Privacy Policy

Last updated: 2026-05-20. Plain-language summary.

What we collect

• Email address — required for the platform to deliver agency replies back to you. Also used to send magic-link sign-in and platform notifications.
• Name (or pseudonym) — appears in the letter sent to the agency.
• The text of your request and any agency replies — stored for tracking. Made public only if you opt in.
• IP addresses — recorded on piggyback sign-on attempts for abuse mitigation; not displayed publicly, not sold.

What we do NOT collect

• No ad tracking. No third-party analytics by default.
• No social-platform pixels.
• No selling of any user data, ever.

Cookies

We set three cookies:

• akrr_session — your sign-in session token. Lasts 60 days. HttpOnly.
• akrr_drafts — lets anonymous visitors keep access to their own drafts before they sign in. Lasts 30 days.
• akrr_csrf — anti-CSRF protection. 90 days.

What's public vs. private

Requests are private by default. They become public only when the requester explicitly toggles "Publish public status page" or "Publish to archive." Piggyback signers see only the public version of a request, never the requester's private email.

Data retention & deletion

You can request deletion of your account and all associated data by emailing [email protected]. Publicly archived documents released by agencies may remain in the archive if other users have signed on; in that case, only your own identifying information will be removed.

Contact

[email protected]