Privacy Policy

This policy explains what personal information Defend Utah collects, why we collect it, where it is stored, and what choices you have. It applies to defendut.com and any account-protected areas of the site.

The short version

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. The only outside companies that touch your data are the service providers listed below, who process it solely to operate this website on our behalf and are not permitted to use it for anything else.

What we collect

If you create an account: your email address, an encrypted (hashed) form of your password, the date you created the account and last signed in, and a record that you accepted these terms. We never store your password in a readable form, and no one at Defend Utah can see it.

If you subscribe to a newsletter or sign a petition: the name, email address, and any location information you provide on that form.

Automatically, when you visit: standard web server information such as IP address, browser type, pages visited, and referring page. This is ordinary web traffic data and is used to keep the site running and understand general usage patterns.

Where your data is stored and who processes it

We want to be straightforward rather than vague about this. Defend Utah does not run its own servers for this website. Your data is stored and processed by the following providers, each acting on our instructions:

• Vercel — hosts the website and processes web requests and server logs.
• Supabase — stores account records (email address, hashed password, sign-in timestamps). Hosted on Amazon Web Services infrastructure in the United States.
• Resend and Amazon SES — deliver account emails such as confirmation and password-reset messages.
• Cloudflare — provides bot protection on sign-up and sign-in forms, to prevent automated abuse.
• Google Analytics — measures general site usage and traffic patterns.
• Google Sheets (via Google Apps Script) — records newsletter subscriptions and petition signatures.

All of these providers are located in, or store data in, the United States. If you are accessing this site from outside the United States, your information will be transferred to and processed there.

How we use your information

• To create and secure your account and sign you in.
• To send transactional email you have asked for — confirming your address, resetting your password, or important notices about your account.
• To send newsletters or campaign updates, if you asked to receive them.
• To keep the site working, secure, and free of automated abuse.

We do not use your information to build advertising profiles, and we do not run third-party advertising on this site.

How long we keep it

We keep account information for as long as your account exists. If you ask us to delete your account, we remove your account record and its associated data. Newsletter and petition records are kept as long as they are relevant to the campaign or advocacy effort they support. Ordinary server logs are retained for a short period by our hosting providers as part of their normal operations.

Your choices

• Access or correction — you may ask what information we hold about you, or ask us to correct it.
• Deletion — you may ask us to delete your account and associated personal information.
• Unsubscribe — every newsletter email includes an unsubscribe link. Transactional emails about your own account are not promotional and cannot be unsubscribed from while the account exists.

To make any of these requests, contact us using the address at the bottom of this page.

Security

Passwords are stored using industry-standard one-way hashing, never in plain text. Traffic to and from this site is encrypted with HTTPS. Access to account data is limited to those who need it to operate the site. Optional two-factor authentication is available on accounts that support it, and we encourage you to enable it.

No online service can promise perfect security. We take reasonable measures to protect your information, but we cannot guarantee it against every possible threat.

Children

This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will update the effective date above and, where appropriate, notify account holders by email.

Contact

Questions about this policy, or requests regarding your information, can be sent to defendut.com@gmail.com.