City Politics Privacy Policy

Last modified: October 23, 2026

City Politics INC ("City Politics INC," "we," "us" or "our") operates citypolitics.org (the "Marketplace"), where businesses, organizations and campaigns ("advertisers," "you") buy direct ad placements on the City Politics network of sites (Chicago Politics, NYC Politics, Austin Politics, Boston Politics, Seattle Politics, Denver Politics, Philadelphia Politics and Pennsylvania Politics). This Privacy Policy explains what we collect from advertisers and from the readers who see their ads, how we use it, who we share it with, how long we keep it, and your choices. Each network site has its own privacy policy for its readers; this one covers the Marketplace and the direct ads it sells. City Politics INC operates the Marketplace and sells the ads; the Network's sites themselves are operated by Matics Lab INC, which shows the ads City Politics INC sells on them.

Summary

Category	Collected?	Disclosed to service providers?	Sold?
Advertiser identifiers (name, email address, organization, account ID)	Yes	Yes	No
Business and billing details (the payer's name and address for political ads, invoice details you give us)	Yes	Yes (payments, section 4)	No
Payment card numbers	No (handled by Stripe, section 4)	No	No
Your ads (images, headlines, text, links, targeting, dates)	Yes	Yes (hosting)	No
Readers' personal information from direct ads	No. We count ads shown, seen and clicked as daily totals with no identifiers (section 6)	No	No

1. Information we collect from advertisers

Account and sign-in. To use the Marketplace you sign in with your email address. We send a 6-digit code to that address; there is no password. Codes expire after 10 minutes and only a hashed copy is stored. Sign-in uses the same account system as the network's sites (Better Auth), so an account you made on one of them works here too.
Advertiser details. Your name and organization, if you give them, and your email address.
Campaigns. What you buy and what you upload: the campaign's name, sites, placement, format, targeting (page types, wards or districts, articles), dates, A/B setup, the quote, its status and our review notes, payment status, and any refund notes.
Creatives. The images you upload (checked for type, size and dimensions and stored in Cloudflare R2), and the headlines, text, sponsor name and links of your ads.
Political ads. If you mark an ad as political (a candidate, PAC, ballot measure or issue advocacy), the kind of ad, the "Paid for by" line shown on it, and the name and address of the person or organization paying for it. We keep these as records of who paid for political advertising on our sites.
Messages. What you write to us (for example, an invoice request or a question), and our answers.
Log data. Like most websites, our hosting provider processes your IP address, browser and the pages you request to deliver the Marketplace, keep it secure and stop abuse. Sign-in sessions record when they were created, and the IP address and browser they came from. Sessions last up to 30 days.

2. How we use it

To run the Marketplace: sign you in, price and record your campaigns, take payment or send invoices, serve your ads, and report their results to you.
To review ads before they run, enforce our Terms of Use, and keep records of political advertising.
To send you email about your account and campaigns: sign-in codes, payment and invoice notices, approval or rejection, and answers to your messages. We do not send advertisers marketing email without asking.
To keep the Marketplace secure, prevent fraud and abuse, and comply with the law.

3. Cookies and similar technologies

Name or kind	Set by	What it does	How long
Session cookie (`cp.session_token`, with a `__Secure-` prefix)	Us, on citypolitics.org	Keeps you signed in	Up to 30 days
Local storage in your browser	Us	Keeps a draft of the campaign you are building on your device	Until you clear it or submit the campaign
Stripe cookies (on Stripe's checkout page)	Stripe	Process your payment and prevent fraud	See Stripe's policy

The Marketplace itself carries no analytics or advertising tags.

4. Payments

Card payments go through Stripe Checkout, a page hosted by Stripe. You give your card details to Stripe, not to us; we never see or store card numbers. Stripe tells us whether a payment succeeded, its amount, and the email address used, and we keep that with the campaign. Stripe's use of your information is governed by Stripe's privacy policy. If you ask for an invoice instead, we use the details you give us to prepare and send it.

We do not sell or rent advertisers' personal information. We share it only:

with service providers who run parts of the Marketplace for us: Cloudflare (hosting, databases, storage of your uploads, email delivery), Stripe (payments) and Better Auth (sign-in);
in your ads, which are public: the images, text, sponsor name and, for political ads, the "Paid for by" line appear on the network's sites. The payer's name and address are not shown on the ad; we keep them for our records and may disclose them where the law requires;
when the law requires it, or to protect the rights, property or safety of City Politics INC, our users or the public;
in a business transfer, such as a merger or sale of assets, under this policy's protections.

6. Readers who see your ads

Direct ads are images and text we host ourselves, shown in our own ad spaces, with no advertiser code and no third-party cookies. We count, for each ad, how many times it was shown, how many times it was seen (at least half of it on screen for at least one second) and how many times it was clicked, by day, site, type of page, ad size and A/B version. These are counters only: no IP address, account, device identifier or page address is kept, and advertisers see only these totals. A click goes through our own address (/ads/click/…) and then to the advertiser's page, which has its own privacy policy.

Location targeting. Advertisers may target states, cities or ZIP codes. To pick an ad for a page, we use the approximate location our hosting provider (Cloudflare) derives from the reader's IP address (country, state, city and ZIP code) at the moment the ad is chosen. The location is used only for that match: it is not stored, logged, counted or shared with advertisers, and neither is the IP address. Locations derived from IP addresses are approximate.

Counting. Each ad we serve carries a short-lived signed token so that an impression or a click is counted only once and only for an ad we actually served. The token holds the campaign, the version, the site, the type of page, the ad size, the time and a random number, and nothing about the reader. For cost-per-click campaigns, the same token decides whether a click is valid and charged (the first click on that ad, at least a second after it appeared, not from a known bot); we keep only the day's total charged, never who clicked.

For A/B tests, each reader's browser keeps a random letter ("a" or "b") in its local storage (cp_ad_ab) so the reader keeps seeing the same version. It identifies no one, and is sent to us only as that letter, counted in the totals above. Each network site's privacy policy describes this too.

7. How long we keep information

Sign-in codes: 10 minutes. Sessions: up to 30 days.
Your account and advertiser details: until you ask us to delete them.
Campaigns, quotes, payments, invoices and review notes: as long as we need them for the campaign and then for our tax and accounting records, generally seven years.
Political ad records (the kind of ad, the "Paid for by" line, the payer's name and address, the ad itself, its dates and what was paid): at least as long as the law that applies may require, and generally seven years.
Uploaded images: while the campaign runs and as part of its records afterwards. Images you uploaded but never used in a campaign are deleted on request.
Ad counters: kept as aggregate totals, which contain no personal information.
Server logs and rate-limit counters: briefly, typically days. Backups may hold copies for a limited time after deletion.

8. Your choices and rights

You may ask to know and get a copy of, correct, or delete the personal information we hold about you, and you may appeal if we decline. Some records (payments, invoices and political ad records) we must keep even after you close your account; we will tell you what we keep and why. To make a request, or to delete your account, contact us through the contact form or email hello@chicagopolitics.org. We verify a request by confirming you control the email address it concerns, aim to answer within 45 days, and do not discriminate against anyone for using these rights.

9. Children

The Marketplace is for businesses and adults buying advertising. It is not directed to anyone under 18, and we do not knowingly collect personal information from children.

10. Security

We protect information with encrypted connections (HTTPS), sign-in without passwords, sign-in codes stored only as hashes, uploads checked before they are stored, access limited to the people who need it, and rate limits against abuse. No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you as the law requires.

11. Where information is processed

City Politics INC is in the United States, and the Marketplace is intended for advertisers in the United States. Our providers may process information in the United States and other countries where they operate.

12. Changes to this policy

We will post any change on this page and update the "Last modified" date. For a material change, we will tell advertisers by email or on the Marketplace before it takes effect.

13. Contact us

Questions, requests or complaints about this Privacy Policy: use the contact form or email hello@chicagopolitics.org. The operator of City Politics is City Politics INC.