Privacy policy
Last updated: 31 October 2026
This draft describes what the current version of Votara does. It will be reviewed before launch and updated before any new feature that processes personal data.
Controller
- PLACEHOLDER: name and address of the controller.
- PLACEHOLDER: contact address for data protection requests.
What this version does not do
- No user accounts, no registration yet: the Agora accounts described below are not open.
- No storage of opinions, votes or comments. The only answers stored are the anonymous “Guess first” guesses described below.
- No third-party scripts, no externally loaded fonts, no trackers, no analytics, no advertising.
Cookies
Votara sets two cookies. Each stores a preference and nothing else.
| Cookie | Content | Set when | Duration |
|---|---|---|---|
theme |
light or dark |
you use the light/dark switch | 1 year |
PARAGLIDE_LOCALE |
language code (de, fr, it or en) |
a page loads in your browser | 400 days |
Neither cookie is used to identify you, and neither is passed on to third parties.
“Guess first” on the home page
The three questions on the home page are answered with a slider or a number field. What happens to an answer depends on whether this version of Votara runs with a database; the note under the form always says which case applies.
Without a database nothing is stored. With JavaScript your guesses stay in your browser.
With a database, pressing “Compare” stores one record for the question you answered:
| Stored | Example | Purpose |
|---|---|---|
| the question | population-observed-1860 |
to group the guesses per question |
| your guess | 3000000 |
to show what visitors guessed |
| the date (Zurich time), without the time of day | 2026-10-31 |
date range of the guesses; deletion |
| a keyed hash of a random code sent with the form | 43 characters | to count each guess only once per day |
The random code is created by the server for each display of the form and travels in a hidden form field; it is not stored itself, and it is not a cookie. Not stored with a guess: IP address, cookie, account, browser identification (user agent), language, time of day. Skipping a question stores nothing.
Limiting abuse. To stop automated mass submissions, a client may submit at most 30 guesses per hour. The counter is stored under a code computed from the IP address with a secret key that exists only in the server's memory and is replaced every day (Zurich time). The IP address itself is not stored; once the key is replaced, nobody can link the code to an address any more. Counters are deleted after two days.
What is shown. From 100 guesses on a question, the answer to that question also shows the median of the visitors' guesses, the range in which half of them lie, their number and their date range, marked “Opinion of Votara users, not a representative poll”. Below 100 guesses it only says that there are not enough guesses yet.
Retention. Guesses are deleted automatically after 400 days, rate-limit counters after two days. Database backups are kept for 14 days, so a deleted record can remain in a backup for up to 14 more days. The database runs on the same server as the site (see Hosting).
Without JavaScript, after you submit, your answers are also put in the page address (to show the answer); that address can appear in the server logs described below.
PLACEHOLDER: legal basis.
Accounts (Agora, not yet open)
The Agora (votes, proposals, comments) is being built and is not open yet: on this version you cannot create an account. This section describes in advance exactly what an account will store; it will be reviewed before the Agora opens.
Signing in, without a password. You enter your email address and receive a link that works once, for 15 minutes. Votara answers in the same way whether or not an account exists for the address. While the link is pending, Votara stores only a fingerprint (hash) of the link, the address encrypted so that only the link can open it, a keyed fingerprint of the address (to delete pending links with an account) and the expiry time. To stop abuse, at most 10 requests per connection and 3 links per address are accepted per hour; the counters use the same daily changing codes as “Guess first” and are deleted after two days. The email is sent through an email provider (PLACEHOLDER: provider and location); it contains no tracking and no image.
What an account stores.
| Stored | Purpose | Kept |
|---|---|---|
| your email address | to send you sign-in links | until you delete your account |
a pseudonym (generated, e.g. user-k7m2q9xr, changeable) |
to name your account | until you delete your account |
| language, account level, roles | emails in your language; access rights | until you delete your account |
| leaderboard opt-out (on by default), show pseudonym (off) | your privacy choices | until you delete your account |
| version and date of the terms and privacy policy you accepted | consent log | until you delete your account |
| a fingerprint of your session cookie, its expiry | to keep you signed in | 30 days after your last visit, or sign-out |
Not stored: your real name, postal address, phone number, date of birth, IP address, browser identification, location or party affiliation.
Session cookie. Once signed in, your browser keeps a cookie __Host-session (on a local test
server session): a random code, readable only by the server (HttpOnly), sent only over HTTPS and
not to other sites. It expires 30 days after your last visit or when you sign out.
Your participation. Daily votes with their reason are political opinions and are treated as sensitive data: linked to your account for at most 35 days, then kept only anonymously (without account, without free text, with the day but not the time). Your proposals, comments and notes are public; your pseudonym appears with them only if you switch that on. Results of votes are shown only for groups of at least 50 people.
Your data, your choice. On your account page you can download everything stored about your account (JSON file) and delete your account at once. Deleting removes your email address, pseudonym, settings, consent log, sessions and pending links; your daily votes stay counted but anonymously; your ratings are deleted; your contributions either stay as “Deleted account” or their text is removed, as you choose (content under a legal procedure is kept as evidence). Backups keep deleted data for at most 14 more days.
PLACEHOLDER: legal basis; data protection impact assessment before the Agora opens.
Newsletter “Before you vote” (not yet open)
The newsletter is built but not open yet: on this version you cannot subscribe. This section describes in advance what a subscription will store; it will be reviewed before the newsletter opens.
What you get. One email about four weeks before each federal voting Sunday, in the language you choose: the title and type of each federal proposal, a link to its page on Votara and the official page of the voting day. No voting recommendation, no other emails.
Double opt-in, no account. You enter your email address and a language. Votara sends a link that works once, for 48 hours; the subscription starts only when you open it and press “Confirm”. A subscription is not linked to a Votara account, and the account export does not contain it.
| Stored | Purpose | Kept |
|---|---|---|
| your email address | to send you the newsletter | until you unsubscribe |
| the language | to send it in your language | until you unsubscribe |
| the version of the subscription text, the date and time of the request and of the confirmation | to prove your consent | until you unsubscribe |
| a fingerprint (hash) of the confirmation link | to confirm the subscription | until you confirm, at most 48 hours |
| the date of the last voting day you received an issue for | not to send an issue twice | until you unsubscribe |
Not stored: your name, IP address, browser identification, and whether you open an email or click a link (no tracking pixel, no tracked links).
Unconfirmed and unsubscribed. An address that is not confirmed within 48 hours is deleted automatically. Every email has an unsubscribe link: one button on the page, no sign-in; unsubscribing deletes your address at once (no list of former subscribers is kept). Backups keep deleted data for at most 14 more days.
Limiting abuse. At most 5 requests per connection and 3 per address are accepted per hour; the counters use the same daily changing codes as “Guess first” and are deleted after two days.
Sending. The emails are sent through an email provider (PLACEHOLDER: provider and location). They contain no images and no tracking. An issue is never sent automatically: a person at Votara starts each sending.
PLACEHOLDER: legal basis; retention periods to be confirmed with our lawyer.
Server logs
Each request passes through a reverse proxy (Traefik) before it reaches the application server (Node.js).
- The reverse proxy can keep access logs: IP address, date and time, requested address, status code, size of the response, referring page and browser identification (user agent). PLACEHOLDER: confirm whether access logging is active and how long the logs are kept.
- The application server writes error messages to the server log. These can contain the requested address. The log is limited in size, older entries are overwritten. PLACEHOLDER: retention period.
These logs are used to run the site and to investigate errors and attacks. PLACEHOLDER: legal basis.
Hosting
PLACEHOLDER: hosting provider and location. The current test version runs on a server in Frankfurt (Germany). The location of the public version is not decided yet.
Your rights
Under the Federal Act on Data Protection (FADP), you can ask for information about your personal data and request its correction or deletion. PLACEHOLDER: how to submit a request.
Changes
This policy will be updated before Votara offers accounts, votes or any other feature that processes personal data.