# Privacy notice, Australian Vote Clarity

_Last updated: 13 June 2026_

This is a **draft, plain-English notice** for the data the app collects. It is not
legal advice, before you publish or sell anything derived from this data, get a
lawyer to review it against the **Privacy Act 1988 (Cth)** and the Australian
Privacy Principles (APPs). Data derived from political opinions is **sensitive
information** under the Act and carries extra obligations.

Vote Clarity now serves multiple countries (matched automatically by your
location), so this AU-focused notice must be **generalised and legally reviewed for
every market you launch**, for example, under UK/EU **GDPR** political opinions are
"special category" data with stricter consent requirements.

## What this tool is

An educational guide that matches your stated priorities to parties' policies. It
is **not** an official ballot and has no connection to the Australian Electoral
Commission. Your real vote happens only with the AEC.

## What we collect, and what we don't

If you tick the **consent box on the first page**, your **anonymous** result is
added to a combined aggregate when you finish. We collect **no personal
information** to do this, we store **only**:

- Your coarse answers (each on a −2…+2 agreement scale) and the match score the
  **server** computes from them.
- Optional, self-reported "about you" details if you choose to provide them, 
  e.g. whether you rent or own, whether you run a business, and a few coarse
  sentiment ratings (such as cost-of-living pressure). These are **not** used in
  your party match and carry no name or identifier; they only enrich the aggregate.
- A one-way hashed device code (so one device can contribute once per country). It
  cannot be reversed to identify you or your device.
- The country you selected (e.g. "au", "us"), so insights are grouped by country.
- The consent version and a timestamp.

We do **not** collect or store:

- Your name, email, phone, address, or any account.
- Any government ID or identity document.
- Your IP address. An IP is used only momentarily, hashed for rate-limiting, and
  read once to detect your country (see "Location & country detection" below), and
  is **never written to storage**.
- Any free text.

## How it's used

Contributions are combined into **aggregate** statistics (e.g. average
match per party, distribution of closest matches). These aggregate insights **may
be shared or sold**. Aggregates are only ever exposed once there is a minimum
number of contributions (k-anonymity), so individuals cannot be singled out.

## Location & country detection

To show the right country's parties and questions, the app detects your country
from your **IP address** when you first open it. This happens on our server: it
reads a country code provided by your network/CDN where available, or otherwise
sends your IP to a third-party geolocation service (currently `api.country.is` /
`freeipapi.com`) **solely** to look up the country. Your IP is used only for that
lookup and is **not stored**, only the resulting country code (e.g. "us") is kept,
and only if you choose to contribute. If detection can't determine your country you
simply choose it once. Operators can avoid the third-party lookup entirely by
hosting behind a CDN that supplies the country header.

## Integrity (anti-abuse measures)

To keep the aggregate trustworthy we use privacy-preserving anti-abuse measures:
rate-limiting, one-contribution-per-device, a timing/honeypot bot check, and an
optional Cloudflare Turnstile check. None of these collect personal information.

## Your choices

- The first page shows a click-to-agree notice: by clicking **Start the quiz**
  you agree to the Terms and this notice, including that your anonymous result is
  added to the aggregate when you finish. If you don't want to contribute, don't
  take the quiz. We never ask for or store anything that identifies you.
  (Note: relying on click-to-agree rather than an explicit opt-in tick is weaker
  consent for special-category political data, see the legal-review note above.)
- Because records are anonymous, we can't link one back to you to delete it
  individually. Clearing your browser's local storage resets your device code.

## Contact

Add your organisation's privacy contact here before publishing.