Privacy Policy

1. What We Collect

We collect the minimum information necessary to operate the platform:

• If you create an account: your email address and a password hash (we never store your plain password)
• If you submit a proposal: your name, email, and the proposal content you provide
• If you vote anonymously: only a count increment — no IP address, no fingerprint, no identity
• Standard server logs: page load times and error codes for performance monitoring only

We do not collect your location, your device identifiers, your browsing history, or any demographic information.

2. How We Use It

• Email: to send confirmation emails and proposal status updates you explicitly requested
• Proposals: to review, fact-check, and publish community initiatives to the platform
• Vote counts: to display public community sentiment on each issue
• Server logs: to identify technical errors and maintain uptime — purged regularly

3. What We Never Do

• Sell, rent, or license your personal data to any third party
• Share your information with advertisers
• Use your data to build behavioral profiles or ad-targeting segments
• Send you unsolicited marketing emails
• Share your identity with any corporation, government agency, or political organization without a lawful court order

4. Cookies and Tracking

We use one minimal functional cookie to maintain your login session if you have an account. We do not use advertising cookies, analytics trackers, or third-party tracking pixels.

The dark/light mode preference on YouCanSayNo.org is stored in your browser's localStorage — it never leaves your device.

5. Accounts and Passwords

Account creation is optional. You can vote, read, and share without any account. If you create an account, your password is hashed using industry-standard bcrypt before storage. We never see your plaintext password.

You may delete your account at any time by contacting us. Deletion removes your email and display name. Anonymized vote records may be retained for public count integrity.

6. Third-Party Services

We use the following infrastructure providers:

• Supabase (database and authentication) — your email and password hash are stored on Supabase's servers under their privacy policy
• Vercel (web hosting and CDN) — serves page files and may log request metadata per their privacy policy
• Google Fonts — fonts are loaded from Google's servers; they may receive your IP address per their policy

We do not use Google Analytics, Facebook Pixel, or any other behavioral analytics service.

7. Your Rights

You have the right to:

• Request a copy of any data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Opt out of any email communications at any time

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

8. Contact

Privacy questions or data requests: use our Contact page. We will respond within 30 days. We do not have a legal department — we are a community platform run by volunteers who take this seriously.