Privacy policy

Effective: April 20, 2026  ·  Version 1.0

This policy covers the FCK Fascists mobile app (iOS and Android) and the FCK Fascists browser extension (Chrome and Firefox). It is written plainly because the answer is short: we don’t collect your data. There is no backend, no account system, and no analytics.

FCK Fascists is an open-source project. Everything below can be verified by reading the source code at github.com/idontlikecodemuch/fuckfascists.

The short version

• No accounts. No sign-in. No servers we control.
• No personal identifiers — not your name, not your email, not a user ID.
• No location coordinates are transmitted. Ever.
• No browsing history is stored by the extension.
• No “support” events are recorded — the app can only count the things you avoid.
• All local data is encrypted at rest using OS-native mechanisms (iOS Data Protection, Android File-Based Encryption).
• The only outbound calls are to FEC.gov, Open Food Facts (barcode lookups), and GitHub (entity list updates).
• We do not run analytics. We do not sell data. We have nothing to sell.

1. Who “we” are

“We,” “our,” and “FCK Fascists” refer to the open-source project publishing the app and extension. Source code and data are public. If you need to reach a person, email info@fckfascists.com or open an issue on GitHub.

2. What the mobile app saves — on your device

The app stores a small amount of data on your phone so it can build your weekly scorecard and remember which places you’ve already checked. None of this data is transmitted to us or to any third party.

Capture-then-purge — the scorecard flow

When the weekly scorecard drops, the app aggregates your week into a single JPG image, saves that image to your device, and then deletes the raw avoid events that produced it. The image survives. The log that generated it does not. The JPG contains per-CEO totals and a weekly grand total — no timestamps, no surface (map / scan / track), and no per-day breakdown. The raw record cannot be reconstructed from it.

Why coordinates are stored at all

When you tap “avoid” on a business on the map, the map pin’s coordinates are saved locally so the map can show today’s avoided markers when you reopen the app. These rows are auto-purged daily and never leave your device. Coordinates for businesses you looked at but did not avoid are never stored — even temporarily.

3. What the mobile app does not save

• We never record that you visited, bought from, or used a flagged business. There is no “support” event in the data model.
• We never store a location coordinate for any business you didn’t actively avoid.
• We never transmit any coordinate to any server, including ours.
• We do not store your name, email, phone number, device ID, advertising ID, or any identifier that can be tied to you.
• We do not use any analytics SDK, crash reporter, or tracker.

4. What the browser extension saves

The browser extension is even simpler than the app. It watches the domain of the tab you’re on, checks whether it’s on our entity list, and lights up its icon if so. That’s it.

• Domain matching happens in memory only. The extension does not write a list of sites you’ve visited to disk.
• When you tap “avoid” in the extension popup, it records an avoid event keyed by entity ID — not by URL or domain — in the browser’s local extension storage.
• The extension runs in anonymous mode against FEC.gov. It does not use an API key.
• If you snooze a site for 7 days, the hostname of that site is stored in the browser’s local extension storage for 7 days so we know not to light up the icon again. This is a known V2 item — we plan to move it to session-only storage.

5. Permissions the mobile app asks for

• Location — used to center the map and find nearby businesses when you open it. Coordinates are used in the current session and never transmitted to us. The only coordinates ever written to disk are the map pins for businesses you actively avoided, and those are purged daily.
• Camera — only requested when you open the barcode scanner. Used to decode UPC/EAN codes on products. Frames are not recorded, saved, or transmitted.
• Notifications — used locally to remind you when your weekly scorecard is ready and once on Thursday evening as a gentle “scorecard is coming” nudge. Notifications are scheduled on your device. Nothing is sent from a server.

You can deny any or all of these. The app continues to work with reduced functionality.

6. Outbound calls — who we talk to

The app and extension make a small number of requests to external services. None of these requests include any personal data, any identifier, or any content from your avoid log.

These services may log the IP address of the device making the request, as any HTTPS service can. We do not receive that log and we have no way to associate a request with a particular user. If you want to eliminate these requests, the app functions offline from the bundled data set.

7. How local data is protected

Everything the app stores on your device is encrypted at rest by the operating system.

• iOS: The app requests Apple’s NSFileProtectionComplete data-protection entitlement. All app files are AES-256 encrypted with a key derived from your device passcode and are inaccessible when the device is locked.
• Android: The app targets Android 10 or later, which enforces File-Based Encryption (FBE) across the app’s private storage using AES-256.
• Secure preferences: A small set of flags (e.g. “onboarding completed”) is stored in the iOS Keychain / Android Keystore, both hardware-backed.
• Extension storage: The browser extension uses the browser’s standard extension storage, which is not encrypted at the filesystem level the same way. We only store per-entity avoid counters and snooze hostnames there — no location, no browsing history, no identifier.

8. Children

FCK Fascists is not directed at children under 13. Because we don’t collect personal data from anyone, we don’t knowingly collect it from children either. If you believe a child has somehow disclosed data to us (we don’t see how they could), contact us and we’ll help you confirm.

9. Your choices

• Delete the app — this clears every avoid event, every cached lookup, every map pin, and every scorecard image. Because nothing leaves your device, deleting the app is a complete erasure.
• Reset from the beta menu — triple-tap the version label in the Info tab to reveal the beta tools, then tap “Reset.” Same effect as reinstalling.
• Revoke a permission — your phone’s system settings override everything. Removing location, camera, or notifications in iOS/Android Settings takes effect immediately.
• Remove the extension — uninstall it from your browser’s extension page. That clears its storage.

10. Your rights (GDPR, CCPA, and friends)

You have rights to access, correct, and delete personal data under laws like the GDPR (EU/UK) and CCPA/CPRA (California). These rights apply to the data a business holds about you. FCK Fascists does not hold personal data about you — everything is on your device — so in practice:

• Access: Open the app. You are looking at every bit of data the app has about you.
• Correct: Edit or delete any row by using the in-app tools.
• Delete: Delete the app. Nothing we hold survives.
• Portability: Your scorecard PNGs live in your device’s file system; you can copy them anywhere.
• Opt out of sale: We have nothing to sell. Nothing is sold, shared, or licensed.

If you want to reach us about any of this, email info@fckfascists.com.

11. Changes to this policy

If we change what data is stored or how it’s handled, we will update this page and bump the version at the top. Because the source code is public, any such change is visible in the project’s git history before we publish a release.

12. Contact

Questions, corrections, or just want to argue about a line in the policy? We’re reachable at:

• Email: info@fckfascists.com
• Bug tracker: github.com/idontlikecodemuch/fuckfascists/issues
• Source code: github.com/idontlikecodemuch/fuckfascists

Financial contributions, on file. 🤘🏽