The Gallery — Privacy Policy

Where we are right now

The Gallery app — accounts, your representatives, your ballot, your civic record — is not live yet. Today, thegallery.vote is a marketing site with a waitlist.

That means this policy has two parts:

What we collect today — the site as it exists right now.
When the app launches — the rules that will govern the full platform, published now so you can hold us to them before we ship. Sections marked [ACTIVE AT APP LAUNCH] don't apply yet; they take effect when the app does, and we'll update the effective date and notify the waitlist when that happens.

Part 1: What we collect today

The waitlist

If you join the waitlist, we store your email address, along with the standard metadata that comes with any web request: your IP address, browser user-agent, country, the page you came from, and a timestamp. The email is the point; the metadata exists only for abuse prevention and de-duplication, and a separate per-IP rate-limit record deletes itself within an hour.

Signups are stored in Cloudflare Workers KV, the storage layer of Cloudflare, which hosts this site.
When someone signs up, an alert goes to our team through Roam, our internal messaging tool. The alert contains the signup email address and country and is visible only to our team.
We use your email for one thing: telling you about The Gallery — launch news and product updates. We never sell it or share it with advertisers or data brokers. It is handled only by the service providers named in the table below, to operate the waitlist.
How long we keep it: until launch outreach ends or you ask us to delete it, whichever comes first.
Want off the list? Email privacy@thegallery.vote and we'll delete it. No hoops.

Site analytics

We use Microsoft Clarity to understand how people use this site — heatmaps and session recordings showing where visitors click, scroll, and how they move through pages. We use it to see where the site confuses people. We do not use it to identify visitors, and we do not connect Clarity data to waitlist emails.

The details, plainly:

Form inputs are masked. The email you type to join the waitlist is masked in recordings — Clarity never captures what you type there.
Clarity collects data through first- and third-party cookies, and Microsoft may also use it for its own purposes, such as improving its products, under Microsoft's privacy statement. That's the deal with a free analytics tool, and we'd rather say so than link past it.
Retention: Microsoft keeps individual session recordings for 30 days and aggregated analytics for up to 13 months, per Clarity's standard retention.
Opt-out signals: we don't track you across other sites, sell data, or share it for advertising — so there is nothing for a Global Privacy Control or Do Not Track signal to switch off. Browsers sending those signals are treated the same as everyone else: not tracked across sites, not sold, not shared.

We also use Google Analytics 4 for basic traffic measurement — how many people visit, which pages they read, and roughly where they arrive from. It runs with IP anonymisation on, we do not use it for advertising or remarketing, and we do not connect it to waitlist emails. Google processes this data under its own terms and may use it to improve its services; Google's privacy policy covers that. Google keeps event-level analytics data for up to 14 months.

Hosting

The site runs on Cloudflare Pages. Cloudflare logs IP addresses and request data to serve and secure the site; we don't use these logs to identify or profile visitors, and they are retained on Cloudflare's standard short rolling window.

What we don't do today

No accounts, no passwords, no profiles.
No selling your email, and no sharing it with anyone beyond the named service providers that operate the waitlist.
No advertising trackers.
No collecting anything beyond what's listed above.

Part 2: When the app launches

[ACTIVE AT APP LAUNCH] — these sections describe the app, which is not yet live. We're publishing them now so the rules exist before the product does.

The two-track model — the heart of how The Gallery handles data

The Gallery is free. It stays free because of one trade, and we want you to understand it exactly.

We treat everything about your political views as sensitive data: nothing individually identifying is processed without your opt-in (Track B), and Track A exists only in deidentified aggregate form — which is why it can be on by default.

Track A — the aggregate picture (on by default).
When people use The Gallery, an anonymized, collective picture emerges: how the country leaned on a bill, what issues a region cares about. Selling that group-level insight is our revenue model. The hard rules:

Aggregate data is never individually identifiable. It exists only as group-level insight.
We enforce a minimum cohort size: no aggregate is ever shown or shared for a group so small that individuals could be picked out of it. A ZIP code with a handful of users is not an aggregate, and we won't treat it like one. Before the app ships, this minimum will be enforced in the query layer itself — the system will be unable to return an aggregate below the threshold — and no aggregate will ever be shown or sold without it.
ZIP-level is the finest geographic detail we ever use — never anything smaller. A ZIP code is not a person.

Track B — your individual data (off by default, yours to turn on).
Anything tied to you personally — your ZIP code, the bills and topics you follow, your notification settings, your saved ballot, your private reasoning notes, your civic record — is Track B. The rules:

Off by default. You turn each piece on yourself, when it's useful to you ("add your ZIP to see your reps"). We explain what each one does and who sees it at the moment we offer it — not buried here.
Never sold. Ever. Not to advertisers, not to campaigns, not to data brokers, not to anyone. There is no price at which your individual political data is for sale.
Your ballot picks and your "why" notes are private to you. They are never included in any aggregate — even an anonymous one — unless you explicitly opt in.
You can turn any of it off, or delete all of it, at any time.
How long we keep it: while your account exists. When you delete your account, Track B data is deleted within 30 days.

One sentence to remember: aggregate the insight, never the identity.

ZIP code, never your address

The Gallery runs on your ZIP code — your representatives, your ballot, your elections all come from it. We will never ask for or store your home address. A ZIP is enough to deliver the value, and we deliberately hold less about you than we could; what we do hold, we treat as the sensitive political data it is. If your ZIP spans two districts, we'll ask which one is yours — we store your answer (a district), never anything more precise than your ZIP.

Signing in

Sign-in options: Google, Apple (including Hide My Email), or plain email.
We do not offer Facebook login and never will. We keep sign-in to providers whose only role here is authentication.
Accounts require you to be at least 13.
An account is never required to read and understand legislation. The platform is open; an account only adds personal features you choose.

Connections we will and won't make

Calendar: write-only. If you want, we'll add an event to your calendar — election day, a town hall, a scheduled vote. We can only add; we can never read your calendar. Ever.
Contacts: no. We will never ask for access to your address book. Sharing with people you know goes through your phone's own share sheet — your apps, your contacts, none of it touching us.
Every connection exists to unlock something specific for you, is explained when offered, and can be disconnected anytime.

What "never sold" covers, precisely

Track B — anything identifying you individually — is never sold, licensed, rented, or shared for value. Track A aggregate insight (which is our business) is only ever sold as group-level, cohort-protected, non-identifiable data. Three commitments make that binding:

We commit to keeping aggregate data deidentified and to never attempting to reidentify anyone in it. Every buyer is contractually barred from attempting reidentification, and that contract is a condition of every deal.
Before launch, we will publish — as part of this policy — exactly who can and cannot buy aggregate insight, including whether campaigns, parties, and PACs are on that list. If a buyer or use would compromise the platform's neutrality or your anonymity, we don't do the deal.
These commitments bind any successor. If AGYL AI is ever acquired, merges, or shuts down, Track B data transfers only under these same rules — or is deleted, not handed over.

Legal requests (today and always)

"Never sold" is not the same as "never disclosed," so here is the disclosure rule too. We only turn over data in response to valid legal process — a subpoena, court order, or warrant. We push back on requests that are overbroad, we disclose the minimum the law requires, and we notify you unless the law forbids it. When the app launches, we will publish a transparency report covering any such requests. Today, the most anyone could compel from us is a waitlist email and its signup metadata — and that smallness is by design.

Children

The Gallery is not directed to children under 13, and we don't knowingly collect their data. If we learn a child's email is on the waitlist — a parent can just write to privacy@thegallery.vote — we'll delete it. At launch, accounts will require a minimum age of 13.

Your rights (today and always)

You can, at any time:

Ask what we have about you. We'll tell you, specifically.
Ask for a copy of it in a usable format. Today that's trivially your email; after launch, an export of your Track B data.
Ask us to delete it. Today that means your waitlist email and signup record; after launch it means your account and all Track B data. Deletion removes your data from live systems immediately; residual copies in backups purge within 30 days. We may retain the minimum needed to meet a legal obligation or prevent abuse — and if that applies to your request, we'll tell you.
Ask us to correct it.
Withdraw any consent you've given — leave the waitlist, turn off any Track B setting, disconnect any connection.

Send any request to privacy@thegallery.vote. How it works:

To protect you, requests must come from — or be confirmed through — the email address we have on file, or otherwise verified before we act. For access requests, we only ever send data to the verified address. An authorized agent may act for you with your written permission.
We'll respond within 45 days.
If we refuse a request, we'll say why, and you can appeal by replying — a different person will review it.
Exercising any of these rights never costs you anything or changes how the product treats you.

We honor these rights — including those under GDPR and state privacy laws like the CCPA — for everyone, regardless of where you live.

The services we use

We name them because you should know exactly who touches your data:

Service	What it does	What it sees
Cloudflare	Hosts the site; stores waitlist signups (Workers KV)	Standard hosting logs; the signup record (email plus the request metadata listed above)
Microsoft Clarity	Site analytics (heatmaps, session recordings)	How visitors use the site; form inputs, including your email, are masked
Google Analytics 4	Traffic measurement (visits, pages, referrers)	Aggregate usage with IP anonymisation; not linked to waitlist emails, not used for ads
Roam	Internal team alert on new signups	The signup email address and country, in an alert visible only to our team

Cloudflare and Roam process this data only to provide their service to us. The analytics tools are the exception — Microsoft and Google also use analytics data for their own purposes, as disclosed above. When the app launches, we'll update this list before adding anything to it.

Changes to this policy

If we change this policy, we'll update the effective date at the top and, for anything meaningful, tell the waitlist and (after launch) notify you in the app. We won't quietly move the lines — especially not the ones in the two-track section. Those are the product.

Contact

privacy@thegallery.vote

The Gallery is operated by AGYL AI, a United States company and the data controller for everything described here. Email reaches us fastest; we'll provide a mailing address on request. If something in this policy worries you, or something we're doing doesn't match what's written here, we want to hear about it — that's the whole point of writing it plainly.

We make money from what America thinks in aggregate — never from you individually.