What we hold, and what happens to it
Written plainly, including the awkward parts. If anything here is unclear or not good enough for your agency, write to us and say so.
Last updated 14 October 2026 · Ideation Lab, Corp. · govbot.ai is in a private pilot with invited agencies, with a public Ask trial and a public data connector.
This page, and the public site
The public pages set no cookies, run no analytics, and load nothing from a third party — no hosted fonts, no tag managers, no trackers. Like any website, the hosting provider keeps standard server logs (IP address, timestamp, page requested) for security and reliability. Signing in sets a session cookie so the workspace knows who you are; the public pages do not. The one exception is the Ask trial page, described in the next section.
The Ask trial (govbot.ai/ask.html)
The Ask page answers questions about a community's hazard mitigation plan. To do that, and to keep the free service from being used by automated traffic, it works differently from the other public pages:
- It loads code from Google. The page loads Google's Firebase sign-in library and Google reCAPTCHA Enterprise, which checks that the request comes from a browser rather than a script. reCAPTCHA receives information about the browser and the visit under Google's own terms.
- It signs you in anonymously. Before your first question the page creates an anonymous account, stored in your browser, so the daily question limit can be counted. It holds no name or email address.
- Your question is sent to Anthropic. The question and the plan record for the community you chose are sent to Anthropic's Claude API to write the answer, under Anthropic's commercial terms, which do not permit using the content to train its models. We do not store the text of your question.
- Usage counts. For each account we keep how many questions it asked today, and for each network a count keyed by a one-way hash of the network address, not the address itself. These counts enforce the published limits.
- Email sign-in, if you choose it. After the free questions, you can sign in with a link emailed from admin@govbot.ai. We then hold your email address against the account. The sign-in email is delivered by Resend, an email delivery service. To stop misuse of the form, requests for sign-in links are counted per network and per address; those counts are keyed by one-way hashes, not by the address itself.
- Updates only if you ask. The sign-in form has a separate, unticked box for occasional email updates about GovBot.ai. We record whether you ticked it and when. Without it, your address is used only for signing in and for operating the service.
To have an Ask account and its email address deleted, or to withdraw from updates, write to hello@govbot.ai from that address.
The public data connector (mcp.govbot.ai)
The MCP connector lets a user's AI assistant read public data
through https://mcp.govbot.ai/mcp/. It needs no sign-in and creates no account.
- What it receives. The tool arguments the user's assistant sends: a read name and its arguments, such as search terms, identifiers, state codes or coordinates. It does not receive the user's conversation beyond those arguments. The assistant chooses the arguments, so text a user typed may appear in them; do not ask the assistant to look up personal information.
- What it does with them. The arguments are processed only to return the requested public data. GovBot's services pass the query to the public data publisher named in the response, which receives it from GovBot's servers and not from the user's device.
- What it keeps. Standard request logs (time, request path, response status and network address), kept for 30 days in Google Cloud Logging, and short-lived per-network request counters used to enforce the published rate limit. Tool arguments are not written to these logs. It stores no account data.
- Who else processes it. The service runs on Google Cloud. The assistant's provider handles the conversation under its own terms and privacy notice.
To ask about request logs, write to hello@govbot.ai.
What we hold
- Your email address, if you have been invited. It is how the one-time sign-in link reaches you and how the workspace knows which account is yours. There are no passwords in the system.
- Documents you upload, stored against your account so the software can read them and check them against what the funding notice asks for.
- For the Ask trial, the items listed in the section above.
- Anything you write to us at the address below.
Who else processes it
Being specific here matters more than sounding reassuring, so these are named rather than described as "trusted partners".
The service runs on Google Cloud. Sign-in messages go through an email delivery provider. To read a document, its text — and for scanned pages, the page image — is sent to Google's AI service. Text is also sent to Microsoft's Azure AI Language service to find personal information so it can be masked. Questions asked on the Ask trial page are sent to Anthropic's Claude API, as described above.
Those are the processors that see applicant content. We use them under commercial terms rather than consumer ones, which is what carries the commitment that content is not used to train their models. If you need that in writing for a procurement file, ask and we will provide the current terms.
What we do not do
We do not sell or rent your documents or your contact details, we do not publish your work, and we do not use it to train any model of our own. Your uploads are partitioned to your account and are not visible to other accounts.
Deleting it
You can delete any uploaded document from inside the workspace, and it is removed from storage. To close an account and remove everything attached to it, write to hello@govbot.ai from the address on the account — that one is handled by a person, not a button, and we will confirm when it is done.
Public government records about your community are not ours to delete. They stay published by the agencies that publish them.
Where the public information comes from
Publicly available government sources only — hazard mitigation plans, federal funding notices and program guidance, and open federal datasets. No paywalled, licensed, or restricted data.
Asking us anything about this
Write to hello@govbot.ai. Questions about privacy, access, or the terms all reach the same place, and a person answers them.