 days of that. If you're still not satisfied, you can contact your state attorney general; in New York, that's the Office of the New York State Attorney General.
Security
We protect the data we hold with measures suited to a small project: hashed passwords, two-factor sign-in for staff, role-based access, HTTPS for every connection to the site, votes, results, and selections that the application itself can't edit or delete, and a tamper-evident audit log checked against daily checkpoints kept outside the database. If a breach affects your information, we'll notify you and the authorities as the law requires.
Children
Framers is only for people 18 and older. If we learn that an account belongs to someone younger, we'll deactivate it.
Future features
Framers doesn't collect phone numbers. If text-message notifications are ever added, we'll update this notice and ask for your explicit consent before collecting a number or sending a message.
Changes to this notice
Each version is dated and numbered, and we record which version you accepted. We'll post a new version here and, for significant changes, email participants before it takes effect.