← GOV-O-METER
Security & Privacy
Last updated July 26, 2026 · Questions: info@govometer.com
Civic accountability only works if the people using the app trust that their votes, contacts, and accounts are not mishandled.
You are safe to take this seriously
GOV-O-METER is built by Family Farms Forever LLC. We treat cybersecurity and privacy as product requirements — not afterthoughts. Below is what we do in plain language, and how to reach us if something looks wrong.
Report a vulnerability
Email info@govometer.com with a description and steps to reproduce. Please do not post exploits publicly. Good-faith research is welcome. We aim to acknowledge within 2 business days.
Our baseline protections
- Encryption in transit — connections to our hosted sites and APIs use HTTPS (TLS), as provided by Firebase Hosting and Google Cloud.
- Encryption at rest — data stored in Firebase/Firestore is encrypted at rest by Google Cloud with Google-managed keys (standard Firebase platform protection).
- Signed-in access control — Firebase Authentication and Firestore security rules are used so private records are not left world-readable; access is limited by design to the account (or linked roles such as parent/teacher) that should see them.
- Secrets stay out of the app binary — server-side API keys and payment secrets are stored in Google Cloud Secret Manager (or equivalent cloud config) for Cloud Functions — not hardcoded into the public client apps.
- Payments by specialists — card payments are processed by Apple In-App Purchase, Google Play Billing, and/or Stripe Checkout/Elements. Our design is that full card numbers (PAN) are not stored in our application databases.
- No sale of personal data — we do not sell your information to data brokers or ad networks.
- Account deletion — available in-app or by request so you can leave cleanly.
- Metered public APIs — public machine-readable APIs include rate limits (and optional API keys with usage metering) so automated bulk access is constrained.
Specific to GOV-O-METER
- Public civic data vs private user actions — officials, bills, and public records may be open; your individual ratings, private messages, and account identity are not dumped on the public API.
- Leak guards — the public API sanitizes sensitive field names and never walks private subcollections.
- Metered agent access — free tier is rate-limited; commercial keys are quota-tracked.
- No sale of citizen dossiers — we are not building advertising profiles from your civic activity.
Questions: info@govometer.com.
What we do not claim (yet)
- We may not yet have a published SOC 2 letter for this product.
- We do not currently run a paid public bug-bounty program.
- When a third-party penetration test is completed, we will note it here.
We would rather be honest than over-promise. The engineering practices above are real and continuously maintained.
Related
GOV-O-METER is developed by Family Farms Forever LLC. Security contact: info@govometer.com.