Privacy policy
Effective October 29, 2026 · Market Mojo LLC
This policy explains what personal information Market Mojo LLC keeps when you use Civic Atlas (the website, the web app and the Android app), why, who handles it, how long it is kept, and the rights you have wherever you live. We collect as little as the service needs and nothing for advertising.
1. Who is responsible
Market Mojo LLC is the controller of your personal information (the business responsible for it). Contact for every privacy question and request: marketmojowi@gmail.com, or the contact page. Market Mojo LLC acts as its own privacy officer; we have not appointed a separate data protection officer because the law does not require one for a service of this kind.
2. What we collect
| Information | From | Why | Legal basis (GDPR, UK GDPR, LGPD) |
|---|---|---|---|
| Name and email address | Your Google account or the address you sign in with | To sign you in and answer you | Contract |
| Password (if you set one) | You | To sign you in. Kept only as a salted scrypt hash by Google Firebase; nobody, editors included, can read it | Contract |
| Member number | Made at random on your device | To identify your contributions without your name or email | Contract |
| Membership status and billing records | Stripe | To give members access and keep tax and accounting records. We never see card numbers | Contract; legal obligation |
| Facts and corrections you add | You | To review and, if accepted, publish them with their source | Consent, which you can withdraw for pending facts at any time |
| Messages you send us | You | To answer you | Legitimate interest in answering; consent |
| Security logs (time of sign-in, internet address) | Google Firebase, automatically | To keep accounts and the service secure and prevent abuse | Legitimate interest in security |
We do not collect your location, contacts, photos, device advertising identifiers, browsing history or any special category of personal data (such as health, religion, race or beliefs). There is no analytics, tracking or advertising. No decision about you is made by automated means.
3. Cookies and storage on your device
Civic Atlas sets no advertising or tracking cookies. Google Firebase keeps your sign-in in your browser's storage so you stay signed in. Members' devices keep a copy of the data set so the app works offline; it is deleted when you sign out or your membership ends. Stripe sets its own cookies on its checkout and billing pages to prevent fraud. Because we do not sell or share personal information, we treat a Global Privacy Control signal as a confirmation of that choice.
4. Who handles it for us
Only these service providers process personal information for us, each under a written data processing agreement: Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage and Hosting) and Stripe, Inc. (payments and billing). GitHub hosts our public pages and receives no personal information from you. We may disclose information if the law requires it. We never sell personal information, never share it for cross-context behavioural advertising, and never use it to train artificial intelligence.
5. International transfers
Your information is stored by Google and Stripe in the United States. Transfers from the European Economic Area, the United Kingdom and Switzerland rely on the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, in which Google and Stripe take part, and on the European Commission's standard contractual clauses in their agreements. Transfers from other countries rely on those same contractual protections, as Canadian, Brazilian and Australian law require.
6. How long we keep it
- Account, member number and membership record: while your account is open; deleted at once when you delete the account.
- Pending facts: deleted with your account. Accepted facts stay in the data set as part of the historical record, without your name or member number.
- Messages: twelve months, then deleted automatically.
- Billing records: kept by Stripe for as long as tax and accounting law requires (usually seven years).
- Backups: anything removed is gone from backups within 30 days.
7. Security
All traffic is encrypted (HTTPS with HTTP Strict Transport Security), and Google encrypts stored data. Access rules let each member read only their own account records; only named editors can review contributions. Passwords are hashed, member numbers are random, and card details never reach us. Our controls follow the NIST Cybersecurity Framework 2.0 and NIST SP 800-63B for sign-in. If a breach puts your information at risk, we will notify the supervisory authorities within 72 hours where the law requires it and tell you without undue delay.
8. Your rights
Wherever you live, you may ask us to:
- See the personal information we hold about you and how it is used (access, and the California right to know);
- Download it in a common machine-readable format (portability) — My account, Download my data;
- Correct anything inaccurate;
- Delete it — My account, Delete my account;
- Restrict or object to its use, and withdraw consent at any time without affecting earlier use;
- Learn which service providers receive it (above).
We answer within 30 days (one month under the GDPR, 45 days under California law, 15 days under Brazil's LGPD for a simplified answer; we use the shortest). We confirm your identity through your signed-in account or by email. You may use an authorized agent. We will not treat you differently for using any right. You also have the right to complain to your data protection authority: in the European Union, the authority where you live; in the United Kingdom, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner; in Brazil, the ANPD; in Australia, the Office of the Australian Information Commissioner; in California, the California Privacy Protection Agency.
9. California notice
In the last twelve months we collected the categories identifiers (name, email, member number), commercial information (membership records) and account login credentials (hashed password), for the purposes in section 2. We use account login credentials only to sign you in. We have not sold or shared personal information and do not do so, including that of anyone under 16.
10. Children
Civic Atlas is for adults. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has an account, write to us and we will delete it.
11. Principles we follow
Our practices follow the OECD Privacy Principles: we collect only what the service needs (collection limitation), keep it accurate (data quality), use it only for the purposes stated here (purpose specification and use limitation), protect it (security safeguards), explain what we do (openness), let you see and correct it (individual participation), and answer for it (accountability).
12. Changes
If this policy changes, the new version is posted here with a new effective date. Members are told by email before any change to what we collect or how we use it takes effect.