This policy covers dukecityledger.com and the email, messages and newsletter of the Duke City Ledger. The Ledger does not sell, rent or trade information about its readers, does not run ads and sets no cookies except the one that keeps a commenter signed in, covered below. The site's forms are the newsletter signup, the tip form and the problem-report box, and every story and series page has a Follow button, each covered below.
When you read the site
The site is hosted by Cloudflare. Like any web host, Cloudflare receives your IP address, browser type and the page you asked for, to deliver the page and to block attacks. The Ledger keeps request logs for up to seven days to fix problems on the site. They are not used to identify readers and are not shared.
The site counts visits with Umami, which runs on a server we operate, not a third party's. It sets no cookies and does not follow you to other sites. It records the page you read, the site that sent you, your browser, operating system, device type, screen size and language, and the country, state and city your connection comes from. On a story, it also records how far down you scrolled and whether you stayed 30 seconds or two minutes. When you play a video, it records which video, whether the sound was on when it started, and whether you watched a quarter, half, three quarters or all of it. It counts a click on the newsletter signup button, and a click on a link to another site by that site's name only. On a Tell the PRC page it counts a tap on the send button, opening "Make it yours" and reaching the last step, never anything you write. That page also remembers which step you're on, in your browser and for that tab only. It does not keep your IP address, and it counts nothing if your browser asks sites not to track it. The counts show which stories people read, and how far they get.
If you pick light or dark mode, that choice is saved in your own browser and never sent to us.
On the voter guide, your picks are saved in your own browser. Each time you pick or change a pick, the site adds one to a running count for that candidate or answer, and takes one off the answer you left. The count is all we keep: no address, district, device or time goes with it, so we can see how often each candidate is picked but never who picked whom. Only the editor sees the counts.
Services your browser talks to directly
Some pages load material from other services. Those services receive your IP address under their own privacy policies, and the Ledger never sees what is exchanged.
- Maps load their background tiles from OpenFreeMap.
- The weather, air quality, temperature records and earthquakes on By the numbers come from the National Weather Service, Open-Meteo, the Applied Climate Information System and the U.S. Geological Survey.
- An address you type into the address lookup goes straight from your browser to the City of Albuquerque's address list. On the voter guide it also goes, as you type, to Esri's address search, which covers the whole state, and an address neither knows goes to the Census Bureau's address search when you press Enter, so readers anywhere in New Mexico can find their ballot. The Ledger never receives it and does not store it.
- Event pictures on the events page load from the organizer's or seller's website.
- A letter to your councilor opens in your own email program. The Ledger does not see it or send it.
Email, tips and sources
If you email us or send a tip by Signal, we keep your message to report on it and reply to you. Our email is hosted by Zoho. We do not share your contact details with anyone but the services named in this policy that handle email for us, and we do not name a source who asks not to be named.
The site has two forms that take a message: the contact form on the contact page and the "Report a problem" box on interactive pages. Neither asks for your name. What you write is emailed to the editor through Resend, and an email address is included only if you give one so we can reply. A problem report is also filed on the Ledger's private bug tracker on GitHub so it can be fixed. Only the people who work on the site can see it. It holds your note, the page, your browser and any errors the page hit, with email addresses taken out. Your own address never goes there. Both forms are checked by Cloudflare Turnstile, which looks at your browser to tell people from bots under Cloudflare's privacy policy. The site itself keeps no log of who sent a message. Resend keeps its own record of the emails it sends.
If a government agency, a court or anyone else demands information about a reader or a source, we will resist it as far as the law allows, including through the protection New Mexico courts give journalists' confidential sources. If we are ever made to hand something over, we will try to tell the person it is about first, unless the law forbids it.
We keep email and tips as long as we need them for our reporting and our records. Ask, and we will delete your message, unless we need it to stand behind a story we have published or the law requires us to keep it.
Comments
Comments take a Ledger account. Signing up isn't reviewed by the editor: once you confirm your email, the account is made and you can comment.
- Your account. We keep your email address, the day you signed up, and which version of our terms, this policy you agreed to, with the time you agreed. We store your email so we can sign you in and contact you about your account. It's never shown on the site, publicly or next to your comments, and never sold; only the editor sees it, on our review page. We don't keep the name you type when you sign up. Your address goes through Resend to send you confirmation and sign-in links, and to Buttondown only if you tick the newsletter box when you sign up for an account. The newsletter box on the site's own pages is separate and uses Resend (see "The newsletter" below).
- What you post. The display name you pick the first time you comment, and each comment: its text, the story it's on, when you posted it and whether it's up, waiting or removed. If you report a comment, we keep that you reported it.
- AI screening. An AI model, Claude from Anthropic, screens comments and display names before anyone else sees them. It approves clear ones on its own, so they go up right away, turns away spam, slurs, threats and sexual content, and holds the rest for the editor to approve or remove. If the model errors or times out, or the day's screening budget is used up, the comment waits for the editor instead. What it screens is sent to Anthropic for this, under its terms. The model's one-line note on each comment is seen only by the editor. See the comment rules.
- Internet addresses. Cloudflare counts posts from each internet address over a minute, to slow down floods of posts; we don't store your address with your account or your comments. At sign-up a scrambled form of it is checked against our block list, travels inside the encrypted confirmation link we email you, and is checked again when you confirm. A sign-up to comment doesn't keep it after that.
- Cookies. One cookie keeps you signed in for 90 days. Signing out deletes it.
- How long. If you delete your own comment, its text, and the model's note on it, are erased right away. A comment that's turned away or removed has its text and note erased within 30 days. The one exception is a story under a legal hold, whose comments are kept whole until the hold is lifted. After the text is gone, a record of the comment stays: the story, when it was posted and removed, its status, how many times it was reported, and the link to your account. That record stays after an account is closed, but by then the account no longer holds your email or display name.
- Closing your account. Email editor@dukecityledger.com from the address you signed up with and we'll close it. Closing takes your comments off the site and deletes your email address and display name. You can sign up again later with the same address, as a new account. If the editor bans an account for breaking the rules, its email address stays on our ban list, in plain text and seen only by the editor, so it can't sign up again unless the editor lifts the ban.
AI tools
We use AI tools to help sort and summarize some email sent to the Ledger, such as replies to public-records requests, and to check our own drafts. A message handled this way is processed by the tool's provider under its own terms. A person decides what to do with every message, and no AI tool replies to anyone or publishes anything on its own. Names and other personal details in a tip never go into an AI tool; the rest of the message may, after we take those details out. If you would rather your message stay out of AI tools, say so at the top and we will keep it out.
The newsletter
The newsletter is sent through Resend. If you subscribe, we email you a link to confirm, and only after you tap it does Resend store your email address for us under its own privacy policy. We use it only to send the newsletter. Every issue has a link to unsubscribe, and unsubscribing removes you from the list.
Following a story
Every story and series page has a Follow button with two choices. Both tell you only about a new story on that story or series, and you can pick either or both.
Email me. We email you one link to confirm, and only after you tap it does Resend store your email address for us, with the stories you follow, and the weekly newsletter only if you tick that box. Nobody can sign up an address that is not theirs. Every email has a link to unsubscribe. We do not keep the address anywhere else. For ten minutes we keep a scrambled code made from it, which cannot be turned back into the address, so no one can flood your inbox with confirm emails. The Worker that sends the confirm email logs no address.
Notify this browser. If you tap "Notify me" and allow notifications, your browser gives us an address its maker's push service (Google, Apple, Mozilla or Microsoft) uses to deliver a notification to that browser, with the keys to encrypt it. We keep that address and those keys in Cloudflare, under the story or series you followed, and nothing else: no name, no email, no IP address and no record of when you signed up. We use them only to send a notification when there is a new story on it. A notification shows the name of what you follow and the headline on your screen.
To make this work the site puts a small script in your browser, a service worker, that shows the notification and opens the page when you tap it. It is not a cookie and does not track what you read. What you follow is also kept in your browser, so the button can say so. Tap "Stop notifications" and we delete your address for that story. Turning off notifications for the site in your browser's settings stops them too, and we delete the address the next time a notification to it is refused.
Social media
When you follow, comment on or message the Ledger on Instagram or another platform, that platform's own privacy policy applies. We may quote a public comment as our editorial standards describe, without your name.
Your choices
Because the site sets no tracking cookies, keeps no IP addresses in its analytics and sells nothing, there is no tracking to opt out of. Umami does not count a browser that sends Do Not Track. To see what we hold about you, or to have it corrected or deleted, email editor@dukecityledger.com. We answer every request, wherever you live.
Security
The site is served only over an encrypted connection, and access to our email and records is limited to the people who run the Ledger. No system is perfectly secure, and if we learn that a reader's or a source's information was exposed, we will tell them.
Children
The site is meant for a general audience and does not knowingly collect information from children under 13.
Readers outside the United States
The Ledger works from the United States, and the little information it holds is kept there or on the services named above.
Changes
If this policy changes, the date at the top changes with it. We will not start collecting anything new from readers without saying so here first.