Privacy
This describes what the software actually does. Where a claim below is enforced in code rather than by policy, it says so.
What we never collect
- Your IP address is never stored. It is read from the request to work out your country and to rate-limit abuse, then discarded. The rate limiter identifies you by
HMAC(secret, IP + today's date)— a value that cannot be reversed to an address and cannot be linked across two days. - No device fingerprinting. It would improve our detection of ballot-stuffing. It is also the capability that makes a political-opinion database dangerous, so it is not implemented.
- No third-party analytics, advertising, or tracking pixels. No external scripts of any kind — the Content-Security-Policy blocks them.
- No passwords. Sign-in is a one-time emailed link, so there is nothing to breach.
What we do store
| Data | Why | Tied to |
|---|---|---|
| Your answers (−2…+2 per item) | The entire point of the site | An anonymous random id in a cookie |
| Two-letter country code | National breakdowns | That same anonymous id |
| Age band, gender, education (optional) | Weighting results to national populations | That same anonymous id |
| Email address (only with an account) | Sign-in, and pulse notices if you opt in | Your account |
| Stripe customer + subscription id (members) | Knowing whether you're a member | Your account |
Answer without an account and there is no email, no name, and nothing linking your answers to a person — only a random identifier in your own browser. That is the default, and it is fully featured.
The live stream
The live page shows answers arriving worldwide. A naive version of that feature would be a deanonymisation tool: in a country with four respondents, watching the feed for a minute would reconstruct an individual's politics. So the wire is deliberately degraded:
- It carries no identifier at all — not even a hashed or rotating one, because a stable pseudonym is exactly what allows one person's answers to be stitched back together.
- A nation is named only once it has 50+ participants. Below that an event shows only its world region; below that, only that it happened.
- Events are emitted out of order from a shuffled buffer, so consecutive answers by one person don't arrive as a readable run.
- Timestamps are fuzzed to a shared batch second.
- Nothing from the stream is written to disk.
Cookies
| Cookie | Purpose | Life |
|---|---|---|
| dr_rid | Anonymous respondent id — the thing that remembers your answers without knowing who you are | 2 years |
| dr_session | Signed session, only if you have an account | 30 days |
| dr_csrf | Cross-site request forgery protection | 12 hours |
All are strictly functional; there are no advertising or analytics cookies to consent to.
Your control
- Export. Members can download every answer held against their account.
- Deletion. Email [email protected] and your account and its answers are removed. Aggregate figures already published are not retroactively recomputed — they contain no trace of you individually.
- Answering anonymously? Clearing your browser cookies ends the association permanently. We cannot recover it, and neither can anyone else.
Processors
Three, and no others: Cloudflare (serving and DDoS protection), Stripe (payment — we never see or store card details), and SendGrid (sign-in emails). Data lives on a server we operate directly.
Questions: [email protected].