Privacy policy

Who we are

CouncilTracer is built and operated by Darren Kruse (Kruse Legal), Adelaide, South Australia. For anything in this policy — questions, corrections, deletion requests — email darren@kruselegal.com.au.

What we collect

• Your account.When you sign in with Microsoft (or, when enabled, Google or Facebook) we receive and store your email address, display name, and the provider's internal account identifier. We never see or store a password. We also record your account tier and when you last signed in.
• Your questions and the answers, during the beta. The raw text of your question is never written to a file, a log, or a database — anywhere. It is handled only in working memory while your answer is being generated. Before anything is stored, the question passes through an automated personal-information redaction filter that replaces names, street addresses, phone numbers, email addresses, account numbers and similar details with typed placeholders (for example <PRIVATE_ADDRESS>). The redaction runs on our own hardware, with a secure cloud fallback if that hardware is unavailable; if neither can run, the question text is withheld entirely rather than stored unfiltered. The same treatment is applied to the search wordings the system derives from your question before they reach our performance logs. Answers are stored as generated — their content comes from the council's public record. What's stored is also automatically deleted after 60 days(see “How long we keep it”). One honest caveat: no automated filter is perfect, and the live question is processed transiently by the providers listed under “Where your information goes”.
• Feedback. If you rate an answer (thumbs up/down) we store the rating and any comment you type, linked to the answer it describes. Comment text is automatically deleted after 60 days; the rating itself is kept.
• Timeline reports. Reports you create are stored (title, report text, and the source list) so you can come back to them.
• Usage telemetry.We record how long searches take, whether they succeed, and the system's internal interpretation of each question (search terms and filters) — for performance and quality monitoring. The interpretation detail (which is derived from your question text) is automatically deleted after 60 days; the timing and success/failure figures are kept.
• Cookies. A sign-in session cookie, plus two small preference cookies: ct_welcomed(you've seen the welcome page) and ct_prefs(interface preferences, e.g. “don't ask me again” choices). Your light/dark theme choice stays in your browser's local storage and is never sent to us. There are no analytics or advertising trackers of any kind.
• Legacy document-request form. An older feature recorded an email address and IP address with each request; it is being retired. The chat service does not log IP addresses.

Why we collect it

To answer your questions; to apply fair-use daily limits; to see, during the beta, whether answers are actually good and where the document corpus has gaps; and to keep the service fast and working. Nothing is collected for advertising, profiling, or resale — we never sell or trade your information, and no advertiser, analytics company, or data broker receives anything.

Where your information goes

CouncilTracer runs on infrastructure providers who process data on our behalf:

• An LLM provider (currently via OpenRouter). To generate an answer, your question text and excerpts of the (already public) council documents are sent to a large-language-model provider and processed transiently — this is inherent to how the service works. Nothing we store from that exchange contains your raw question: on our side, storage only ever sees the redacted form.
• Cloudflare.Hosts the application, computes search embeddings of your question (Workers AI), and stores the council's public PDFs (R2).
• Supabase.The database that holds everything listed under “What we collect”.
• Your sign-in provider (Microsoft, and when enabled Google or Facebook) — used only to prove who you are; we don't post to, read from, or otherwise touch your account.

How long we keep it

Raw text is deleted automatically after 60 days.A nightly job permanently removes, for anything older than 60 days: the text of your questions and answers (and the search representation derived from them), feedback comments, and the system's per-question interpretation details. What remains after 60 days is aggregate-only — dates, counts, timings, success/failure status, and thumbs-up/down ratings — which cannot be traced back to what was asked. One exception, so your saved reports keep working: when you build a timeline report, the questions and answers behind it — including the documents they cited — are copied into the report itself. Each report holds its own copy, and building a new version of a report carries that copy forward into the new version too. Deleting a report deletes its own copy; if the same text has already been carried into other versions, those versions keep their own copies until you delete them separately.

• Your account (email, name, tier) is kept while you have one — deleted on request.
• Timeline reports you create are yours: they're kept until you delete them or ask us to.

Your choices

• You don't need to police your questions for our sake — personal details are redacted before anything is written, and the raw text never reaches a file. Feedback comments are different: they are stored as typed, so please keep personal information out of those.
• Email darren@kruselegal.com.au to see what we hold about you, correct it, or have it deleted — during the beta this is a manual process and we'll turn it around promptly.
• You can stop using the service at any time; on request we'll delete your account row and your logged questions, answers, feedback and reports.

Changes to this policy

Updates are posted on this page with a new date; material changes will be flagged in the app. See also our scraping & transparency policy for how the underlying council documents are collected.

Last updated: 13 July 2026 (the raw text of a question is now handled in memory only and never written to any file or log; the redaction filter also covers the search wordings derived from a question before they reach our performance logs; added the automated personal-information redaction of questions before storage, and the 60-day automatic deletion of stored question, answer, comment and interpretation text).