Privacy information
Privacy
RuleRoster minimizes personal data and keeps public reference reading separate from protected editorial operations.
Last updated
Public browsing
RuleRoster can be read without an account. The site does not offer public signup. Standard hosting and security infrastructure may process request metadata such as an IP address, user agent, requested URL, and timestamp for delivery, abuse prevention, and incident investigation.
RuleRoster may use Vercel's aggregate Web Analytics on public routes. Query strings are removed before an event is sent, and administrative and API paths are excluded. Advertising remains disabled unless its separate configuration and consent requirements are completed and disclosed here.
If error monitoring is configured, RuleRoster may send a scrubbed technical error event to Sentry. Query strings, request headers and bodies, cookies, and user identity fields are removed; session replay and performance tracing are disabled.
Correction submissions
A correction may include the page URL, challenged claim, supporting evidence URL, and an optional contact email. An abuse-prevention check and a one-way IP-derived value may be stored. The public page never displays the submitter's email or network information.
Correction data is used to triage and document factual review. Do not include sensitive personal information in a correction.
Protected administration
Editorial access is allowlisted and requires multi-factor authentication. Administrative actions create security and audit records needed to attribute approvals, protect integrity, and investigate failures.
Retention and requests
Source evidence and publication audit records may be retained to preserve provenance and explain historical answers. Personal correction contact details should be removed when they are no longer needed for the review or a legal obligation.
Controller, privacy contact, correction retention period, and data-request instructions have not yet been published. Correction intake remains disabled until all four are published, its privacy and abuse-prevention controls are configured, and an operator explicitly sets the server-side activation flag.