Privacy Policy

1. Overview

Forthwith helps verified people participate in public discussion and action. We collect only what we need to operate the service, keep accounts secure, and meet legal and safety obligations.

This policy describes our practices for the Forthwith web app and related services. It does not cover third-party sites you reach through links or embeds.

2. Data we collect

Depending on how you use Forthwith, we may collect:

• Account data: email, password hash, sign-in method, preferred locale, account status.
• Verification data: results and metadata from identity verification (through Stripe Identity). Government ID images stay with the verification provider unless law requires otherwise.
• Profile and participation data: display name, handle, bio, avatar, declared home region, posts, replies, responses to Posts, positions, tool responses, drafts, and settings you choose.
• Usage and device data: log data, IP address, browser type, approximate region signals, and security events.
• Communications: support messages and service emails.
• Payment-related data: if you use paid features later, billing identifiers processed by our payment provider.

3. How we use data

We use personal data to:

• Create and secure your account.
• Verify personhood and reduce duplicate accounts.
• Publish and display content according to your identity mode and visibility rules.
• Operate search, feeds, activity, moderation, and safety systems.
• Send service messages (verification, security, account status).
• Comply with law, respond to legal requests, and enforce our terms.
• Improve reliability, prevent abuse, and measure aggregate performance.

4. Legal bases (where applicable)

Where privacy law requires a legal basis, we rely on contract performance (providing the service you requested), legitimate interests (security, fraud prevention, product improvement), consent (where we ask for it explicitly), and legal obligation.

5. When we share data

We do not sell your personal data.

We share data with service providers that help us run Forthwith (hosting, identity verification, email, analytics, moderation tooling) under contracts that limit their use.

Public posts and profile fields you choose to make public are visible to visitors and may appear in search engines, feeds, and shared links according to our public read rules.

We use Google Tag Manager on the live site to measure how the site is used. It does not run on account, settings, or staff pages, and you can turn it off at the bottom of this page. The choice is stored only in your browser.

We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition with notice where required.

We do not give out who you are, where you live, or what you did on Forthwith because someone asks informally. We require valid legal process, review each request, push back on requests that are too broad, and tell you before we hand anything over when the law allows.

6. Public and private boundaries

Drafts, verification documents, precise location, constituency details, contact launch history, moderation notes, and accountability fields are not public.

Private posts use a generic public author presentation. Public pages and metadata must not expose the accountable actor behind a Private post. Private does not mean anonymous to Forthwith: we still know which account posted.

Embeds and third-party frames load only under applicable consent and policy. Providers may receive browser and network data when you activate an embed.

7. Retention

We keep data only as long as needed for the purposes above. Examples from our current retention schedule:

• Verification result metadata: account lifetime plus 24 months after deletion.
• Hashed uniqueness signals: 24 months after deletion.
• Unpublished drafts: 30 days after last update.
• Flags, moderation actions, and appeals: up to 7 years.
• Contact launches: 24 months.
• Privileged audit logs: up to 7 years.

8. Your choices

You can update many profile and settings fields in the app.

You can request account deletion in settings. Deletion includes a grace period you may cancel. Some public posts may remain with a deleted member presentation to preserve discussion integrity.

You may opt out of non-essential emails where the product provides controls.

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Contact us to exercise those rights.

9. Security

We use technical and organizational measures to protect data, including access controls, encryption in transit, and separation of sensitive verification data from public profile data.

How we limit what our own team can do, and which protections are not finished yet, is explained in plain words on our Trust page at /trust.

No method of transmission or storage is perfectly secure. Report suspected account compromise to support@forthwith.me.

10. Children

Forthwith is not directed to children under 18. We do not knowingly collect personal data from children under 18. If you believe a child provided data, contact us and we will take appropriate steps.

11. International use

Forthwith is operated from the United States. If you use the service from another country, your data may be processed in the United States and other countries where our providers operate.

Launch countries may expand over time. Regional privacy rules may apply additional rights or restrictions.

12. Changes to this policy

We may update this policy from time to time. We will post changes on this page and update the last updated date. Material changes will be communicated where appropriate.

13. Contact

Privacy questions or requests: support@forthwith.me

Site analytics

Site analytics are on for this browser.