Privacy Policy

1. Who We Are

MyGOPHub (the “Platform”) is operated by the GOP Cherokee (the “County Committee”), with platform infrastructure operated by the platform owner (collectively, “we,” “us,” or “our”). This Privacy Policy describes how we collect, use, share, and protect personal information of members and visitors who use the MyGOPHub mobile and web applications (the “Service”).

Contact:

• Email: privacy@mygophub.com
• Postal: Cherokee County Republican Party, Canton, Georgia

2. Scope

This Privacy Policy applies to all use of the Service, including the marketing site (mygophub.com), the member application (app.mygophub.com, iOS, Android), and the backend services that support them.

This platform serves United States residents. It does not currently provide GDPR-compliant data-subject access request handling for residents of the European Union or other jurisdictions with comparable regimes. If you are a resident of such a jurisdiction, do not create an account.

3. Information We Collect

3.1 Account information

When you create an account we collect:

• Full name, email address, phone number (optional)
• Password (stored only as a salted bcrypt hash; we never store your password in clear text)

3.2 Profile information

After sign-up you may add:

• Mailing address (street, city, state, ZIP)
• Civic district information (federal congressional district, state house district, state senate district), derived from your address via the Google Civic Information API
• Interests and mailing-list opt-ins (local, state, national)
• Demographic interests you choose to share

3.3 OAuth identity data

If you sign in using Google, Apple, Facebook, or Firebase, the identity provider asserts to us:

• The provider name (Google / Apple / Facebook / Firebase)
• The provider’s user identifier
• The email address the provider has on file for you

We do not receive your password from these providers.

3.4 Device and session data

To keep your account secure we record:

• Trusted-device fingerprints when you mark a device as trusted
• IP address, browser, and operating system used at sign-in
• Short-lived session tokens (see Section 10)

3.5 Payment data

All payments are processed by Stripe, Inc. Stripe collects and stores your full payment-instrument information (card number, bank account, etc.). We store only:

• Stripe customer and payment identifiers
• Where applicable, the card brand and last four digits Stripe returns to us
• Transaction amount, currency, and status

We never see or store your full payment-instrument details.

3.6 Candidate application data

If you apply to run as a candidate, we additionally collect the data fields required by your candidate application (office sought, biography, photo, campaign committee details, FEC identifiers where applicable). Stripe Express performs Know-Your-Customer (“KYC”) verification on candidates who accept donations through our Platform; that verification is governed by Stripe’s own privacy notice.

3.7 Audit-log data

We log administrative actions taken by or affecting your account (for example, role changes, admin impersonation events, donation processing events) so that we can investigate disputes and meet our recordkeeping obligations.

4. How We Use Your Information

We use the information described above to:

• Create and maintain your member account
• Show you content, events, candidates, and elections scoped to your county and civic districts
• Send you transactional email through SendGrid, Inc. (password resets, RSVP confirmations, message notifications, donation receipts)
• Send mailing-list email you have opted in to (local, state, national)
• Process donations, event tickets, sweepstakes entries, ad-campaign purchases, and subscription billing through Stripe
• Support OAuth sign-in via Google, Apple, Facebook, and Firebase
• Look up your civic districts via the Google Civic Information API
• Surface public candidate and election data sourced from the Federal Election Commission (“FEC”), Open States, and Congress.gov
• Monitor application errors and uptime via Sentry / GlitchTip
• Store media files and audit logs in Amazon Web Services Simple Storage Service (“AWS S3”)

5. Third-Party Service Providers

We share the minimum information necessary with the following providers to deliver the Service:

We do not sell your personal information.

We do not share your personal information with data brokers, advertising networks, or any party not listed above.

6. Political Information and Legal Basis

By creating an account on a Republican Party platform you are voluntarily joining a political organization. We process information that reflects your political viewpoint (party affiliation, candidate support, donations, opt-ins) on the basis of your explicit, informed opt-in at the time you create your account.

7. Children

The Service is intended for users aged 16 or older. We do not knowingly collect personal information from anyone under 16. If you believe a person under 16 has created an account, please contact privacy@mygophub.com and we will delete the account.

8. Data Retention

• Active accounts. We retain your account data for as long as your account is active.
• Account deletion. You may delete your account from inside the application via Profile > Security > Delete Account. Deletion uses a seven (7) day cooldown window during which you may cancel; after the cooldown expires, account data is hard-deleted from our primary database. Some derivative records (audit logs, donation records) are retained as described below.
• Audit logs. Administrative-action audit logs are retained for seven (7) years, consistent with political-organization recordkeeping practices.
• Donation records. Donation records are retained per IRS and FEC retention rules: a minimum of three (3) years for donations of $200 or less, and a minimum of seven (7) years for itemized contributions of more than $200.
• Backups. Routine database backups age out on the standard backup retention cycle and are not separately purged on account deletion.

These are committed maximum-retention periods. The Platform may, in the future, run scheduled purge jobs to enforce them; the current implementation is append-only for audit and donation records.

9. Your Rights

You may:

• Access the personal data we hold about you by signing in to your account; most fields are visible and editable in the Profile screen.
• Correct your account data via Profile > Edit Profile.
• Delete your account via the in-app deletion flow described in Section 8.
• Opt out of mailing-list email at any time via Profile > Notification Preferences or by following the unsubscribe link in any of our email messages. Transactional email cannot be unsubscribed while your account is active.
• Request a copy of your data by emailing privacy@mygophub.com. We will respond within a reasonable period.

10. Security

• Passwords are hashed using bcrypt (cost 10) at the application layer per our internal PASSWORD_HASHING_STANDARD. We never store, log, or transmit your password in clear text.
• All traffic between your device and our servers is encrypted in transit using TLS.
• Our PostgreSQL database is encrypted at rest by Render.
• AWS S3 buckets used for media and audit-log storage are configured for server-side encryption at rest.
• Administrative actions on your account are written to the audit log.

Session and cookies

Sign-in uses three time-bounded credentials:

• Access token. A short-lived JSON Web Token, expiring fifteen (15) minutes after issuance.
• Refresh token. A longer-lived token used to mint new access tokens, expiring thirty (30) days after issuance and revoked when you sign out.
• Trusted-device cookie (mygop_trusted_device). Set only when you explicitly mark a device as trusted on sign-in. Expires ninety (90) days after issuance and may be revoked at any time from Profile > Security > Trusted Devices.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will be revised when we do. For material changes that affect your rights or the categories of data we process, we will additionally notify you through an in-app notice or transactional email.

12. Contact

Privacy questions, deletion requests, and data-copy requests:

• Email: privacy@mygophub.com
• Postal: Cherokee County Republican Party, Canton, Georgia