← back

Privacy

Last updated 1 September 2026. What is held, why, and for how long — written from the code rather than from a template.

What we hold

• A handle and a password hash. Salted and hashed; we cannot read your password.
• An address only if you give one, and only until you confirm it. On confirmation the address is deleted and replaced by a keyed hash — enough to enforce one mailbox, one account, and to send a password reset; not enough to recover the address.
• What you write: cards, clarifications, side-chat turns, votes, links, nominations. Inside a dialogue these are not attributed to you anywhere in the interface. The database records who wrote what, so that one-vote-each and round robin can work at all.
• A signed session cookie, expiring after 14 days. No third-party cookies, no analytics, no advertising, no trackers.
• Organisation rosters: keyed hashes of the addresses an administrator supplied, plus a two-character hint so they can recognise a row. The addresses themselves are not stored.

What we do not hold

No location, no phone number, no advertising identifiers, no profile built from your behaviour, no IP logs beyond what the web server keeps transiently. We sell nothing to anybody.

Who else sees it

• Other participants see what you wrote, never that you wrote it.
• A steward sees the handle of someone asking to join, because that is a decision about whether a particular person belongs.
• Other rooms see a card only if you released it.
• Processors: a mail provider for confirmations and resets; a payment provider if you subscribe; the server host. If the optional logic assistant is enabled, the sentences of an argument you submit to it are sent to Anthropic — no account details, and the verdict is computed on this server either way.
• The operator can read the database. Records are not yet tamper-evident, and we say so on the sign-in page rather than implying otherwise.

How long

Your account and what you wrote stay until you delete them. Unconfirmed addresses expire with their link. Deleting your account removes the account and its contact hash. What you contributed to a dialogue stays, unattributed, because other people's votes and maps were built on it — removing it would rewrite their record. That is the same rule that stops anyone editing history in their own favour.

Your rights

Ask for a copy of what is held about you, ask for it corrected, ask for your account deleted, or object to how it is used: hello@truecauses.org. If we cannot honour a request we say why. You may complain to your data protection authority.

Where

Servers in the European Union. Mail and payment providers may process data outside it under their standard safeguards.

If this page stops matching what the software does, the software is right and the page is wrong — tell us and we will fix the page.