What we collect

• Email hash, not your email. We store a one-way hash of your email address to enforce one account per person. We cannot reverse it.
• Your handle — the public name you choose.
• Your votes — stored against an anonymous voter hash, not your account. Your profile’s vote records are private by default.
• Issues you propose or endorse.
• Research responses — stored separately from identity, with no joinable keys, per our published methodology.

What we never collect

Raw Social Security numbers — never, in any system. Passwords — we use email codes instead, so there is nothing to leak. Private messages — they cannot exist here; the platform has no messaging, comments, or follows.

How long we keep it

• Identity records: deleted within 30 days of your request, or 1 year after your last activity.
• De-identified research responses: up to 7 years.
• Frozen public tallies: permanent — they are the public record.
• Operational logs: 90 days.

Full schedule: Transparency → Retention.

Sharing

We do not sell personal data. We share data only: with service providers who run the infrastructure (hosting, database, email delivery) under contract; if required by law; or as aggregate, de-identified statistics that cannot identify you.

Your rights

Request a copy of your data, correct your handle, or delete your account and identity records at any time via the deletion request flow. Frozen tallies cannot be altered after closing — that permanence is the point of the public record, and it is disclosed before you vote.

Security

Verification codes expire in 10 minutes and are rate-limited. Secrets are stored as hashes. Admin access requires an allowlisted email plus a code. No system here can reverse an email hash back into an email address.