Privacy

WalletShock is a project of the Dekleptocracy Alliance, a Texas 501(c)(4) nonprofit. We collect as little as the site can work with, we say plainly what each piece is for, and we never sell or share it for advertising. There are no advertising or analytics trackers on any page.

Reading the site

The area report, the methodology and the rest of the public pages need no account and set no cookies. Our host, Vercel, keeps ordinary web server logs, and our database host, Supabase, keeps its own. Those logs hold network addresses for a short period and are used to keep the service running.

Your own area

If you allow location on your prices, your browser sends your position once. We look up which county it falls in and keep only the county: the position itself is never written to our database. The county, the items you picked and the timescale go into the address bar and into this browser's local storage, so a return visit reopens the same view without an account. The “forget my area and items” button clears that. Typing a ZIP code instead sends the ZIP to the U.S. Census Bureau geocoder, which is a public federal service.

The widget on other sites

The embeddable widget sets no cookies, loads no third-party script and no web font. When a host site uses the loader, the widget asks our server which county the visitor's network address falls in. That request is never cached, nothing about it is stored, and only a county code is returned. The widget itself is then built from that county code alone, so the page a visitor receives cannot identify them.

Reporting a price

When you report what you paid, we store:

• The store and its location. Your position is used to place the store, and the store's own location is what we keep. Where a store has no name we take one from OpenStreetMap, and a moderator may correct it.
• The values you confirmed: the item, the price, the quantity, the date, and the price per unit we compute from them.
• An opaque source code. If you are signed in it is derived from your account; if not, it is a one-way hash of a random identifier kept in your browser together with a one-way hash of your network address and a secret only our server holds. Its only purpose is to count independent reports, so that three shoppers are not one person three times. Your network address itself is not stored.
• A photo, for 90 days. Your browser shrinks and re-encodes any photo before it leaves your device, which also removes the location data cameras write into image files. Photos live in a private store that no visitor can read. A scheduled job deletes them after 90 days; the confirmed figures remain.

Photos are read by an automated service (Mistral) to suggest what they say. A reading is only ever a suggestion: a person at WalletShock checks it before any figure is used. Only prices that three independent shoppers agree on within 14 days appear publicly, always labelled “Community reported”, with the store name, the number of reports and the dates. Your identity is never shown next to a price.

The form is protected by Cloudflare Turnstile, which checks that a person is sending it. Cloudflare receives the information needed for that check and states that it does not use it to build advertising profiles.

The Texas pages

Your county. The Texas card at /tx/me works like your prices above: your position or a typed address is used once to find the county and is not written to our database; the county, items and timescale live in the address bar and this browser's local storage. A county page is a public address and holds nothing about who opened it.

Your bill. A photograph of your electricity bill is shrunk and re-encoded in your browser, which also removes the location data cameras write into image files, and sent once to Moonshot AI's Kimi API to be read into a few fields. WalletShock does not store the photo or the reading. The fields you confirm are used in your browser to work out your figure and appear only in the address of your result page, which you choose whether to share. If you tick the box to add your figure to the community row, we store the delivery company, the billing month, the kilowatt-hours, the amount due, the delivery charge if you gave one, and the same opaque source code used for reported prices; never your name, address or account number, and never the photo. The bot check is Cloudflare Turnstile, as on the report form.

Your letter. The letter on a county page is written in your browser from the page's figures; the name you type into it does not leave your device unless you send the letter. Sending it through the campaign form hands your name, email address, postal code and the letter to Action Network, which delivers it to the court's published addresses and keeps your details on the Dekleptocracy Alliance's list under Action Network's privacy policy; you can ask us to remove you at the address below. When Action Network confirms a delivery it tells our server, which keeps only the delivery's identifier and the county, to count letters per county; nothing from the letter, the name or the email is stored. Copying the letter and sending it yourself tells us nothing at all.

Language. Choosing Spanish adds ?lang=es to the address and sets no cookie.

Accounts and alerts

An account holds your email address and nothing else about you. There is no password: signing in sends you a one-time link through Resend, our email provider. A saved basket holds an area, up to five items, a timescale, an alert threshold and the date you saved it. When an alert goes out we record which figures it reported, so the next email can measure the movement since then. Alert emails contain no tracking pixel and no click tracking.

Every alert carries an unsubscribe link, which opens a page with one button to stop your alerts; mail apps that show their own unsubscribe button stop them in one tap. If an email bounces or is reported as spam, that address is added to a suppression list and never written to again. Deleting your account on your account removes your saved baskets, your alert history and your sign-in. Any prices you reported stay in the community data without your identity attached.

Where the data lives

• Supabase (database, authentication and private photo storage), United States.
• Vercel (web hosting), United States.
• Resend (sign-in and alert email), United States.
• Cloudflare Turnstile (the bot check on the report form).
• Mistral (reading photos of receipts and price tags).
• Moonshot AI's Kimi API (reading a photo of an electricity bill on the Texas bill page; the photo is sent once and not stored).
• Action Network (delivering letters to commissioners courts from the Texas pages, and holding the sender's name and email), United States.
• OpenStreetMap (naming a store from a point) and the U.S. Census Bureau geocoder (placing a typed address or ZIP code).

Asking us

Write to info@dekleptocracy.org to ask what we hold about you, to correct it, or to have it deleted. Because anonymous reports are keyed by a one-way hash we cannot look them up from an email address; tell us roughly when and where you reported and we will find them.

Radius used for nearby community prices: 25 miles. Radius used for data centers in the widget: 25 miles. See the methodology for how every published figure is produced.