Privacy
This describes what the software actually does. Where a claim below is enforced in code rather than by policy, it says so.
What we never collect
- Your IP address is never stored. It is read from the request to work out your country and to rate-limit abuse, then discarded. The rate limiter identifies you by
HMAC(secret, IP + today's date)— a value that cannot be reversed to an address and cannot be linked across two days. - No device fingerprinting. It would improve our detection of ballot-stuffing. It is also the capability that makes a political-opinion database dangerous, so it is not implemented.
- Ordinary web analytics, on every page. DataRadio loads Google Tag Manager sitewide, including while you answer. It sets its own cookies and tells Google which URL you are on, the same as most of the web. What it is not given: any answer you give, and the identifier your answers are stored against. Those never enter the page's data layer and never leave this server.
- Your answers are still not linked to you. Analytics knows a browser visited a page. It does not know what that browser chose, because the choice is posted to this server and never handed on.
- No passwords. Sign-in is a one-time emailed link, so there is nothing to breach.
What we do store
| Data | Why | Tied to |
|---|---|---|
| Your answers (−2…+2 per item) | The entire point of the site | An anonymous random id in a cookie |
| Two-letter country code | National breakdowns | That same anonymous id |
| Age band, gender, education (optional) | Weighting results to national populations | That same anonymous id |
| Email address (only with an account) | Sign-in, and pulse notices if you opt in | Your account |
| Stripe customer + subscription id (members) | Knowing whether you're a member | Your account |
The live stream
The live page shows answers arriving worldwide. A naive version of that feature would be a deanonymisation tool: in a country with four respondents, watching the feed for a minute would reconstruct an individual's politics. So the wire is deliberately degraded:
- It carries no identifier at all — not even a hashed or rotating one, because a stable pseudonym is exactly what allows one person's answers to be stitched back together.
- A nation is named only once it has 50+ participants. Below that an event shows only its world region; below that, only that it happened.
- Events are emitted out of order from a shuffled buffer, so consecutive answers by one person don't arrive as a readable run.
- Timestamps are fuzzed to a shared batch second.
- Nothing from the stream is written to disk.
Cookies
| Cookie | Purpose | Life |
|---|---|---|
| dr_rid | Anonymous respondent id — the thing that remembers your answers without knowing who you are | 2 years |
| dr_session | Signed session, only if you have an account | 30 days |
| dr_csrf | Cross-site request forgery protection | 12 hours |
The cookies above are strictly functional. Google Tag Manager sets its own analytics cookies sitewide. Blocking them changes nothing about the poll: every question still works, and your answers are still counted.
Your control
- Export. Members can download every answer held against their account.
- Deletion. Email [email protected] and your account and its answers are removed. Aggregate figures already published are not retroactively recomputed — they contain no trace of you individually.
- Answering anonymously? Clearing your browser cookies ends the association permanently. We cannot recover it, and neither can anyone else.
Processors
Three, and no others: Cloudflare (serving and DDoS protection), Stripe (payment — we never see or store card details), and SendGrid (sign-in emails). Data lives on a server we operate directly.
Questions: [email protected].