Privacy Policy

Where your data goes

Everything personal is kept and worked out on your own devices. This is every place anything goes; the sections below explain each one.

Who we are

MiddleMark is an app for iPhone and Android made by Kahcozi LLC, a California limited liability company (“we”, “us”). This policy covers the MiddleMark app on both platforms and this website, middlemark.app. Where the two apps differ, this page says so. You can reach us any time at support@middlemark.app.

What we collect

Nothing that identifies you or describes you. MiddleMark has no sign-in, no user accounts and no analytics. It contains no advertising, tracking or analytics code from anyone else. Its App Store privacy label is “Data Not Collected,” and its Google Play Data safety section says “No data collected.”

The one exception is anything you choose to send us yourself. If you email us, or use Settings › Report a Problem, we receive your email address and what you send, and we use them only to help you.

A problem report opens in your own email app. It includes your MiddleMark, iOS or Android and data versions and your phone model, plus any screenshots you choose to add, and you can see and change all of it before you send it. On iPhone, while you write, Apple Intelligence on the phone may suggest categories, the screens involved and a one-line summary for the subject, from what you’ve written and attached. Nothing is sent until you tap Send.

What stays on your phone

Everything personal in MiddleMark is stored and processed on your own devices. We never receive any of it.

On iPhone, like any app’s data, this is also included in your iPhone’s own backups — iCloud Backup or a backup to your computer — which you and Apple control. On Android, the system backup carries only MiddleMark’s encrypted answers and the keys that open them, as described below.

What leaves your phone, and why

MiddleMark does use the internet. Here is every reason it does, and what goes with each request.

Downloading public data

The votes, bills, campaign filings, executive orders, court decisions and election dates in MiddleMark come from public records. On Android, the first copy of that data arrives with the app from Google Play. After that, the app downloads updates from our data server when you open it. On iPhone, data updates wait for Wi-Fi by default; you can allow cellular in Settings › Data & Sync.

Updates are the same files for every phone. When you open a research report that isn’t on your phone yet, the app downloads that one report by its public report number. Requests never include your answers, scores, ZIP code, district or anything else you’ve entered.

Like any internet connection, a download reveals your phone’s IP address to the server that answers it. Our server doesn’t keep request logs, and we don’t store IP addresses or record which files a device downloads. Our data server and this website are hosted by Cloudflare, which processes IP addresses to deliver traffic and protect the service from abuse, under Cloudflare’s privacy policy.

Checking that the app is genuine

To keep the data service from being copied in bulk, MiddleMark proves to our server that its downloads come from a genuine copy of the app. When the app first sets up, our server checks that proof once, issues an access token that lasts seven days, and renews it with a longer-lived refresh token. Each download carries the access token. Renewing a token never involves Apple or Google. Our server keeps no list of devices and no log of their requests, apart from keys it has blocked for abusing the service.

On iPhone, MiddleMark uses Apple’s App Attest service. App Attest creates a cryptographic key on your iPhone, and our server receives that key’s public half and identifier. Neither the key nor the tokens are linked to your Apple Account, your name, your iPhone’s serial number or anything you’ve entered in the app.

On Android, MiddleMark creates a key in your phone’s Android Keystore and asks the phone’s secure hardware to vouch for it. Our server receives the key’s certificate chain, which shows that the key belongs to a genuine copy of MiddleMark on a phone with a locked bootloader. The chain also shows whether the phone runs its maker’s software or a relocked system such as GrapheneOS, and roughly which model it is. Our server uses it to issue the tokens and then discards it. If your phone can’t provide that proof, the app falls back to Google Play Integrity: Google Play services on your phone ask Google to confirm the app and the device, under Google’s privacy policy, and our server receives only Google’s verdict. Neither path tells us your Google Account, your name or anything you’ve entered in the app.

Syncing your answers through iCloud (iPhone)

If you use iCloud, MiddleMark keeps your answers in step across your own Apple devices. This is on by default. You can turn it off on each device in Settings › Data & Sync › “Sync my answers across my devices.”

• Your answers, ZIP code and district, quiz history, settings and backups are compressed and then encrypted on your iPhone (AES-256-GCM) before they’re stored in MiddleMark’s private folder in your iCloud Drive.
• The encryption key is kept only in your iCloud Keychain, which Apple end-to-end encrypts. Only your own devices signed in to your Apple Account can read the copy. We can’t, and neither can Apple.
• App Lock and the elections you’ve marked as voted are never synced.
• When you turn sync off, the app offers to export an encrypted copy first. It then brings everything back to that iPhone and deletes the iCloud copy. If another of your devices still has sync on, it will upload a new copy, so turn it off on each device.

The encrypted files count toward your own iCloud storage. iCloud is provided by Apple under Apple’s privacy policy.

Backing up your answers to your Google account (Android)

On Android, MiddleMark uses Android’s own backup to your Google account, so your answers can come back when you set up a new phone. It’s on by default and can be turned off.

• The backup carries only MiddleMark’s encrypted answers and the keys that open them. Everything else in the app stays on the phone.
• It runs only when Android can encrypt the backup end to end with your phone’s screen lock, so Google can’t read it. On a phone that can’t — for example, one with no screen lock — nothing is backed up.
• Android keeps the latest backup and restores it when you install MiddleMark on a new phone signed in to the same Google account. It doesn’t sync answers between phones as you go.

Android backup is provided by Google under Google’s privacy policy.

Exporting backup files (iPhone)

You can export encrypted backup files from Settings › Data & Sync › Current & Earlier Backups. Each file is encrypted with a strong password that MiddleMark creates and keeps in your iCloud Keychain, so your own devices can open it. After Face ID or your passcode, you can view the password to save it in the Passwords app; if you copy it, it’s cleared from the clipboard after two minutes (during that time, Universal Clipboard can make it available on your other nearby Apple devices). Files are saved to your MiddleMark folder in iCloud Drive, or wherever you choose. We never receive them.

Reading sources for “Explain the debate” (iPhone)

When you ask MiddleMark to explain the debate on an issue, it reads the public articles and reports linked from that issue so its summary can draw on them. Your iPhone fetches those pages directly from their publishers, much as a web browser would, without saving cookies. Those publishers see an ordinary request from your iPhone, including its IP address and that it came from MiddleMark. Nothing about your answers or scores is sent.

Summaries with Apple Intelligence (iPhone)

“Explain the debate”, “Explain the source” and summaries of bills and reports are written by Apple Intelligence on your iPhone. The Android app doesn’t include these AI features.

Links you open

MiddleMark links to its sources, such as congress.gov, fec.gov and vote.gov. Those pages open in your browser, or in a browser window inside the app, and the sites you visit have their own privacy policies.

MiddleMark Plus

On iPhone, MiddleMark Plus is an optional subscription sold through the App Store. Apple handles the payment and keeps the subscription record, tied to your Apple Account, under Apple’s privacy policy. Family members who share your subscription through Family Sharing are handled by Apple in the same way.

On Android, it’s sold through Google Play. Google handles the payment and keeps the subscription record, tied to your Google Account, under Google’s privacy policy. Google Play doesn’t share this subscription with family members.

Either way, MiddleMark only asks the store, on your phone, whether Plus is active. No purchase record or token is sent to us, we never learn your name, email address or payment details, and subscribing doesn’t send anything you do in the app anywhere.

Apple gives us sales figures in aggregate. Google shows us each order’s number, product, date and price, with the purchase’s general location (such as the state or postal code) for tax purposes — not your name, email address or payment details. If you go to cancel on iPhone, Apple may show a short message from us on its cancellation screen; that message is the same for everyone and tells us nothing about you. Subscription terms are on our Terms of Use page.

Siri, widgets and other phone features

• Siri and Shortcuts (iPhone). Siri’s own answers never include your answers, scores or match ranking; actions that involve them open MiddleMark instead. Some actions use what you’ve saved to answer you — for example, reading out your state’s voting dates or your quiz progress, or playing your ballot briefing. Requests you make to Siri are handled by Apple under Apple’s privacy policy.
• Listen to Your Ballot. Briefings are spoken by voices built into your phone, on the phone, and are public record only by default. If you turn on “Include how each race fits your values”, each race also says who’s closest to your answers and their score — out loud, wherever your phone is playing, including a briefing started from Siri.
• “Let Siri see what’s on screen” (iPhone). Off by default (Settings › Siri). When it’s on, MiddleMark tells Apple Intelligence which member of Congress, bill, roll-call vote or race you’re looking at, so Siri can answer questions about it. Your values, weights and answers are never included.
• Spotlight (iPhone). MiddleMark adds public information, such as members of Congress, to Spotlight on your iPhone so you can search for it. Your answers and scores aren’t added.
• Widgets. The standard widgets never show your positions — only public information, your own race and election dates, and your quiz progress. Widgets that show your matches are off until you turn them on in Settings › Widgets. While they’re off, your match isn’t written anywhere a widget could read it.
• Calendar. If you add a voting deadline to your calendar, MiddleMark adds just that one event. It doesn’t keep or send anything from your calendar.
• Notifications. Any reminders or alerts are scheduled by the app on your phone. We run no push-notification server, so nothing about them passes through us.
• Photos (iPhone). If you share your “I voted” sticker and choose Save Image, iOS asks to let MiddleMark add a photo. MiddleMark can only add that image; it can’t see your photo library. Screenshots you attach to a problem report are chosen with Apple’s photo picker, so only the ones you pick reach the app.
• Visual Intelligence (iPhone). If you use Visual Intelligence on a campaign sign or mailer, MiddleMark reads the text on your iPhone to find matching candidates, then discards it. The image and its text are never stored or sent, and address lines are ignored.
• App Lock. If you turn on App Lock, Face ID, face unlock, your fingerprint or your passcode is checked by your phone’s operating system. MiddleMark only learns whether unlocking succeeded and never receives biometric data. While locked, the app also hides its contents in the app switcher (Recents on Android).
• Permissions. MiddleMark never asks for your location, contacts, camera, microphone or files. On Android, besides internet access, it uses permissions for checking the network, vibration, fingerprint or face unlock, notifications (which Android asks you about first), and finishing a data download in the background.

Crash reports and the app stores

On iPhone, if you’ve chosen to share analytics with app developers (iOS Settings › Privacy & Security › Analytics & Improvements), Apple may send us crash reports and aggregate usage figures for MiddleMark. Apple collects these, not us, and they don’t identify you. You can turn this off at any time in the same place.

On Android, if you’ve chosen to share usage and diagnostics data with Google, Google Play may show us crash and performance reports and aggregate figures for MiddleMark. Google collects these, not us, and they don’t identify you. You can turn this off in your phone’s Google settings.

Apple and Google handle downloads of MiddleMark and any purchases, under their own privacy policies. They give us only aggregate figures, such as the number of downloads, and for Google Play the order details described above — never who you are or your payment details.

Information about public officials and organizations

MiddleMark shows public records about people in their public roles — members of Congress, candidates, the administration and Supreme Court justices — and about organizations that spend money in elections. This comes from public sources such as Congress.gov, the House Clerk and Senate.gov, the Congressional Record, the Federal Election Commission, the Congressional Research Service, the Federal Register, supremecourt.gov and state election offices.

MiddleMark does not include the names of individual campaign donors, and it never will.

If you believe something in MiddleMark about you is inaccurate, email support@middlemark.app and we’ll look into it.

Third parties and data retention

We don’t share personal information with anyone, because we don’t have it. These companies carry MiddleMark’s traffic or run the platform it’s on, and each processes only what it needs to do that:

• Cloudflare hosts our data server and this website (privacy policy).
• Apple provides, on iPhone, the App Store, subscriptions, iCloud, App Attest, Siri and Apple Intelligence, and hosts our support email (privacy policy).
• Google provides, on Android, Google Play and its subscriptions, Android backup and Play Integrity (privacy policy).

None of them receives your answers, scores or ZIP code from us. When you tap Explain the debate on iPhone, your iPhone also contacts the publishers of the linked articles directly, as described above, and reports you send to us travel through your own email provider.

The only outside code in the app is an open-source compression library. The Android app also includes Google Play’s own libraries for delivering the app’s data, for subscriptions and for Play Integrity. None of them is an analytics, advertising or crash-reporting library.

We keep no data about people who use the app, and our servers keep no request logs. Support emails are kept only as long as we need them to help you and follow up, and then deleted.

Your choices and deleting your data

Because your data lives on your devices, you control it directly:

• Change any answer in Your Values.
• Erase all your answers in Settings › Data & Sync › Erase All My Answers…. On iPhone, choose Erase Answers to keep your backups, or Erase Answers and All Backups to delete every backup and everything in Trash for good; with sync on, your answers are cleared on your other devices too, and the scores MiddleMark remembered from them are cleared on this iPhone. On Android, Android’s next backup replaces the old copy. Quiz history stays.
• Reset quiz progress in Learn’s Quiz Settings.
• Delete a backup (iPhone) in Settings › Data & Sync › Current & Earlier Backups. Deleted backups go to Trash, where you can delete them for good. Trash keeps them until you empty it or it reaches its size limit, or you can have it empty itself after 30 days to 4 years.
• Remove the iCloud copy (iPhone) by turning off “Sync my answers across my devices” on each of your devices. Stop the Android backup by turning it off.
• Remove your “I voted” record in Settings › Data & Sync.
• Turn match widgets on or off in Settings › Widgets, and on-screen awareness in Settings › Siri on iPhone. On iPhone, allow or stop cellular downloads in Settings › Data & Sync.
• Delete everything by erasing your answers (and, on iPhone, all backups) and resetting quiz progress, then turning off sync or backup and deleting the app on each device. Delete any backup files you exported, wherever you saved them.

We have no copy of your data, so there is nothing for us to delete on our side.

Your privacy rights

Depending on where you live — including California, other U.S. states, the European Union and the United Kingdom — you may have rights to access, correct, delete or port personal information a company holds about you, and to opt out of its sale or sharing.

We don’t hold personal information about MiddleMark users, so there’s nothing for us to provide, correct or delete. We do not sell or share personal information, and we don’t use it for targeted advertising. You’re still welcome to contact us with any request or question, and we’ll respond.

Do Not Track and Global Privacy Control. Neither the app nor this website tracks you over time or across other sites or apps, and we don’t allow anyone else to. There’s nothing for these signals to switch off, so you get the same privacy whether or not your browser sends them.

Children

MiddleMark is a civic app for adults and isn’t directed at children under 13. It collects no personal information from anyone, including children.

This website

middlemark.app uses no cookies, no analytics and no scripts, and loads nothing from other companies. It’s hosted by Cloudflare, which processes your IP address to deliver pages and protect the site from attacks. We don’t keep visitor logs.

Security

• Your answers are kept encrypted on your phone: in the iOS Keychain and encrypted files protected by iOS data protection on iPhone, and in an encrypted vault on Android.
• On iPhone, the iCloud copy and every backup are encrypted (AES-256-GCM) on the phone before they’re saved, and an exported file is checked by opening it again before it’s saved, so you’re never left with a backup you can’t open. On Android, the answers are encrypted on the phone before they’re backed up, and the backup itself is end-to-end encrypted.
• Data downloads travel over encrypted HTTPS connections.
• App Lock can require Face ID, face unlock, your fingerprint, your passcode or a PIN to open MiddleMark.

Changes to this policy

If we change this policy, we’ll update this page and the effective date at the top. If a change would ever send information about you off your phone, we’ll explain it here and in the app’s release notes before it takes effect.

Contact us

Questions about privacy, or anything else: support@middlemark.app

Kahcozi LLC, maker of MiddleMark · kahcozi.com