Privacy policy

Who we are

CouncilTracer is built and operated by Darren Kruse (Kruse Legal), Adelaide, South Australia. For anything in this policy — questions, corrections, deletion requests — email darren@kruselegal.com.au.

What we collect

• If you sign in.When you sign in with a six-digit email code (or, when enabled, Google or Facebook) we receive and store your email address, display name, and the provider's internal account identifier. We never see or store a password. We also record your account tier and when you last signed in.
• If you don't sign in. You do not need an account to use CouncilTracer. The first time you ask a question we create a record identified only by a random number kept in a cookie on your device (ct_sid). That record holds no name, no email address and no postal address — we do not know and cannot find out who you are. It exists so that your own questions and reports are still there when you come back, and so the daily limits work. Signing in later links that work to your account, and we ask before doing so.
• Your questions and the answers, during the beta. The raw text of your question is never written to a file, a log, or a database — anywhere. It is handled only in working memory while your answer is being generated. Before anything is stored, the question passes through an automated personal-information redaction filter that replaces names, street addresses, phone numbers, email addresses, account numbers and similar details with typed placeholders (for example <PRIVATE_ADDRESS>). The redaction runs on our own hardware, with a secure cloud fallback if that hardware is unavailable; if neither can run, the question text is withheld entirely rather than stored unfiltered. The same treatment is applied to the search wordings the system derives from your question before they reach our performance logs. Answers are stored as generated — their content comes from the council's public record. What's stored is also automatically deleted after 60 days(see “How long we keep it”). One honest caveat: no automated filter is perfect, and the live question is processed transiently by the providers listed under “Where your information goes”.
• Feedback. If you rate an answer (thumbs up/down) we store the rating and any comment you type, linked to the answer it describes. Comment text is automatically deleted after 60 days; the rating itself is kept.
• Timeline reports. Reports you create are stored (title, report text, and the source list) so you can come back to them.
• Usage telemetry.We record how long searches take, whether they succeed, and the system's internal interpretation of each question (search terms and filters) — for performance and quality monitoring. The interpretation detail (which is derived from your question text) is automatically deleted after 60 days; the timing and success/failure figures are kept.
• Cookies. A sign-in session cookie; ct_sid, the random identifier described above, which lasts 180 days, cannot be read by scripts in your browser, and contains no information about you; plus two small preference cookies: ct_welcomed(you've seen the welcome page) and ct_prefs(interface preferences, e.g. “don't ask me again” choices). Cloudflare's browser check sets its own cookie when it runs (see below). Your light/dark theme choice stays in your browser's local storage and is never sent to us. There are no analytics or advertising trackers of any kind.
• IP addresses. We do not store your IP address and the chat service does not log it. There is one exception, and it is a disclosure rather than a storage: when you build a timeline report without signing in, your browser is checked by Cloudflare Turnstile to confirm you are not an automated script, and that check sends your IP address and some technical details about your browser to Cloudflare. We receive only a pass or fail. An older document-request form did record an email and IP address with each request; it is being retired.

Why we collect it

To answer your questions; to apply fair-use daily limits; to see, during the beta, whether answers are actually good and where the document corpus has gaps; and to keep the service fast and working. Nothing is collected for advertising, profiling, or resale — we never sell or trade your information, and no advertiser, analytics company, or data broker receives anything.

Where your information goes

CouncilTracer runs on infrastructure providers who process data on our behalf:

• An LLM provider (currently via OpenRouter). To generate an answer, your question text and excerpts of the (already public) council documents are sent to a large-language-model provider and processed transiently — this is inherent to how the service works. Nothing we store from that exchange contains your raw question: on our side, storage only ever sees the redacted form.
• Cloudflare.Hosts the application, computes search embeddings of your question (Workers AI), and stores the council's public PDFs (R2). Cloudflare also runs the Turnstile browser check in front of a timeline report when you are not signed in: that check receives your IP address and technical details about your browser, and sets its own cookie. Signing in skips the check entirely.
• Supabase.The database that holds everything listed under “What we collect”.
• Your sign-in provider (Microsoft, and when enabled Google or Facebook) — used only to prove who you are; we don't post to, read from, or otherwise touch your account.

How long we keep it

Raw text is deleted automatically after 60 days.A nightly job permanently removes, for anything older than 60 days: the text of your questions and answers (and the search representation derived from them), feedback comments, and the system's per-question interpretation details. What remains after 60 days is aggregate-only — dates, counts, timings, success/failure status, and thumbs-up/down ratings — which cannot be traced back to what was asked. One exception, so your saved reports keep working: when you build a timeline report, the questions and answers behind it — including the documents they cited — are copied into the report itself. Each report holds its own copy, and building a new version of a report carries that copy forward into the new version too. Deleting a report deletes its own copy; if the same text has already been carried into other versions, those versions keep their own copies until you delete them separately.

• Your account (email, name, tier) is kept while you have one — deleted on request.
• An anonymous session record is kept while the cookie lasts (180 days), and is removed once it has gone unused for that long. Because it holds nothing that identifies you, there is an honest limit worth stating plainly: if you clear the cookie we can no longer find your data in order to delete it on request, and we cannot prove a particular record is yours. That is the trade-off of not signing in, and it is by design rather than an oversight — signing in is what gives you a handle on your own work.
• Timeline reports you create are yours: they're kept until you delete them or ask us to.

Your choices

• You don't need to police your questions for our sake — personal details are redacted before anything is written, and the raw text never reaches a file. Feedback comments are different: they are stored as typed, so please keep personal information out of those.
• Email darren@kruselegal.com.au to see what we hold about you, correct it, or have it deleted — during the beta this is a manual process and we'll turn it around promptly.
• You can stop using the service at any time; on request we'll delete your account row and your logged questions, answers, feedback and reports.
• Using it without an account. Clearing your browser cookies for this site ends the anonymous session and starts a fresh one; your profile page also has a “start a fresh session” control, which is worth using on a shared or public computer, since the cookie otherwise lasts 180 days and the next person would see the previous person's questions.

Changes to this policy

Updates are posted on this page with a new date; material changes will be flagged in the app. See also our scraping & transparency policy for how the underlying council documents are collected.

Last updated: 30 August 2026 — CouncilTracer no longer requires an account. This revision describes what that changes: the anonymous session record and itsct_sid cookie, the Cloudflare Turnstile browser check in front of a report (which sends your IP address to Cloudflare, the one place your IP goes), how long an anonymous session is kept, the plain limit that we cannot find your data to delete it once the cookie is gone, and the control for ending a session on a shared computer. We still do not store your IP address and the chat service does not log it. Earlier (13 July 2026): the raw text of a question is handled in memory only and never written to any file or log; the redaction filter also covers the search wordings derived from a question before they reach our performance logs; the automated personal-information redaction of questions before storage, and the 60-day automatic deletion of stored question, answer, comment and interpretation text.