Privacy notice

Information Officer: the operator. POPIA makes the head of the responsible party the Information Officer by default (section 55), so this role is filled even where no separate person is named. Registration with the Information Regulator is still an open item.

1. While you answer, your answers stay in your browser. A saved copy expires after two hours and is removed when the site next checks it. Finishing or selecting "Start over" clears the saved quiz.
2. When you select "See my results", your browser sends your answers, your priorities and your municipality to the server. The server adds one to the tally for each answer value, one to each priority you picked and one to the completion count for your municipality, then drops what you sent. It does not write a row for you, an identifier, or a time beyond those counters, and it returns nothing that points back at you.
3. Your result itself is a link, and the link carries your answers in coded form. The server reads that link to draw the page, so the address reaches our hosting provider's logs, and anyone you send it to can open it. This is the part that still exposes political views, whatever the database holds.

• Anyone with the link can open it. A link containing v1~ or v2~ carries your answers in coded form; opening it on our site decodes them. Every new result is a link of this kind. Random-ID links made before September 2026 point at rows in the old store, which the retention job deletes; once a row is gone, that link no longer opens. These links have no built-in expiry.
• Opening a live link sends its address to the hosting provider. Provider request logs may record it with the visitor's network address. Hosting and log-retention settings must be confirmed before launch. Not writing a response row is not a promise that the address never reaches a server.
• Messaging apps can keep it too. Links can remain in chats, backups and forwarded messages. Messaging services may fetch a link to build a preview. Browser history and screenshots can also retain it.
• Sharing starts with a plain quiz invitation. It contains no result or outlook. You can separately choose an outlook message, a full result, or a challenge link. The last two expose your answers. Even an outlook card without party names describes your views.
• Think before forwarding a result link. "Without your name" does not guarantee anonymity. A distinctive answer pattern or a link forwarded from a chat where people know you can point back to you.

• An unfinished quiz, for two hours. Cleared when you finish or start over.
• Your last result's address, for this visit only, with a 24-hour limit. You can choose to keep that result for 30 days instead, or forget it at once. Opening a different result does not save that new result for 30 days without another choice.
• Public reading pages and static assets can be cached for weak connections. Quiz, result, group and answer-bearing pages are excluded. "Clear this device" also removes result pages an older version may have cached. We do not promise that a complete quiz works offline.
• Small settings: your language, the data-saver switch and which opening line you saw on the home page. None of these are about your answers.

• Public insights combine the counted answers, top priorities and completion counts by municipality. They cannot list individual answers, because no individual answer set exists. A municipality's total is hidden until at least ten people there have finished. These totals describe people who used the quiz, not a representative poll.
• Share taps add one to a daily counter per channel and button. No result, no link and no identifier travel with them.
• Invite links may carry a short code derived from a result's ID. A completion adds one to that invitation's counter. The code is not written next to any answer tally, because the tallies have no row to attach it to. A plain quiz invitation in the sharing screen does not include this code.
• Opening a group link and finishing the questionnaire adds your outlook and closest party to that group's totals. Your answers are not added there, and a group entry carries no result address. Group pages need at least five participants and at least two people in a shown category. These limits reduce exposure but cannot eliminate privacy risks.

• Hosting configuration is prepared for Vercel and Supabase. Regions, contracts and log-retention periods still need to be confirmed by the operator before launch.
• Network addresses are used in memory to limit abuse of forms. Provider logging is separate and must be reviewed.
• The counted totals are kept for the election cycle. They are tallies, so there is no row to delete for one person and nothing in them to link back to anyone.
• The old response store holds answer sets from the time when contributing was a switch. Nothing writes to it any more, its contents are already counted, and the daily job deletes every remaining row.
• WhatsApp session hashes are deleted 7 days after the last message and editor email addresses in the audit log are replaced after 12 months, both by a daily job that logs each run.
• Retention run logs contain deletion counts and no participant details, and are kept for 12 months.

Rights under POPIA include requesting access, correction, deletion and objection to processing.

Configured contact: sikhetha.za@gmail.com.

The operator must establish and publish a working rights-request process before launch. Counted totals hold nothing we can trace to you, so access, correction and deletion have nothing to act on there. Where a request is about the old response store, the honest answer is that those rows are being deleted; a result link you still hold is the only address that ever pointed at one. Complaints can be directed to the Information Regulator (inforegulator.org.za).