Privacy

What we store

- A short-lived anonymous cookie identifies a voter session. - Voter hashes and ballot pseudonyms are derived tokens used only for anti-duplicate voting. - Operational logs store request and route-level events; they do not store raw IP addresses. - Catalog search terms travel in the request URL to return results. Application logs record the route path, not raw `q` values, and application analytics do not retain raw searches. - Turnstile verification uses challenge-only payloads and does not persist, forward, or log raw IP addresses. - Metric events are limited to operational outcomes needed for moderation and reliability, and only on an aggregate basis. - Denominator for results is the total number of accepted votes per matchup.

Retention

• Anonymous voter token: 30 days.
• Ballot pseudonym set: 14 days.
• Raw vote rows: retained for operational review window, then moved to immutable aggregates.
• Vote void evidence/audit trail: retained as documented in operational runbooks.
• Rate-limit state: limited short window for abuse control.
• Consent for all optional analytics or telemetry is opt-in by owner configuration and defaults to disabled.

Vendors

• Hosting and edge: Cloudflare (Pages, Worker, DNS, R2, Turnstile).
• Database: managed PostgreSQL provider.
• Each vendor receives only the fields needed for service operation and follows standard contract terms.

Product metrics, denominator rules, and consent basis

• Approved metric events:
• `competition_state_view`: route visits to duel/archive/winner/template routes for latency and availability monitoring.
• `catalog_request`: aggregate result/no-result and latency counters without the raw query.
• `vote_attempt`, `vote_accept`, `vote_reject`: operational quality signals for integrity and abuse controls.
• `finalization_complete`: finalizer outcomes with round count and elapsed duration.
• `policy_lookup`: policy content access for legal review workflows.
• Denominator rules:
• Voting conversion and completion metrics are based on accepted votes per matchup.
• Duplicate retries, invalid payloads, and challenge failures are excluded from percentage counts.
• Consent basis:
• Operational counters are off by default and require an explicit owner decision.
• Optional analytics/telemetry outside product operations is disabled unless explicitly enabled for an approved purpose.

Rights and disclosure

• No personal accounts.
• No ad tracking.
• No public profile linkage.
• Anonymous voting lowers abuse risk for open voting, but it does not prevent coordinated or cookie-reset manipulation.
• Cross-day voting behavior is not inferred across dates without explicit retention policy changes.

Requests and deletion

• Removal or correction requests are handled through the policy contact path.
• Retention and deletion outcomes are logged with request IDs, actor, and reason.

Abuse and bot controls

• Turnstile or equivalent challenge is required before write actions when configured.
• Rate limits and token entropy checks run on every vote attempt.
• Bot activity is rate-limited, but not blocked by default in a way that prevents ordinary accessible use.