Privacy Policy
Last updated: October 27, 2026
Epieme ("we", "us") is a tool for tracking patient-safety legislation at epieme.com, run by Samson Cournane. This policy covers what we collect when you use the site, why, who processes it for us, what other people can see, and how to get your data changed or deleted.
The short version
- We collect what each feature needs: your email and state for alerts, an account if you sign in, and whatever you choose to post.
- Discussion posts, comments, display names and public profiles can be seen by anyone.
- We don't sell personal information, show ads, or track you across other websites.
- You can unsubscribe in one click, and you can ask us to delete your data at any time.
What we collect
Email alerts. Your email address, the state you follow, how often you want a digest, and when you confirmed, last received a digest, or unsubscribed.
Your account. Sign-in is handled by Clerk. Your account holds your email address, your name and profile picture if you add them or sign in with Google or another provider, and the preferences you set: alert settings, the states you follow, whether usage analytics is on, whether you finished onboarding, and supporter status if you donate.
Discussions and community. The posts, comments, votes, reactions and reports you make; the handle, display name, avatar and bio on your profile; and the notifications and threads you follow. If a moderator removes content or restricts an account, we keep a record of that action and the reason.
Action tracking, points and stories. When you log an action (for example, contacting a legislator), we store what you did, which bill or petition it concerned, your state, any evidence link or notes you add, and your name and email so the entry can be reviewed. Points, leaderboard profiles and success stories you submit are stored the same way.
Donations. Payments are processed by Stripe, and your card details go to Stripe, not to us. We receive your email address, the amount, and whether the gift is one-time or monthly. If your email matches an Epieme account, we mark that account as a supporter.
Mentorship introductions. The mentorship form sends nothing. It drafts an email that you choose whether to send to support@epieme.org. If you send it, we keep it like any other email.
Visiting the site. Vercel Web Analytics counts page views, the referring site, your country, and your device and browser type, and Speed Insights records page performance. We also record how far you scroll and how long you stay on a page. Neither tool uses cookies. If you're signed in, you can turn this off under Settings → Privacy → "Help improve Epieme". Like any web host, Vercel logs requests, including IP addresses, to run and protect the site, and our sign-up form briefly holds your IP address in memory to limit repeated attempts.
What other people can see
Discussion posts and comments, with your display name, handle, avatar and bio, are public. Success stories and leaderboard entries are public too, unless you set them to private. Reports you file and your individual votes are not shown to other users. Moderators can see reports and the content they point to.
Please don't post private medical details, about yourself or anyone else, in discussions, stories or notes. Anything posted publicly can be read and copied by anyone.
How we use it
- To send the alerts you asked for and confirm changes to your subscription.
- To run your account, show your activity back to you, and keep the community working: displaying posts, notifying you of replies, and handling reports.
- To review logged actions and award points.
- To process donations and recognize supporters.
- To understand which pages are useful and keep the site fast and secure.
Who processes it for us
We share personal information only with the services that run Epieme, only for that purpose:
- Clerk for sign-in and account data (privacy policy)
- Supabase for our database: subscriptions, community content, action logs and profiles (privacy policy)
- Stripe for donations (privacy policy)
- Resend for sending email (privacy policy)
- Vercel for hosting, analytics and performance data (privacy policy)
- Google Fonts and Vercel's font service, which receive your IP address when your browser loads the site's typefaces (Google privacy policy)
These providers may process data in the United States and other countries where they operate. We will also disclose information if the law requires it, or to protect people from harm.
Cookies and browser storage
Clerk sets cookies that keep you signed in. They are needed for accounts to work. Stripe sets its own cookies on its checkout pages. We don't use advertising or cross-site tracking cookies.
The site also saves a few things in your browser's local storage, where only you can see them: your light or dark theme, a note that you were signed in, whether you've turned usage analytics off, the states you recently viewed or are watching, guidance cards you dismissed, a counter that limits repeated sign-up attempts, and the email you typed into the alert form on the States page. Clearing your browser's site data removes them. A vote you cast before signing in is held in session storage until you sign in or close the tab.
How long we keep it
- Alert subscriptions stay until you unsubscribe. After that we keep your email and the unsubscribe date so we don't email you again. Ask us and we will delete it completely.
- Account and community data stays while your account exists. When you delete a post or comment, it is hidden from everyone and a "[deleted]" placeholder keeps replies in place. The original text stays in our database until you ask us to erase it or delete your account.
- Donation records are kept by Stripe as payment and tax rules require.
- When you ask us to delete your account, we delete your account and the data tied to it, except where we have to keep a record by law.
Your choices and rights
- Unsubscribe from alerts with the link in any alert email, or with your mail app's unsubscribe button.
- See and correct your data in your account and on the preferences page, which can also export a snapshot of your account.
- Delete your account and its data. Use "Prepare deletion request" on the preferences page, or email privacy@epieme.org.
We answer access, correction and deletion requests within 30 days. Depending on where you live, you may have further rights under laws such as the GDPR or California's privacy laws. Email us and we will help, whichever law applies.
Children
Epieme is not meant for children under 13, and we don't knowingly collect their information. If you think a child has given us personal information, email privacy@epieme.org and we will delete it.
Do Not Track and Global Privacy Control
We don't track visitors across other websites or sell or share personal information for advertising. A Do Not Track or Global Privacy Control signal therefore doesn't change what the site does.
Security
The site is served only over HTTPS, and the keys that can read our database stay on our servers, never in your browser. No system is perfectly secure. If we learn of a breach that affects your information, we will tell you as the law requires.
Changes to this policy
When we change this policy, we update the date at the top. If a change significantly affects how we use information we already have, we will also email alert subscribers before it takes effect.
Contact
Questions or requests: privacy@epieme.org.