Privacy Policy

What is public

Your username, display name, bio, avatar, the communities you belong to, your posts and comments, and their scores are public, and so are moderator actions in each community’s moderation log. Your posting history stays on your profile, and posts and comments can be found through the site’s search, as anyone reading them could.

Votes are not public. Scores and poll results are only totals: who voted, and how, is never shown to anyone, moderators and the site team included.

Anonymity

• Other members know you by your username, and your display name if you set one. Your email address and date of birth are never shown to them; your political side only where the site says so.
• Anoncracy no longer offers anonymous posting. Posts made anonymously before show “Anonymous” instead of a name to everyone, moderators and the site team included, wherever they appear (share cards and link previews too), and they don’t appear on the author’s profile. We still record which account wrote each one, so its author can edit or delete it and the site’s rules apply to it. No page of the site shows that record; we disclose it only as our Legal Requests page describes.
• You can read Anoncracy without an account. Your browser keeps the preferences and local reading history described below. Our servers keep the short-lived request counters and operational logs described under Operational logs and abuse prevention.
• Posts and communities marked NSFW are shown only to signed-in members whose date of birth shows they are 18 or older and who chose Blur or Show in Settings. They do not appear in Home, Popular or community recommendations, even with that preference enabled.

What we keep privately

• Your email address, to sign you in, recover your account and send the messages you ask for. Your password is stored only as a slow, salted hash (Argon2).
• Your date of birth, given at sign-up or once when we ask. It is never shown to anyone, and you can’t change it yourself; if it is wrong, tell us through Report a problem and the site team corrects it.
• Your votes on posts, comments and polls, your saved posts, drafts, filters and settings.
• Your political side, if you choose one, which decides where you can vote; it is shown only where the site says so.
• Ballots in elections and recalls are secret: results are counted without showing anyone how you voted.
• Direct messages and modmail are encrypted in our database with keys the site holds. This protects them in backups and from casual access; it is not end-to-end encryption.
• A registration fingerprint: a keyed hash of the network you signed up from (the first three parts of an IPv4 address, or the first half of an IPv6 one). This fingerprint does not contain the address itself. It lets several accounts from one network count at most a few times in elections, and it is deleted after 365 days.
• If you are a site admin: the secret behind your authentication codes (encrypted), your recovery codes (only as keyed hashes), and a record of each second-factor sign-in and failure with a keyed hash of the network address, never the address itself.
• Reports you make, support requests (data requests included) and replies, and notes moderators keep about members of their community.

Limited campaign measurement

Some links to Anoncracy carry a shared campaign label, such as the name of a channel or creative. Your browser can keep that label and a test-journey flag in this tab’s session storage until registration or the tab closes. These are shared labels, not visitor identifiers. We do not add advertising pixels, analytics cookies or fingerprinting.

If you create a new account through one of these links, we privately associate its label with your account. We count signups, email verification, a first post or comment within 48 hours, a later signed-in foreground visit between 24 hours and seven days, and accounts that both contribute and return. Existing accounts, site admins and marked test journeys are excluded. Signing in later does not change your signup label. Campaign details never appear on public profiles.

We remove the account-level association and its milestone times from the live database after 30 days, or earlier when your account is erased, and retain aggregate counts grouped by campaign and UTC signup day. An existing background worker performs expiry even if you never return. Older database backups expire on the schedule below; restored copies must apply the same expiry before serving traffic. Future changes to an account after its association is erased cannot change those totals. Operators can export aggregate counts, without usernames, email addresses, account IDs or raw events. We do not share account identities with advertising platforms or use this measurement to send marketing email.

Operational logs and abuse prevention

Our logs record which page or API route was used, how it went and how long it took. They don’t record IP addresses, what you typed, search words or cookies. To stop abuse we count requests per account or per address for a short time (from a minute to a day); each counter is filed under a keyed hash of the account or address, made with a secret key only our servers hold, never under the address itself, and expires on its own.

Separately, we keep an encrypted history of network IP addresses used to create an account, sign in successfully or access an authenticated session. This includes correctly authenticated attempts by suspended accounts, but we do not associate a failed password guess with the account it names. Entries expire after 30 days without being seen again. Only site administrators can view this history for a recorded security reason; each access is audited. The addresses are not public.

Signup is limited to one account per IP address. We retain a server-keyed hash to enforce this limit, including after an account is closed. This record contains no readable IP address or account ID. People sharing a home, workplace or VPN connection may therefore be unable to create separate accounts. Existing accounts can still sign in.

Cookies and storage

We set 4 cookies, all first-party (only this site can read them):

• polisita_session: Keeps you signed in. Scripts on the page can’t read it. Kept for: 12 hours, or 30 days when you choose “Keep me signed in”; it ends when you sign out.
• csrf_token: Protects your actions from other websites while you’re signed in. Kept for: the same as your sign-in.
• feed-sort: Remembers the sort you last chose for each feed on this device (up to 24 feeds), so a page opens the way you left it. Kept for: one year from your last choice.
• comment-sort: Remembers the sort you last chose for comments on this device. Kept for: one year from your last choice.

Your browser also remembers display choices, such as light or dark mode, and favourite communities on this device. There are no advertising or analytics cookies and no tracking pixels.

Recent communities and Recently viewed keep the identifiers of your last five visited communities and 30 viewed posts in this browser. Each account and signed-out browsing have separate lists. They don’t appear on your public profile or sync between devices, and we don’t save these lists on our servers. Use Clear in either list, remove an individual post from Recently viewed, or clear this site’s browser data to remove them. Favourite communities can be unstarred or removed by clearing this site’s browser data.

Videos and posts from other sites load only when you press Play or Load. Until then your browser contacts nobody but us. Link previews are fetched by our server, not your browser.

Who helps us run the site

Render hosts the site and its database; Cloudflare R2 stores uploaded images and our backups; Resend delivers our email. They process data only to provide those services to us. We don’t sell personal data or share it with advertisers.

Sightengine checks text and images submitted for publication, including publisher preview text and images. Uncertain or flagged submissions can be held privately for the site team to review. We keep screening results and submitted material needed for that review. We do not attach your account password, date of birth, private messages or vote records to these requests. Automated checks can make mistakes; the site team can review a decision through Report a problem.

If a shared public page returns 403 (Forbidden) to our preview crawler, we may send the page’s URL to Microlink to obtain preview details. The URL can include query parameters. We do not add your account details, sign-in cookies or private messages to that request. Your browser does not contact Microlink to display the preview card. See Microlink’s privacy policy for how it handles these server requests, and our preview crawler page for the fetching rules.

How long we keep things

• Your content stays until you delete it or it is removed. Deleting a post or comment removes its text from the site; a moderator’s removal is recorded in the public log without the text.
• Direct messages you and the other person have both deleted are purged after 30 days, along with their edit history. Archived modmail with no activity for two years loses its text. Report details are purged a year after the decision.
• Registration fingerprints are deleted after 365 days.
• Database backups are kept for 35 days (daily) and 90 days (weekly), then deleted. A copy of uploaded images is kept for backup. Deleting a post or comment does not remove its image from storage or from that backup; an image removed from storage leaves the backup within 35 days.
• A legal hold (see Legal Requests) pauses these deletions for the account or conversation it names until it is released.

Your choices and rights

You can change your profile and settings, download your messages, the notes about you and the reports you filed from Settings, and close your account. Depending on where you live you may have rights to access, correct, delete or move your data, and to object to how it is used.

For a copy of everything we hold about your account, or to have it corrected or deleted, sign in and choose Ask about my data in Report a problem. We check the request comes from the account’s owner and answer within 30 days; a copy comes as JSON files sent to your account’s email address. It holds everything this page lists except how you voted in elections, recalls and side votes: ballots are never handed out, not even to you, so nobody can be made to prove a vote. If you can no longer sign in, use Report a problem without signing in and give your account’s email address; we write to that address to confirm it’s you before anything is sent.

You can also send privacy questions or data requests to privacy@anoncracy.com. The same account ownership checks apply.

Anoncracy is not for children under 13, or under the higher minimum where they live. If you believe a child has an account, tell us through Report a problem and we will close it.

Changes

When this policy changes in a way that matters, we say so on the site before the change takes effect. The version and date are at the top of this page.