Privacy

How we handle your data.

We built this to give people a voice, not to harvest their data. Here's what that means in practice.

If you just vote (no account)

• We store your vote choices against a random ID kept in your browser — no name, no email, nothing that identifies you.
• That ID exists only so the same browser isn't counted twice. Clear your browser data and it's gone.

If you create an account

• We store your email (to sign you in) and, only if you choose to share them, broad demographics — your postcode (an area of thousands of people, never your exact address), age band, gender, work status. Never your name.
• These let us show how views compare across groups. Results are always aggregate — individual votes are never shown, and any group smaller than 20 people is hidden.

What we don't do

• We don't sell your data, and we don't run advertising trackers.
• We use Plausible and Vercel Web Analytics, privacy-first tools that count page visits in aggregate — they use no cookies, store no personal information, and can't follow you across the web.
• We don't publish anything that could identify how a specific person voted.

Who is responsible, and how to reach us

Five Million Voices is run from New Zealand and this statement is written under the Privacy Act 2020. For anything on this page — questions, access or correction requests, complaints — email feedback@fivemillionvoices.nz with "Privacy" in the subject line. We aim to respond well inside the Act's 20 working days.

Everything we collect, in one place

• Without an account: your vote choices, stored against a random ID kept in your browser, and a coarse country code taken from your network connection (a manipulation-detection signal — it is never displayed and never used for anything else). Our hosting providers also keep standard, short-lived server logs.
• With an account: your email address, your votes, your digest and topic preferences, and — only if you choose to share them — postcode, age band, gender, and work status. We derive your region from your postcode; your exact address is never asked for.
• If you verify a phone: your mobile number is held in our authentication system solely to prove one person, one number. It is never displayed, never used for marketing, and is deleted with your account. Verifying a number does not prove nationality or enrolment, and we never present it as if it did.
• If you donate: payment is handled entirely by Stripe. We receive confirmation and the email you used — never your card details.
• On your device: we use browser storage (not tracking cookies) for three things: your light/dark preference, the random voting ID, and your sign-in session.

What it's used for — and what it never is

We use this information to count each person once, to show honest aggregate results, to sign you in, to send the weekly digest you opted into, and to detect vote manipulation. That is the whole list. We don't use it for advertising, we don't sell it, and we don't share it with political parties, campaigns, or anyone else who would love to have it.

Where it's stored

We run on infrastructure from Supabase (database and sign-in), Vercel (the website), Cloudflare (the invisible human-verification check on anonymous votes), Resend (email delivery), Stripe (payments), and Plausible (cookieless analytics). Some of these providers store data outside New Zealand — including in Australia, the United States, and the European Union. We choose providers with strong published security and privacy commitments, and they process data only to provide their service to us.

How long we keep it

• Accounts: until you ask us to delete yours. Deletion takes effect after a 30-day grace period (signing in again cancels it), then the account, profile, and your identifiable votes are permanently removed.
• Anonymous votes: kept as part of the aggregate tallies, under a random ID that identifies a browser, not a person.
• Emails: unsubscribing stops the digest immediately — from the link in any email, or from Your account.

Your rights

Under the Privacy Act you can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email us and we'll do it — no forms, no fee. If something goes wrong on our side and a breach creates a risk of serious harm, we will notify the Privacy Commissioner and the people affected, as the Act requires.

If you're not happy

Tell us first — we mean it about wanting to fix things. If you're still not satisfied, you can complain to the Office of the Privacy Commissioner: privacy.org.nz or 0800 803 909.

Plain English is the binding text — there is no separate legalese version. If we change this statement in a way that matters, we'll say so on the site.
Last updated 14 August 2026.