Privacy

No interaction or analytics data leaves your browser before you choose. If you select “keep local only,” answers and your visit record remain in this browser’s localStorage.

What is sent when I allow it?

A random visitor code, room choices, interaction times and—only when you write it—an answer or hope and the province you selected. We do not store names, email addresses, phone numbers, precise location, photos, faces or IP addresses. “Smile to Vote” does not access a real camera or image.

Optional Google Analytics loads only in production, only when configured by the operator, and only after your permission. You can disable recording at any time on Your Record.

If you join a group workshop by code, only structured choices and room completions made afterwards enter that workshop’s counts. Written answers, hopes, letters and visitor codes never appear in the facilitator report. Workshops expire after 24 hours.

Public text

Voice answers and hopes enter a moderation queue. A human publishes or hides them before they can appear publicly or in open data. Exports include only approved text, without visitor codes, provinces, precise dates or inferred keywords.

Retention

Raw events and participatory text are retained for no more than 365 days, then removed by periodic maintenance; aggregate counts may remain. The one exception is a public Letter to 1415, deliberately sealed until 20 March 2036. A private letter never reaches the server.

Short-lived request counters are shared across servers to resist automated submissions. When the operator configures the security key, a network address is converted to a keyed, irreversible digest; the raw address is not stored and expired counters are removed by maintenance.

Delete the server copy

Your visitor code acts as an anonymous deletion key. The button removes every database row attached to it and disables future uploads. Local room progress remains so it is not erased accidentally; clearing this site’s browser data removes that copy too.