Data and privacy

What each form collects

Join (register your interest)

• a nickname (a first name or nickname; please do not use a full name) and your email address;
• your state, and optionally your school district;
• how you want to take part: District Delegate, State lead, researcher, teacher or parent sponsor, or other;
• an optional short note of up to 500 characters;
• a yes-or-no confirmation that you are 13 or older. We store this answer as true or false only, and never a birth date or an age. The form cannot be sent without it;
• a yes-or-no agreement to the storage of this information as described on this page; and
• only if you say you are under 16and have a parent or teacher sponsor: your sponsor’s email address, stored in its own field, and a yes-or-no answer that your sponsor has agreed to the code of conduct. The submission is then marked “needs sponsor confirmation.” We do not store a sponsor’s name.

We do not collect full names, birth dates, ages, photos, home addresses or phone numbers. A person at CENTS contacts an under-16applicant only through the sponsor’s email address, never directly. Nothing is sent automatically: the site sends no email.

Contact

• your name and email address;
• a topic from a short list (press, correction, data question and others); and
• your message, up to 2,000 characters.

Corrections

• the state or page the report is about;
• what is wrong, and the source that shows the correct information; and
• optionally, your email address, if you want us to be able to reach you.

Newsletter

• your email address and the page you signed up from.

Please do not put anyone’s personal information, or any student’s name or records, in a note, message or correction.

Researcher portal (invite-only pilot)

A small private area for invited student researchers. It is not open to the public and has no public profiles. Signing in uses one strictly necessary cookie that holds a random session code. There is no analytics or tracking.

What it collects

• a username you choose (not a real name) and a password, stored only as an argon2id hash;
• your role (explorer, researcher or reviewer);
• yes-or-no answers recorded by your invite: that you are 13 or older and, if you are under 16, that a parent or teacher sponsor has been confirmed. No age, birth date or sponsor name or email is stored in the portal;
• your training results and your qualification task answers;
• the evidence packages you write: a state, a research question, a limitations note, and 1 to 5 claims. Each claim has a claim type, a source address, a verbatim excerpt of 25 words or fewer, a citation, the date retrieved, an optional archive link (only web.archive.org or perma.cc), a confidence note, and a flag if the source address did not look like a primary-source site;
• a reviewer’s decision and note on each claim and on the package as a whole, with the time of each decision. This review history is kept with the submission and is never edited; only you can see the feedback on your own work; and
• if you are an approved researcher, the outreach records described below: contact lists, a reviewer’s decisions on them, and a record of each email that was sent; and
• a session record (random code and expiry time) and, for sign-in limits, a one-way salted hash of your network address that changes daily and is deleted after 2 days.

It does not collect your own email address, real name, birth date, photo, phone number or address, and it has no messaging, comments or file uploads. The portal never sends email.

Outreach records

Approved researchers can build lists of public work contacts and record the emails they send to them. The portal records outreach. It does not send, draft or schedule any email: a researcher sends from their own account, and a CENTS adult sends for anyone under 16.

• What is stored. A list title and who the list is for (legislators, district officials or school contacts). For each contact: a name, a role or title, an affiliation, the public work email address, the web address of the page where that address appears, and the date it was accessed. For each reviewer decision: the decision, a note and the time. For each email sent: the date, the template version and the proof described below. A reply is logged as an evidence claim, not as free text: a verbatim excerpt of 25 words or fewer, with no names, email addresses or phone numbers.
• Only public work contacts.The address must be one an official or staff member publishes for their job, on a page anyone can open. Personal email addresses (such as Gmail, Yahoo, Outlook or iCloud), phone numbers, and anything that looks like a student’s contact are rejected. An address that is not on a .gov, .edu or .k12 domain, or a known district domain, is marked for a person to check by hand.
• Copy rule. Every outreach email must copy a CENTS outreach address. The portal shows that address and asks for proof with each recorded send: a reference to the message, or the Cc header line as it appears. A send is not recorded without it.
• Under 16. An account under 16 cannot send or record a send. A CENTS adult sends on their behalf, from a CENTS account, and records it.
• Private. Contact data is visible only to the researcher who entered it and to the person who runs the portal. It is never shown on a public page, never in the public dataset, and never exported except by the private command-line export. Feedback on a list is shown only to its author. Review decisions and send records are kept as a permanent history that cannot be edited.
• How long it is kept. A draft list nobody has touched for 60 days is deleted. A list with no activity for 6 months is deleted with its contacts, review history and send records. Deleting your account deletes all of it at once.

Who can see it, and what is published

Only the person who runs the CENTS portal can read portal data. Other students cannot see your work. Nothing you submit is published automatically, and nothing is verified until it has been reviewed: accepted claims go to a private queue, without your username, to be reviewed by hand before anything is considered for the public dataset. Data is stored in a database provider and is not sold or shared.

How long it is kept, and deleting it

• Accounts with no activity for 12 months are deleted with all their data, including packages, claims and review history.
• Invite codes not used within 30 days are deleted. Only a hash of a code is ever stored.
• Sessions end after 24 hours at most, or 4 hours without use.
• You can delete your account and all of your data yourself, any time, from the Account page. A sponsor can ask us to do it.

Spam protection

Each form has a hidden decoy field and a minimum time to submit, and the number of submissions from one network is limited. For the limit we store a one-way, salted hash of the network address together with the time. The salt includes the date, so the hash changes every day and cannot be used to follow anyone across days. We never store the address itself. These records are deleted after 2 days.

Why

To confirm that a district has a delegate, to confirm with a sponsor that a young person under 16 may take part, to answer messages, to check and apply corrections, and to contact you about your role. We use it for nothing else.

How long we keep it

• Join submissions: deleted 30days after they are sent unless we have followed up and marked the submission confirmed. A submission that needs sponsor confirmation is deleted, with the sponsor’s email address, if the sponsor has not confirmed within 30 days. Confirmed submissions are deleted after 12 months without activity, or sooner on request.
• Contact messages and corrections: deleted 12 months after they are sent, or sooner on request. Corrections that lead to a change are recorded in the public change log without any personal details.
• Newsletter addresses: kept until you ask us to remove yours.
• Spam-protection records: 2 days.

The deletions above are run by hand with a script that the maintainers run, so a record can stay a little past its date until the next run.

Deletion

You can ask us to delete anything you sent at any time. Email contact@centscampaign.org from the address you used, with the date you sent it. A parent or teacher sponsor can make the same request for a young person. See youth safety. For questions about the data this site publishes, write to policy@centscampaign.org.

Open data

The state dataset is published under an open license on data and downloads. It contains no personal information. Form submissions and anything collected through the forms are never part of it.

Email

The forms send no email. Messages and submissions are read by people who work with CENTS, and we may write back to the address you gave. Role addresses such as contact@centscampaign.org forward to a private inbox.