What we collect

• Email hash, not your email. We store a one-way hash of your email address to enforce one account per person. We cannot reverse it.
• Your handle — the public name you choose.
• Your votes — stored against an anonymous voter hash, not your account. Your profile’s vote records are private by default.
• Issues you propose or endorse.
• Research responses — stored separately from identity, with no joinable keys, per our published methodology.

What we never collect

Raw Social Security numbers — never, in any system. Passwords — we use email codes instead, so there is nothing to leak. Private messages — they cannot exist here; the platform has no messaging, comments, or follows.

How long we keep it

• Identity records: deleted within 30 days of your request, or 1 year after your last activity.
• De-identified research responses: up to 7 years.
• Frozen public tallies: permanent — they are the public record.
• Operational logs: 90 days.

Full schedule: Transparency → Retention.

Sharing

We do not sell personal data. We share data only: with service providers who run the infrastructure (hosting, database, email delivery) under contract; if required by law; or as aggregate, de-identified statistics that cannot identify you.

Cookies and advertising

We use a small number of cookies. Strictly necessary cookies keep you signed in (your login session) and keep the site secure — the site does not work without them, and they are never used for tracking.

We also show ads served by Google AdSense. Google and its partners use cookies to serve ads based on your prior visits to this and other sites — including the DoubleClick cookie for interest-based ads. You can opt out of personalized advertising in Google’s Ads Settings or at aboutads.info. Blocking cookies in your browser will also stop the ads from personalizing, though the site itself will keep working.

Why ads? They pay the bills — server costs, hosting, and email delivery. The ads fund the platform; your data is not the product and is never sold to advertisers.

Your rights

Request a copy of your data, correct your handle, or delete your account and identity records at any time via the deletion request flow. Frozen tallies cannot be altered after closing — that permanence is the point of the public record, and it is disclosed before you vote.

Security

Verification codes expire in 10 minutes and are rate-limited. Secrets are stored as hashes. Admin access requires an allowlisted email plus a code. No system here can reverse an email hash back into an email address.