Privacy Notice

The short version

The Service has no account or user-profile database. Identity details entered in the form helper stay on your device. To render a checklist or answer, your browser sends the choices in the page address and any optional free-text question to the server. Do not put a name, Social Security number, or other identifying detail in a question. Google Analytics counts page visits, but never receives your choices, questions or identity details, and you can turn it off (see below).

Identity details used for forms

The on-device form helper does not transmit your name, date of birth, Social Security number, or identity-document data. That local-only boundary does not apply to the optional question box: a question is sent to the server exactly as entered.

What the server processes

The server transiently reads your state, change and document choices, language, court-order bookkeeping choice, and any optional question from the request URL. Free-text questions bypass the application cache and are not copied into application logs or responses. Selection-only checklist and answer renders may remain in a bounded in-memory cache until eviction or process restart. Because these are GET URLs, the full address may also remain in browser history or in infrastructure-provider access records.

Application and infrastructure logs

Application logs use a fixed allowlist: route template, response status, jurisdiction, selected change/document types, language, and other bounded operational fields. They exclude the raw question and identity-form fields. The live preview's application-log retention is 14 days; the production infrastructure template uses 30 days. Hosting and edge providers may keep separate network or access metadata under their own retention policies.

Google Analytics (page counts only)

The Service uses Google Analytics 4, a service of Google LLC in the United States, to count visits to its pages. For each page you view, Google receives the page address with everything after the “?” removed, so your state, change and document choices, court-order and minor choices, and any question never reach Google. It also receives the page title, the domain of the site that linked you here (never the full address), your browser, device type, screen size and language, and an approximate location that Google works out from your IP address. Google Analytics does not log or store IP addresses. It may also record how far you scroll and clicks on links that leave the Service.

Google Analytics never receives your name, date of birth, Social Security number, identity-document details, form-helper entries, saved progress, or any question you type. A page whose address carries a question does not load Google Analytics at all, and neither does the relocation planner (“Plan a move to another state”), even without your states in the address.

No advertising trackers are used. Google signals and ad personalization are off, and the advertising consent signals (ad storage, ad user data and ad personalization) are denied for every visitor. Google keeps this data for 14 months.

Cookies

Outside the European Economic Area, the United Kingdom and Switzerland, Google Analytics sets two first-party cookies, _ga and _ga_8HZFD5R23E, to tell a returning browser apart from a new one. They last up to two years. In the European Economic Area, the United Kingdom and Switzerland, analytics storage is denied, so no Google Analytics cookie is set, but Google still receives a measurement without a cookie identifier for each page you view. The Service sets no other cookies.

Turning analytics off

Google Analytics does not load if your browser sends Global Privacy Control or Do Not Track. You can also use the “Opt out of analytics” button at the bottom of any page. That choice is saved in this browser’s local storage as trans-docs-navigator:analytics-opt-out, not in a cookie, and covers this browser on this device only. Clearing this site’s data removes it. Opting out does not delete Google Analytics cookies that were already set; you can delete those in your browser settings. Read how Google uses information from sites that use its services.

Optional “Save your progress” (on your device)

If you choose to save your progress, only your selections, never your name, are encrypted with a passphrase you choose and stored on your own device. The encrypted resume blob is not transmitted by the save action; the selections were already sent in the page request as described above. You can delete the local blob at any time with the “Delete saved” button or by clearing your browser storage.

Optional "Save for offline" (on your device)

If you choose to save pages for offline use, your browser makes explicit same-origin requests for the listed pages and offline shell; those request URLs and metadata are handled as described above. The resulting copies are stored unencrypted in browser storage on your device. Anyone who can open your browser or inspect the device may be able to read them. After that user-initiated fetch, the feature does no background syncing, push notifications, or periodic fetching. Opening a saved copy while offline makes no fresh request. Use “Delete offline copies” (or clear browser storage) when done. Every saved page shows its save date because laws change and an old copy can go stale.

Why we built it this way

We assume some people who use this may be in places that are hostile to trans people. The Service therefore avoids accounts and identity databases, keeps form identity details on-device, prevents raw questions from entering application logs or caches, and bounds application-log retention. Google Analytics is limited to page counts without your choices or questions, and you can turn it off. This minimizes records; it does not mean no server or infrastructure record can exist.

Your choices

You can delete encrypted resume state and offline copies from your device at any time. The Service has no account or user-profile database. In-memory render entries expire through eviction or restart, application logs follow the retention periods above, and infrastructure providers may hold separate records outside this application's control.