Privacy

There are no accounts, no ads, no analytics scripts, and no cookies. This page is the complete list of what exists.

What a vote stores

• Your answer, and your optional call on the majority.
• A country code derived from your connection at the edge. The IP address itself is not stored.
• A one-way code derived from your network address, the date, and a server secret. It exists so one connection cannot stuff the ballot, it cannot be reversed into the address, and it cannot link one day to another.
• An age bracket and a profession category, only if you chose to set them. Both are broad buckets from a fixed list.
• How many seconds you took to answer.
• A random ID your browser generated. It identifies a browser, not a person, and exists so one browser gets one vote per day.
• A short campaign label, when you arrive through a tagged link. It is stored with the vote so aggregate reports can distinguish new participants from returning ones and measure whether new participants come back. No browsing history or third-party identifier is collected.

If you turn on the reveal notification

• Your browser creates an anonymous push endpoint and we store that endpoint with its delivery keys, nothing else. It is used once a day at 13:00 UTC to send the result.
• Turning notifications off in your browser deletes the route; dead endpoints are pruned automatically.

Streak backup codes

A backup code is your streak numbers signed by the server so another device can trust them. The server stores nothing when it makes one; the code lives wherever you paste it and expires after 30 days.

The reveal email

Communities are optional. A community is a code plus a name you chose; joining one links your anonymous voter id to that code so the group's split can be computed, and the group is never shown below 5 votes. A community creator can leave an email address for reports; it is stored with the code, used for nothing else, and deleted on request.

The daily email is optional. If you subscribe, we store your address and, so your streak can follow you between devices, the same anonymous voter id your votes already carry. That id never includes your name; the email never carries anyone else's data. Every email has one-click unsubscribe. Unsubscribing removes your address and prevents pending deliveries from sending. While subscribed, a delivery record keyed by your subscription’s random token is retained for up to 30 days. It records retry and delivery status without duplicating your address. Unsubscribing also deletes those delivery records. If an address you did not enter starts receiving it, one tap ends it for good.

One-time result experiment

Some first-time voters are offered one result email instead of a daily subscription. We store the assigned option with the existing anonymous voting ID for up to 90 days to compare return rates. No new tracking service or fingerprint is used.

If you request one result, we send a confirmation email. Confirming authorizes only that question's result, not daily emails. The request stores your address, voting ID, question date, and random confirmation/cancellation links. Confirmation expires 24 hours after the poll closes; delivery expires 48 hours after it closes. Your address and links are removed when the result is sent, you cancel, or the request expires. The request's voting-ID link is removed after 90 days; delivery status and timing may remain for aggregate reporting. Cancel using the link in the confirmation email. This does not cancel a separate daily subscription.

A result email contains a private sign-in link to restore your voting history on another device. Keep that link private. Email-provider acceptance is recorded; it does not prove that the email reached your inbox or was read.

What never exists

• Voting needs no name, email, phone number, password, or account.
• No stored IP addresses and no device fingerprinting.
• No third-party trackers of any kind.
• Public reveals only include groups of five or more voters. If you choose “Compare with a friend,” the link includes your answer and optional prediction, without your voter ID. Anyone with that link can read or forward those choices; they are not encrypted.

Where it lives

The seven-question comparison uses answers already saved in your browser and the public, frozen results for those questions. Loading it sends no voter ID or personal answer history. It creates no personality profile or list of matching people. The percentages describe the voters on each question, who may differ from day to day.

Your streak, your past answers, and your age and profession settings live in your own browser's local storage. Clear it and they are gone unless you restore a backup or use a reveal email's sign-in link. Vote records live in a database on Cloudflare's network and support the daily reveal and aggregate participation and return-rate calculations.

An unfinished answer is held in this tab’s session storage so a reload can restore your selection. Restoring it does not cast a vote. The draft is cleared when a save is confirmed or the app detects that the question has closed or changed. You can discard it with “Change answer.”

First-party daily counters record visits, answer-selection and save steps, draft recovery, successful copy or share actions, and invitation activity. Campaign tags can count arrivals and votes by source. These counters contain no answer text, voter ID, email, or network address. A completed copy or share action does not tell us whether anyone received or read it.

Questions about any of this: ask@wisehumans.org.