Privacy Policy
Privacy Policy
Effective Date: April 1, 2026
1. Introduction
The Tooele County Republican Party ("we," "us," or "our") operates this website to serve our members, supporters, and the residents of Tooele County, Utah. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our website, create an account, donate, register for events, volunteer, or otherwise interact with our services.
We are committed to protecting your privacy and handling your personal information responsibly. By using our website, you agree to the practices described in this policy.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address (required for authentication)
- First and last name (required during onboarding)
- Display name (optional, for public-facing contexts)
- Phone number (optional)
- Profile photo (optional, stored as an uploaded image)
- Short biography (optional)
- Precinct assignment (optional)
2.2 Preferences and Settings
We store your choices for:
- Notification preferences — which communications you want to receive (email, SMS) and which types (event reminders, news, volunteer opportunities, meeting notices)
- Privacy settings — whether your profile is visible to other members, whether your name appears on event registrations, and whether your display name is used publicly
- Event interests — types of events you're interested in (used to personalize your experience)
- Theme preference — light or dark mode (stored locally in your browser)
2.3 Donation Information
When you make a donation, we collect:
- Donor name and email address
- Mailing address (street, city, state, ZIP code)
- Employer and occupation — required by the Federal Election Commission (FEC) for contributions exceeding $200 in an election cycle
- Donation amount, type (one-time or recurring), and payment method
- Transaction identifiers from our payment processors (Stripe or PayPal)
Federal law requires political committees to report certain donor information to the FEC. See Section 6 for details.
2.4 Volunteer Information
When you sign up to volunteer, we collect:
- Name, email, phone number
- Address, city, and ZIP code
- Precinct (if known)
- Areas of interest and availability
- Estimated hours per month and earliest start date
- Skills and relevant experience
- Whether you have reliable transportation
- Any additional notes you provide
2.5 Event Registration
When you register for events, we collect:
- Registration details — which event, ticket type, number of guests, and any notes
- Attendance status — whether you attended, cancelled, or were waitlisted
- Volunteer role selection — if you volunteer at an event, which role you selected
- Reminder preferences — timing and channel (email or SMS) for event reminders
2.6 Security and Authentication Data
To protect your account, we may store:
- Passkey credentials — public key material for passwordless authentication (your private key never leaves your device)
- Multi-factor authentication data — encrypted TOTP secrets and recovery codes
- Elevation session records — timestamps, method used, and IP address when you access administrative functions
- Login session data — managed by our authentication provider
2.7 Moderation Records
If your account is subject to moderation action, we record:
- Ban type (account, event, or comment restrictions), reason, and duration
- Which administrator took the action and when
- Lift reason if the restriction is removed
2.8 Consent Records
When you accept our Privacy Policy or Terms of Use, we record:
- Which document version you accepted and when
- Your IP address and browser identifier at the time of acceptance
These records are maintained for legal compliance and to demonstrate your informed consent.
2.9 Contact Form Submissions
When you use our contact form, we collect your name, email, phone (optional), subject, and message. Contact form data is used solely to respond to your inquiry.
2.10 Automatically Collected Information
We collect limited technical information to operate the site securely:
- IP address — recorded during security-sensitive actions (MFA elevation, policy acceptance) for audit purposes
- Browser user-agent — recorded alongside IP addresses for the same security audit purposes
- Authentication cookies — session cookies necessary for keeping you logged in (managed by Supabase)
We do not use third-party tracking cookies. We may use privacy-first analytics tools (such as Plausible Analytics) that do not use cookies, do not track individuals across sites, and do not collect personally identifiable information.
3. How We Use Your Information
We use your personal information for the following purposes:
- Account management — creating and maintaining your account, authenticating your identity, and managing your profile
- Event operations — processing registrations, managing waitlists, sending reminders, and tracking attendance
- Donation processing — completing financial transactions, issuing receipts, and fulfilling FEC reporting obligations
- Volunteer coordination — matching volunteers with opportunities, tracking hours, and managing assignments
- Communications — sending event reminders, news updates, volunteer opportunities, and meeting notices based on your notification preferences
- Security — protecting accounts through multi-factor authentication, detecting unauthorized access, and maintaining audit logs
- Legal compliance — meeting federal and state reporting requirements, including FEC filings
- Site improvement — understanding how our site is used to improve functionality and user experience (using aggregate, non-identifying data only)
4. Third-Party Service Providers
We use the following third-party services to operate our website. Each provider receives only the data necessary to perform its function:
4.1 Supabase (Database, Authentication, and Storage)
Our primary infrastructure provider. Supabase hosts our database, manages user authentication, and stores uploaded files (such as profile photos). Supabase's servers are located in the United States. Supabase Privacy Policy
4.2 Stripe (Payment Processing)
Processes credit card and digital wallet donations. When you donate, Stripe receives your payment details, name, email, and address. Stripe is PCI DSS Level 1 compliant — the highest level of payment security certification. We do not store your full credit card number on our servers. Stripe Privacy Policy
4.3 PayPal (Payment Processing)
An alternative payment method for donations, including Venmo. When you pay via PayPal, your payment is processed under PayPal's terms and privacy practices. PayPal Privacy Policy
4.4 Resend / Amazon SES (Email Delivery)
We use email delivery services to send event reminders, volunteer renewal notices, and waitlist notifications. These services receive recipient email addresses and message content. They do not use your email address for their own marketing purposes.
4.5 Twilio / Amazon SNS (SMS Delivery)
If you opt in to SMS notifications, we use SMS delivery services to send event reminders to your phone number. Standard messaging rates from your carrier may apply.
4.6 Google Maps API (Geocoding)
Used by site administrators to look up geographic coordinates for mapping purposes. Individual user data is not sent to Google through this integration.
4.7 Open States API (Representative Data)
Used by site administrators to retrieve publicly available information about elected officials. No user data is sent to Open States.
4.8 Hosting Provider
Our website is deployed on a cloud hosting platform that serves web pages to your browser. The hosting provider may process your IP address as part of standard web traffic delivery.
We do not sell, rent, or trade your personal information to any third party.
5. Cookies and Local Storage
Our site uses a minimal set of cookies and browser storage:
- Authentication session cookies — required to keep you logged in. These are first-party cookies set by our authentication system (Supabase). They are essential for site functionality and cannot be disabled while using authenticated features.
- Theme preference — your light/dark mode choice is stored in your browser's local storage. This data never leaves your device.
- Banner dismissal — when you dismiss a notification banner, a session flag is stored so it doesn't reappear during your visit.
We do not use third-party tracking cookies, advertising cookies, or cross-site tracking technologies.
6. Data Sharing and Disclosure
6.1 FEC Reporting Requirements
As a political committee registered with the Federal Election Commission, we are legally required to report certain donor information. If you contribute more than $200 in aggregate during an election cycle, the following information becomes part of the public record through FEC filings:
- Your name and mailing address
- Your employer and occupation
- The date and amount of your contribution
This is a federal legal requirement under the Federal Election Campaign Act (52 U.S.C. § 30104). We cannot waive this disclosure for contributions above the threshold. The "anonymous" donation option on our site applies only to how your name appears on our website — it does not affect FEC reporting obligations.
Contributor information reported to the FEC is protected from commercial use under federal law (52 U.S.C. § 30111(a)(4)). It is unlawful for any person to use FEC-disclosed contributor information to solicit contributions or for commercial purposes.
6.2 Party Organizations
We may share member and volunteer information with the Utah Republican Party and the Republican National Committee as required for party operations, voter outreach, and coordinated campaign activities.
6.3 Law Enforcement
We will disclose personal information when we believe in good faith that disclosure is required by law, legal process, or court order, or is necessary to protect the rights, property, or safety of our organization, our members, or the public.
6.4 Service Providers
We share data with the third-party service providers listed in Section 4 solely for the purposes described. These providers are contractually obligated to protect your data and use it only for the services they provide to us.
6.5 No Sale of Data
We do not sell your personal information to anyone, for any purpose, under any circumstances.
7. Data Retention
We retain your personal information for the following periods:
| Data Type | Retention Period |
|---|---|
| Account and profile data | Until you request account deletion |
| Donation records | Minimum 3 years after the filing of the FEC report to which they relate, as required by federal law (11 CFR § 102.9) |
| Event registration records | 2 years after the event date |
| Volunteer records | Until the volunteer relationship ends, plus 2 year |
| MFA credentials (passkeys, TOTP) | Until you revoke them or delete your account |
| Moderation records (bans) | Retained permanently for safety and to prevent abuse |
| Security audit logs | 2 years |
| Policy acceptance records | Duration of your account, or as required for legal compliance |
| Contact form submissions | 90 days after response |
When data is no longer needed, it is permanently deleted from our systems. Some data may persist in encrypted database backups for a limited period before those backups are rotated.
8. Your Rights
You have the following rights regarding your personal information:
- Access — You can view your profile data, donation history, event registrations, and volunteer records through your account dashboard and settings pages.
- Correction — You can update your profile information, notification preferences, and privacy settings at any time through your account settings.
- Deletion — You can request deletion of your account by contacting us. Upon deletion, your personal data will be removed, except where retention is required by law (such as FEC donation records).
- Communication preferences — You can opt out of non-essential communications at any time through your notification settings. You can opt out of SMS messages by replying STOP to any message or disabling SMS in your settings.
- Data export — You may request a copy of the personal data we hold about you by contacting us.
To exercise any of these rights, please visit our Contact page or use the relevant settings in your account.
9. Data Security
We implement the following measures to protect your personal information:
- Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
- Encryption at rest — Our database provider encrypts stored data at rest. Sensitive credentials (payment API keys) are additionally encrypted using Supabase Vault.
- Row-Level Security — Our database enforces access controls at the row level, ensuring users can only access data they are authorized to see.
- Multi-factor authentication — Administrative accounts require MFA (passkey or TOTP) to access sensitive functions.
- Rate limiting — Security-sensitive operations are rate-limited to prevent brute-force attacks.
- Audit logging — Access to sensitive infrastructure (such as payment credentials) is logged for security review.
While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
10. Children's Privacy
Our website is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. You must be at least 18 years of age to create an account or make a donation.
If we discover that we have inadvertently collected personal information from a child under 13, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us immediately through our Contact page.
11. Political Activity and Sensitive Data
By creating an account on this website, you are associating yourself with the Tooele County Republican Party. This may be considered sensitive information related to your political opinions.
We treat this association with care:
- Your membership and participation history are used solely for party operations (event coordination, volunteer management, and internal communications).
- We do not publicly disclose your political participation without your consent, except as required by law (such as FEC donation disclosures above the reporting threshold).
- Your privacy settings allow you to control the visibility of your profile information to other members.
12. SMS and Text Messages
If you opt in to SMS notifications:
- Consent — You must explicitly enable SMS notifications in your account settings. We will never send you text messages without your prior opt-in consent.
- Opt-out — You may opt out at any time by replying STOP to any message, or by disabling SMS notifications in your account settings.
- Frequency — Message frequency varies based on your reminder preferences and upcoming events.
- Costs — Message and data rates may apply according to your mobile carrier's pricing.
- Compliance — Our SMS practices comply with the Telephone Consumer Protection Act (TCPA).
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make changes:
- We will publish the updated policy on this page with a new effective date and version number.
- For material changes, we will provide notice through the website (such as a banner or notification requiring your acknowledgment).
- Previous versions of this policy will remain available for review through the version history on this page.
Your continued use of the website after changes are posted constitutes your acceptance of the updated policy. For material changes, we will ask you to review and re-accept the policy before continuing to use authenticated features.
14. Contact Us
If you have questions about this Privacy Policy, your personal data, or our privacy practices, please reach out through our Contact page.
You may also write to us at:
Tooele County Republican Party 65 N. Main St, #151 Tooele, Utah 84074
Paid for by the Tooele County Republican Party. Not authorized by any candidate or candidate's committee.