What the form collects
The petition stores a first name, last initial, role, community, selected age range (ageBand), the consent notice identifier (consentVersion), optional district or charter network, optional comment, creation time, and a one-way duplicate-prevention code. That code is a best-effort field match, not identity verification: two people with the same submitted identifying fields can collide, and one person who changes those fields can create another entry. It does not ask for an email address, phone number, street address, or full last name.
People ages 13–17 may submit their own minimized support entry. Their form records the age range, first name, last initial, student role, and one broad Utah county or region chosen from a closed list. The teen form does not accept a free-text location, free-text comment, or school-network detail.
Matching submissions receive the same accepted response whether or not an eligible entry already exists, which reduces disclosure. The public count and field-based matching are not an anonymity, identity, residency, or voter-verification guarantee.
The petition record does not intentionally store an IP address, browser, or request header. The hosting provider may still keep ordinary technical access logs under its own operations and retention settings. The campaign does not use petition data or technical identifiers for behavioral advertising or cross-site tracking.
What gets shared
There is no public signer list. Entries are not sold, and raw comments are not published without permission. The 1,000 eligible recorded support-entry handoff is aggregate-only: it may include the exact total and privacy-safe grouped counts, but never row-level signer records.
Names, last initials, raw comments, duplicate-prevention codes, exact timestamps, and provider access logs are not included in the handoff. Small groups are suppressed or combined.
Age and family information
The current petition accepts self-attested support entries from people ages 13–17 and adults. Every signer must submit only their own information. A parent or guardian signing in an adult role must use the adult's own name. Teen signers choose a broad Utah county or region from the form's list; they are not asked for an exact school, city, ZIP, class schedule, email address, phone number, birth date, medical or disability information, or another person's details.
The petition is not collecting personal information from children under 13. The neutral age screen appears before personal fields and does not preselect an answer. After an under-13 choice, that browser tab remains on the non-collection page. Any future under-13 program would require a newly reviewed verifiable-parental-consent implementation, direct parental notice, parent review and deletion rights, security controls, and a new notice version. It cannot be enabled by a server setting or a simple checkbox.
Legacy records without a recorded notice version are quarantined and are not used for the 1,000 eligible recorded support-entry milestone. Adult entries submitted under notice v1 remain eligible. An old v1 record marked 13–17 remains quarantined and is not silently relabeled; a teen must submit under v2. If the same field-based duplicate code appears in more than one eligible notice version, it counts only once. If the campaign learns that it collected actual personal information from a child under 13, it will remove the record from every count and delete it immediately from systems under campaign control, then request provider-controlled copies to be removed or allowed to expire.
Ownership, review, and closure
Responsible data owner: the PhonePolicy.org organizer, reachable at hello@phonepolicy.org. This notice and the data lifecycle are reviewed at least annually while the petition remains open and whenever collection or hosting changes materially.
Formal closure means the organizer records a written closure decision and timestamp, new submissions are disabled, the final aggregate count is recorded, all known raw copies are inventoried, and a deletion owner and start date are assigned. Reaching 1,000 by itself does not close the petition.
Automated deletion is not currently implemented. After formal closure, the organizer intends to complete deletion of primary raw records, exports, and working copies within 90 days after formal closure. This is an operational target, not a guarantee. A limited legal or security hold must be documented and reviewed. Aggregate reports that do not identify signers may be retained.
Provider logs and backups
Provider logs and backups can remain under the hosting provider’s own retention schedule even after campaign-controlled copies are removed. Backup copies are restricted from ordinary use, are not included in a handoff, and should be allowed to age out or be deleted where provider controls permit. The campaign cannot promise selective deletion from every provider backup.
Correction and deletion requests
To request a correction or deletion, email hello@phonepolicy.org. Include the information you submitted and an approximate submission date, but do not send sensitive documents. Because the form does not collect an email address or full name, the organizer may not be able to authenticate every request safely.
The organizer will not disclose whether a matching record exists or reveal its contents, and will not ask for government identification. A correction or deletion is completed only when the supplied details create a high-confidence match without exposing another signer. If that is not possible, the organizer may quarantine the possible match and will explain the verification limit without revealing record contents.
Request actions are logged using a non-identifying request number, dates, action type, scope, and outcome—not names, comments, or copies of the petition row.
