← Back to Cactus Watch

Privacy Policy

Last updated: March 2026

Cactus Watch is a free, open-source civic tool built to help Arizonans follow legislation. It is not a commercial product. We have no interest in monetizing your data, and this policy reflects that.

What we collect

• Account information: When you sign in, we receive your name and email address from your authentication provider (Google) or from the email you use for magic-link login. We use this solely to identify your account.
• Bill tracking lists: The lists you create and the bills you add to them are stored so you can access them across devices.
• IP address: We log IP addresses temporarily for rate limiting and abuse prevention. These are not stored long-term or tied to your account.

Why we collect it

• Authentication: Your email and name let us create and manage your account.
• Personalized tracking: Your bill lists are stored server-side so they persist across sessions and devices.
• Rate limiting: IP-based rate limiting prevents abuse of the service.

How we store it

• All data is stored in Cloudflare D1, a serverless SQL database with encryption at rest.
• The application runs on Cloudflare Workers at the edge, so your data never touches a traditional server.
• Session tokens are stored as HttpOnly cookies and cannot be accessed by JavaScript.

Cookies

• Session cookie (cactus_session): An HttpOnly, Secure cookie set on .cactus.watch with a 30-day expiry. This identifies your session. It cannot be read by client-side JavaScript.
• Local storage: We use browser localStorage to cache your display name and UI preferences (like list view state). This data never leaves your browser.

Third-party services

• Google OAuth: If you sign in with Google, Google processes the authentication. We only receive your name and email. See Google's privacy policy.
• Resend: We use Resend to deliver magic-link login emails. See Resend's privacy policy.
• Cloudflare: Our infrastructure runs on Cloudflare. See Cloudflare's privacy policy.

What we do NOT do

• We do not run analytics or tracking scripts.
• We do not use ad networks or advertising pixels.
• We do not sell, share, or trade your data with anyone.
• We do not profile you or build behavioral models.
• We do not send marketing emails. The only emails you receive are magic-link login codes.

Deleting your account

To delete your account and all associated data, email privacy@cactus.watch from the email address on your account. We will delete your data within 7 days.

Open source

Cactus Watch is open source under the MIT License. You can inspect exactly what the code does at github.com/az-civic-tools/az-civic-tools.

Changes

If we make meaningful changes to this policy, we will update the date at the top. Since this is a civic tool with a small user base, we are not going to clutter your inbox with policy update emails.

Contact

Questions about this policy? Email privacy@cactus.watch.