Who we are: Popverdict is operated by Mina Nasralla. Contact: [email protected]. What we use your data for: running your account and your votes; keeping one vote per person and stopping fake accounts; ordering your deck, which you can switch off; sending the notifications you allow; answering you. Worth knowing: your votes can reveal political, religious or other personal views. We process them only with your separate, explicit consent, and we store each choice apart from your identity, with one limit explained in section 3. What we never do: advertising, selling data, or tracking you across other apps or websites (the full list is in section 21). Where your data is: our database is in Frankfurt, Germany. A few service providers are in other countries, under the safeguards in section 11. Age: Popverdict is for people aged 13 and over. Changes: if we change how we use your data, we tell you in the app and by email at least 30 days before (section 19). Your rights: access, correction, deletion, a copy to take elsewhere, withdrawal of consent, and objection (see section 13). You may complain to us or to a data protection authority.

Popverdict is operated by Mina Nasralla, who is the controller responsible for your personal data under data protection law. You can reach us on any data protection matter at [email protected], with the subject "Privacy", or, once signed in, through Settings → Send feedback. We have not appointed a data protection officer. This notice covers the Popverdict apps for iOS and Android, the website popverdict.com and the emails we send. Apple and Google, where you deal with them directly — including when you buy a Paid Feature in the app — publish notices of their own.

What we use: the technical data your device sends when it loads a page or the app (IP address, device and browser type, time) and a session held in your device's own storage. To hold that session, our server creates a random guest account for your device; it is not linked to an email address. Why: to deliver the service securely and keep it working. Legal basis: our legitimate interest in providing a secure, working service to people who visit it. How long: server logs are kept by our hosting providers for their short standard periods, and never longer than 30 days. The guest account is deleted after 30 days without use.

What we use: the answer you choose, the vote it belongs to and the time; the fact that your account took part. How a vote is stored: each vote creates two records. The first holds the answer chosen, the vote and the time, and contains nothing that identifies you. The second records that your account took part, so that each person votes only once and you can see and change your own choice. The two are connected by a random reference. No function of Popverdict lets anyone else, including the person who asked, a Parliament administrator, other members or our moderators, see which answer you chose. The limit: a person with direct administrative access to the database could technically connect the two records. We do not do this. That access is restricted to the people who operate the service and to our hosting provider, which is bound by a data processing agreement. This protection comes from how the service is built and run, not from cryptography. Legal basis: your explicit consent (section 4), and the agreement between us for running your account. How long: your choice stays in the result of the vote permanently. When you delete your account, the record that links your account to your votes is deleted with it; the choices remain in the counts with nothing that identifies you.

Because votes can reveal your political opinions, your religious or philosophical beliefs or other personal views, we process them only with your explicit consent, which you give once, when you first open the app and choose "Agree and continue" — that screen says in its own words that your votes are stored and counted. We record the date and time you gave it, so that we can show it was given. You can withdraw it at any time by writing to [email protected], or by deleting your account. After that you cannot vote, but you keep your account and everything else. Choices you have already cast stay in the counts. Withdrawing your consent does not make earlier processing unlawful.

What we use: your email address and password (stored only as a cryptographic hash), or the Google or Apple sign-in you chose; your @username; and, only if you add them, a display name, a profile picture, a short bio and your place. If you sign in with a one-time code sent to your email address, we keep no password. If you sign in with Apple and choose to hide your email address, we receive a private relay address from Apple instead of your real one. Who sees it: your email address is never shown to anyone. Other people know you by your @username, and see the profile details you choose to add. Why: to create and run your account and let you sign back in. Legal basis: the agreement between us. The Terms you accepted: we record which version of the Terms of Use you accepted, and when, so that we can show what you agreed to. Legal basis: our legitimate interest in being able to show what was agreed. How long: until you delete your account; then deleted without delay. One thing stays: your @username itself, with the date it was retired and nothing else about you, so that nobody else can ever take it and be mistaken for you. Legal basis: our legitimate interest in preventing impersonation.

What we use: questions, answers, appeals, reasons, discussion posts, reactions, messages, reports and feedback, with the time and the account that posted them. Why: to show your content where you posted it, to count votes, to moderate the service and to answer you. Legal basis: the agreement between us; for moderation, also our legal obligations and our legitimate interest in a safe service. Posting anonymously: other users do not see who asked, but we still know which account posted. We use that link only to run and moderate the service, and disclose it only where the law obliges us to. Messages are visible to you and the person you write to. They are stored on our servers and are not end-to-end encrypted. A moderator reads a message only when it is reported to us or when the law requires it. What is public stays public: anything you post publicly can be seen, and copied, by other people, and we cannot control what happens to it after that. Reports: we do not tell the person you reported who you are, except that a notice about a copyright or another right may be passed on so that it can be answered (Terms of Use, clause 9.7), or where the law requires it. If you report something by email without an account, we use your name and email address only to handle your report and tell you our decision.

What we use: the chambers you entered, the people you follow, the topics of votes you opened or voted on, and whether an asker also votes on other people's questions. We never use which answer you chose. Why: to show you first the votes you are most likely to care about. Legal basis: our legitimate interest in offering a relevant deck. Your choice: switch off "Votes picked for me" in Settings → Privacy, and the deck shows the newest votes first. How long: while your account exists; deleted with it.

Everything posted in a Group or Parliament is visible only to its members. Members can see who has not voted yet in a vote of that room, never how anyone voted. A Parliament administrator manages seats and invitations and receives the room's results and reports, which contain counts and never individual choices.

Notifications: if you allow them, we store a notification token for your device and send you the kinds you keep switched on in Settings → Notifications. Legal basis: your consent, which you can withdraw in your device's settings or in the app. Translation: when you tap Translate, the public text of that vote, never your name, is sent to a translation service (section 10). Feedback: what you send through Settings → Send feedback reaches our team inbox, with your @username. The same goes for the technical details of a crash when you tap "Copy and send us the details" on the crash screen. One vote per person and security: one live vote per account, rate limits and checks against fake accounts. Nothing that identifies your device is sent or stored with a vote. Legal basis: our legitimate interest in fair votes and a secure service. Feature counts and crash reports: we count which features are used, each day, without anything that identifies you across days; crash reports carry the technical state of the app, not your name or email. Legal basis: our legitimate interest in fixing and improving the service. Growth counts: from the dates of votes we count, in totals only, how many new voters come back and how many arrived through a shared link. A shared link carries a random code that names neither the person who shared it nor anyone who opens it. If you sign up on the website after opening a vote, we keep that vote's address with your account for up to 7 days, so the app can open it when you first sign in. Legal basis: our legitimate interest in improving the service.

Service providers acting on our instructions, each bound by a data processing agreement: Supabase (database, sign-in, file storage and server functions, including our in-house duplicate check; servers in Frankfurt, Germany; its staff may reach them from outside the EU for support and maintenance, section 11); Cloudflare (delivers the website and runs our domain's name records); Expo (delivers push notifications); Sentry (crash reports); Google Workspace (our email, and the encrypted daily copies of our backups); Resend (delivers the emails we send you, such as sign-in codes and purchase confirmations, and in-app feedback to our inbox); RevenueCat (RevenueCat, Inc., United States), which checks purchases made in the Popverdict apps with Apple and Google and tells us their status. RevenueCat receives a random purchase identifier that we create for your account (never your name, email address or user ID), the store's transaction and product identifiers, the dates of purchase, renewal, cancellation, refund and expiry, the store's country, currency and price, and the technical data your device sends when it connects (IP address, device and app version). Independent companies that decide for themselves how they use data: Apple and Google, for sign-in if you choose it, for delivering notifications to your device, and for selling Paid Features in the Popverdict app under their own terms and privacy notices; MyMemory (Translated srl, Italy) or Google Cloud Translation, for the text of a vote you ask to translate. Your card details never reach us. Others: other users see what you post publicly; courts and authorities receive data only where the law obliges us; a new operator receives it if Popverdict is taken over, and we tell you in advance. Requests from authorities include the case where someone's life or safety is in danger (Terms of Use, clause 9.6). Where the law allows it, we tell you before we hand over your data in answer to such a request. After a takeover, your data stays protected by this notice until you are told about a new one (section 19). Beyond what this section lists, we share your data only if you ask us to or agree to it.

Some of the companies above are based in the United States. Transfers to the United States rely on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or otherwise on the Commission's standard contractual clauses. RevenueCat is based in the United States; the transfer relies on the EU-US Data Privacy Framework where RevenueCat is certified, and otherwise on the standard contractual clauses in its data processing agreement. Supabase keeps our database in Frankfurt, but its staff may reach it from countries outside the EU for support and maintenance; that access relies on the standard contractual clauses in its data processing agreement. For a copy of the safeguards, write to [email protected].

Account and profile: until you delete your account; then deleted without delay. Your @username after you delete your account: kept for good, with the date and nothing else about you, so that nobody else can take it. Guest account (reading without an account): deleted after 30 days without use. Voting consent and the date it was given: until you withdraw it or delete your account. Messages: until you or the person you wrote to deletes their account; the whole conversation is deleted then. Notifications in the app and blocks: until you delete your account (a block earlier, if you remove it). Notification token: until you sign out on that device or delete your account. Questions and answers you posted: as long as the vote exists; shown without your @username after you delete your account. Reasons and discussion posts you wrote: as long as the vote exists, unless you delete them first; shown without your @username after you delete your account. Cast choices: permanently in the counts; with nothing that identifies you once your account is deleted. Reports and moderation decisions: six months after the decision, or until a review or court case ends. Feedback and support emails: until the matter is dealt with, and at most two years. Purchase records (what was bought, through which store, and each change to it, including refunds): for as long as the purchase runs and then for up to ten years, for our accounts and to answer disputes and chargebacks. Crash reports: 90 days. Server logs: at most 30 days. Backups: deleted within 30 days.

You may ask for access to your data and for a copy of it (write to [email protected] and we send it to you), for correction (Settings → Account → Edit profile, or write to us), for deletion (Settings → Account → Delete my account), for restriction of processing, and for a copy in a machine-readable form to take elsewhere. You may withdraw any consent at any time with effect for the future. Write to [email protected]; we answer within one month, which we may extend by two further months for complex requests, in which case we tell you why. Using these rights is free. So that we never hand your data to someone else, we may ask you to write from your account's email address or otherwise confirm that the request comes from you. If you can no longer sign in, write to [email protected] from your account's email address and we delete your account for you. If you would like to know how we weighed our interests against yours for any use based on our legitimate interests, write to us and we explain it. YOUR RIGHT TO OBJECT. Where we use your data on the basis of our legitimate interests — ordering your deck, preventing fake accounts and abuse, counting how features are used and fixing crashes — you may object at any time, for reasons arising from your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. You can object to the ordering of your deck at any time, without giving reasons, by switching off "Votes picked for me". For everything else, write to [email protected].

You do not need to give us anything to read public votes. To create an account we need an email address and a password (or a one-time code we email you), or a Google or Apple sign-in, and later a @username; without them we cannot create an account. Everything else in your profile is optional. To vote, we need your consent (section 4). Data comes from you; from your device (section 16); from Apple or Google if you sign in with them (your name and email address as they share them); from Apple or Google, through RevenueCat, about a Paid Feature you buy in the app (the product, its status, renewal, cancellation and refund); and from other users, for example when someone reports your content.

We take no decision based solely on automated processing that has legal effects on you or affects you in a similarly significant way. Two automated steps exist: a vote or answer that 25 different people, each with an account at least a week old, have reported is hidden until a moderator has reviewed it (never inside a Group or Parliament, and never an answer people have already voted for); and when you add an answer, similar existing answers are suggested. In both cases a person, or a jury of users, decides.

The app and the website store on your device only what the service needs to work: your sign-in session, your settings (such as language and appearance), a random number that the app creates the first time it is opened and that never leaves your device (it keeps the order of the answers on each card the same on this device), and, if you allow notifications, a notification token. The app and the website also keep, for at most a day, a copy of the deck you last loaded, so that it opens quickly, and the words you are writing but have not sent yet, so that they survive a restart; both are removed when you sign out. This storage is strictly necessary for the service you asked for, so we do not ask for it separately. We use no cookies or similar technologies for analytics, advertising or tracking. If you buy a Paid Feature in the app, Apple or Google handles the payment; its own notice explains what it stores.

Every connection is encrypted in transit. Access to data is limited by rules enforced in the database itself, so each person can reach only what is theirs or public. Administrative access is limited to the people who operate the service, and two-step sign-in is available for accounts. If a breach of personal data occurs, we notify the competent authority within 72 hours where the law requires it, and tell the people affected without undue delay where there is a high risk to them. Our database host also encrypts the stored database. Neither the apps nor the website hold an administrator key: everything they do passes the same database rules as everyone else. The copies of our backups that we keep away from our own computer are encrypted. If you find a security problem, the page "How the votes are protected" says how to tell us.

Popverdict is for people aged 13 and over. If we learn that an account belongs to someone younger, we delete it. We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe that your child under 13 has an account, write to [email protected] and we delete it.

If we change this notice in a way that affects how we use your data — a new purpose, a new kind of recipient or a transfer to a new country — we tell you in the app and by email at least 30 days before the change applies, explain what it means for you, and ask for your consent where it is needed. You never have to check this page to stay informed. Smaller changes that do not affect how we use your data, such as clearer wording, apply when they are published; the date at the top of this page shows the last change. If you would like an earlier version of this notice, write to [email protected] and we send it to you.

You have the right to complain to a data protection authority, in particular in the EU country where you live or work, or where you believe an infringement took place. The European Data Protection Board lists every authority on its website, edpb.europa.eu. We would be glad of the chance to put things right first: write to [email protected].

We never sell your personal data, and we never share it with anyone for advertising. We show no advertising, we use no advertising or tracking tools, and we never track you across other companies' apps or websites. We never ask for your device's location or your contacts. The place on your profile is only what you type, if you add one. We never use the answers you chose to work out your opinions or beliefs, and we never sort people into groups by them. Your deck never uses which answer you chose (section 7). We do not use your content to train artificial intelligence models, and we do not sell or license it to anyone for that purpose. We do not use your data for direct marketing and send no marketing emails. If we ever wanted to, we would ask you first, and you could object at any time without giving reasons.

Wherever you live, you have the rights in section 13 and can use them by writing to [email protected]. Where the law of your country or state gives you further rights — for example to know what we hold about you, to have it deleted or corrected, or to opt out of the sale of your data, of targeted advertising or of profiling — you can use them the same way, free of charge, and we will not treat you differently for doing so. We do not sell personal data, we do not use it for targeted advertising, and we take no decision based on profiling that has legal or similarly significant effects on you, so there is nothing to opt out of. If we turn down a request, you may ask us to look at it again by replying with "Appeal" in the subject line, and we tell you how to complain to your local authority if you are still not satisfied.