Privacy Policy — Democracy

Effective Date: October 30, 2026
Last Updated: November 11, 2026

1. Who We Are

Democracy lets anyone pose a question and lets verified people vote on it. Because a vote on a public question is a political opinion, the most sensitive kind of personal data there is, the app is built so that we hold as little of it as possible. This policy explains what we collect, why, what we cannot see by design, who else receives data, how long we keep it, and your rights.

Data Controller: Dimitrios Daskaleas, trading as FineApps (sole proprietor)
Address: Athens, Greece
Contact: democracy@fineapps.gr — all our contact points are on the contact page
Data protection questions and requests: write to the controller at democracy@fineapps.gr.

2. The Short Version

  • Your identity document is read and checked on your phone. Its photo and its details are never sent to us or to anyone.
  • Every vote is anonymous. A vote cannot be linked to you — not by other people, and not by us. We do not have that link to give.
  • What goes on the public blockchain cannot be traced back to you from your name, date of birth or nationality — not by us, not by a government, not by anyone — without the cooperation of several independent key operators.
  • No vote ever appears on a profile, and anonymous questions never appear on one either.
  • We do not sell data, show ads, or use advertising or analytics trackers.

3. What We Collect, and What Never Leaves Your Phone

3.1 Account

You need an account to ask questions under your name, follow people or have a public profile. Browsing needs no account.

  • You can sign in with email and password, Apple, Google or Facebook, and link several of them to one account.
  • Email address, and whether you have confirmed it.
  • If you use a password: stored only as a one-way cryptographic hash — we never see or store the password itself.
  • If you sign in with Apple, Google or Facebook: the account identifier that provider gives us, and the email address it shares. Facebook sign-in uses Facebook's web sign-in page; the app contains no Facebook software.
  • Your confirmation that you are 18 or older.
  • Your consents (section 6): which ones you gave and when.

3.2 Public Profile

  • The handle you choose (we never require your real name).
  • Who you follow and who follows you, and the people you have blocked (visible only to you).
  • Questions you post under your name. Never your anonymous questions, and never your votes.
  • Nothing about your identity document or your voter registration: your profile is never linked to them.

3.3 Identity Verification (only when you first vote)

To vote you take one photo of an identity document: a passport, an identity card, or another official identity document, in any language or alphabet. Your phone reads the photo itself; the photo is never uploaded. If the document has a chip, the app also asks you to hold it to your phone for a few seconds. Before you start, the app asks for your explicit consent, and if your document comes from a country where taking part in independent votes may put people at risk, it tells you plainly what is public and what is not.

  • Document with a chip: your phone reads the chip, checks the issuing government's digital signature and produces a zero-knowledge proof — a mathematical proof that reveals only the facts listed below, and nothing else.
  • Document without a chip: your phone reads the details from the photo, checks that you are an adult and computes the facts listed below itself. It sends them with a device check from Apple or Google (section 3.6).

Either way, only these things leave your phone:

  • a yes/no answer that the holder is an adult (and, for a chip, that the document is genuine and not expired) — never the date of birth itself;
  • the country of the document;
  • a person key (section 4), so the same person cannot register twice — not with a renewed document, and not with a different document;
  • your voting identity's public key (generated on your phone);
  • for a chip document, the zero-knowledge proof; for a document without a chip, the device check.

To produce the person key, your phone asks a key service run by several independent key operators (section 4). It sends them your name, date of birth and nationality only in blinded form — mathematically scrambled with a random value that only your phone knows — so no operator learns those details or the resulting key.

Your name, date of birth, document number, photo, the machine-readable zone and the chip data stay on your phone and are deleted from it after the check. We never receive them. Every registered voter counts the same, however they registered.

3.4 Your Voting Key

Voting uses a secret key created on your phone. It is never sent to us and never linked to your account. So that losing your phone does not lose it, it is saved in your own end-to-end-encrypted keychain — iCloud Keychain on iPhone, your Google account's encrypted backup on Android — which neither we nor Apple nor Google can read; it returns when you sign in to a new phone. If that backup is lost too, you can register again with your identity document; that creates a new voting key on the new phone. The blinded key service gives your document the same person key as before, so the new voting key replaces the old one rather than adding a second voter, and it votes only on polls created after you register again (Terms §4).

3.5 Questions

  • Named questions are stored with your profile and show your handle.
  • Anonymous questions are posted with a zero-knowledge proof that a registered voter of a given country wrote them. We store the question with no link to any account; the country's voter group is public, the person is not.
  • So that you can add answers to your anonymous question later, your phone creates a separate key for that one question and keeps it in your own encrypted keychain. We store only its public part and accept new answers signed with it. Each anonymous question has its own key, and we refuse a key that was already used, so your anonymous questions cannot be linked to each other or to you through it.
  • Each anonymous question also uses a one-time code that limits how many anonymous questions one voter can post per day. It is different every time and links nothing.
  • Before any question or answer is published, an automatic filter checks it for clearly prohibited content (terms, section 9).

3.6 Device Check (App Attest and Play Integrity)

When you register with a document without a chip, your phone asks Apple (App Attest, on iPhone) or Google (Play Integrity, on Android) to confirm that the request comes from the genuine Democracy app on a genuine, unmodified phone. The check is bound to a single-use challenge from our server that expires after 5 minutes. It contains no document data. Apple or Google read what they need about the app and the phone to answer, under their own terms; we receive their answer, check it once, and do not keep the token. It is used only to stop fake registrations, never to track you.

3.7 Reports, Blocks and Moderation

  • When you report content: the item, the reason and explanation you give, and — if you want to be told the outcome — your name and email. A report is not linked to your account or your IP address.
  • When we remove or restrict content: the item, the decision, the reasons we sent, and any request to reconsider.
  • Blocks: whom you blocked, stored with your account so their content is hidden from you.

3.8 Technical Data

  • Your IP address is processed while a request is in flight, to deliver it and to stop abuse (for example, limiting how many requests one address can send per minute, in memory). It is never stored together with a vote, and no country or location is ever logged with a vote.
  • Server logs and error reports needed to keep the service working, without vote content (section 8).

4. What Is Public on the Blockchain, Permanently

Votes and voter registrations are recorded on Base, a public Ethereum network, so that no one, including us, can alter a result. Anything there is public, worldwide and permanent: neither we nor anyone else can edit or delete it. Exactly this goes there:

  • For each registration: the person key, your voting identity's public key, your country's voter group, whether the document had a chip (used only to decide which registration may replace another — never shown in results, never weighting a vote), and, for a chip document, the zero-knowledge proof.
  • For each vote: the answer, the country's voter group, a one-time code that is different for every question, and the proof that a registered voter cast it.
  • For each question: a fingerprint (hash) of its text and answers, the number of answers, and a fingerprint of every answer added later. The text itself is stored on our servers.

Why this cannot be traced back to you. The person key is not a plain scramble of your details. It is computed with a secret that is split between several independent key operators: no single operator — and not us — can compute a key alone, and the operators never see your details or your key (section 3.3). So nobody who knows your name, date of birth and nationality — not a government, an employer or a relative — can compute your person key and look for it on the blockchain, unless enough of the independent operators agree to help them. The one-time codes on votes cannot be linked to each other, to your person key, to your account or to your document. We do not hold any record that links your account to your registration or to any vote.

What we cannot promise. Because the key operators together hold the secret, a key could in theory be recomputed for a specific person if enough of them cooperated with someone who also knew that person's details. That is why the operators are independent of each other and of us, and why they never receive your details in readable form. Even then, it would show only that someone registered — never how they voted.

5. Votes — What We Cannot See

  • Every vote is anonymous. Nobody, including us, can tell that a vote was yours.
  • Changing a vote: allowed at any time (with a waiting period between changes). The blockchain keeps the history of changes, which is just as anonymous as the vote.
  • Votes are sent through our relay server, which pays the network fee and keeps your IP address off the blockchain. The relay cannot change a vote: the proof would no longer be valid. The relay records no account, IP address or country with a vote.

6. Why We Process Data, and on What Legal Basis

  • Account, sign-in, profile, follows, blocks and service emails (address confirmation, password reset, decisions about your content): to provide the service you signed up for — GDPR Art. 6(1)(b).
  • Identity verification and voter registration (section 3.3): your explicit consent — Art. 6(1)(a) and Art. 9(2)(a). The app asks for it on a separate screen before verification.
  • Votes and questions, named or anonymous, which may reveal a political opinion: your explicit consent — Art. 6(1)(a) and Art. 9(2)(a), asked on a separate screen before your first vote or question. For a question you post under your name, it is also data you have manifestly made public (Art. 9(2)(e)).
  • Device check, rate limits, the pre-publication filter, security logs and abuse prevention: our legitimate interest in a service that cannot be flooded by fake registrations, bots or attacks — Art. 6(1)(f). You may object (section 9).
  • Handling reports of illegal content, statements of reasons and the public log of removals: legal obligations under the EU Digital Services Act — Art. 6(1)(c).
  • Responding to lawful orders, and preserving removed terrorist content for 6 months: legal obligations under the Digital Services Act, Regulation (EU) 2021/784 and Regulation (EU) 2023/1543 — Art. 6(1)(c).

Withdrawing consent is as easy as giving it: one tap in the app's settings. It does not affect what was done before. When you withdraw consent to verification or to voting, the app deletes your voting key from your phone and your keychain; your earlier votes stay on the blockchain, anonymous, and cannot be changed unless you verify again. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile users.

7. Who Receives Data, and International Transfers

  • Hetzner (Hetzner Online GmbH, Germany) hosts our servers and database in its data centre in Germany, as our processor under a data processing agreement (Art. 28 GDPR). Hosting involves no transfer outside the European Union.
  • Cloudflare (Cloudflare, Inc., USA) stores the nightly backups of our database, encrypted at rest, in its R2 storage, as our processor under a data processing agreement. Transfer basis: the EU-US Data Privacy Framework, under which Cloudflare is certified, with the European Commission's Standard Contractual Clauses in its agreement as a fallback.
  • Resend (Resend, Inc., USA) delivers our emails, as our processor under a data processing agreement. Transfer basis: the EU-US Data Privacy Framework, under which Resend is certified, with the European Commission's Standard Contractual Clauses in its agreement as a fallback.
  • Apple, Google and Meta (Facebook), only if you choose to sign in with them. They act as independent controllers for their own sign-in services, under their own privacy policies.
  • Apple and Google for the device check (section 3.6), only when you register with a document without a chip. They act as independent controllers under their own terms and receive no document data.
  • Apple and Google for the end-to-end-encrypted keychain backup of your voting key and your anonymous-question keys — unreadable to them and to us.
  • The key operators of the key service (section 4): independent organisations that each hold one share of its secret. They receive only blinded values that reveal nothing about you, and they process them under an agreement with us. We will name every operator in this section before the key service starts. Where an operator is outside the European Economic Area, the transfer is covered by an adequacy decision or the Standard Contractual Clauses.
  • The Base network and everyone who reads it: the data in section 4 is published there, worldwide and permanently, with your explicit consent. It is not traceable to you without the key operators (section 4).
  • Authorities, only as described in section 10.

We never sell personal data and never share it for advertising.

8. How Long We Keep It

  • Identity document photo and details: on your phone only, deleted after the check. We never hold them.
  • Account, email, sign-in links, profile, follows, blocks and consents: until you delete your account. Deletion removes them from our live systems at once and from backups within 30 days.
  • Sign-in sessions: up to 90 days, or until you sign out.
  • Email confirmation and password-reset links: until used or expired.
  • Device-check challenge: 5 minutes, single use. Device-check token: not stored; discarded after the check.
  • Server logs with IP addresses: no longer than 30 days.
  • Questions: the question and its answers stay, because other people voted on them. If you delete your account, a named question stops showing your name.
  • Reports and moderation decisions: 12 months after the decision, so that it can be reconsidered or reviewed. The public log of removals contains no personal data and is kept permanently.
  • Removed content: 6 months after removal — as Regulation (EU) 2021/784 requires for terrorist content, and for all removed content so that a decision can be reconsidered — or longer only if a court or authority requires it.
  • Blockchain records (section 4): permanent. This is why nothing there identifies you.

9. Your Rights

Under the GDPR you may access, correct, delete, restrict or port your data, object to processing based on our legitimate interest, and withdraw consent at any time. Write to democracy@fineapps.gr; we reply within one month.

  • Delete your account in the app (Settings → Delete account), with the web form at https://fineapps.gr/democracy-delete, or by email to democracy@fineapps.gr.
  • What deletion does: it removes everything we hold about you on our servers (section 8). It cannot remove blockchain records, but those records are not linked to your account and cannot be traced to you (section 4). Delete the app's keys from your keychain as well, and nothing anywhere connects you to them.
  • Votes: because we cannot link any vote to you, we cannot show, correct or delete "your" votes — we cannot tell which they are (GDPR Art. 11). You can still change a vote yourself in the app.

You may complain to the Hellenic Data Protection Authority (Kifisias 1–3, 115 23 Athens, www.dpa.gr) or to the data protection authority of the country where you live or work.

10. Disclosure to Authorities

We disclose account data only when a lawful order requires it: an order of a Greek prosecutor or court, an order under Article 10 of the EU Digital Services Act, or an EU production or preservation order under Regulation (EU) 2023/1543. We check every order, and we hand over only what it covers and what we hold. We cannot disclose how anyone voted, or who wrote an anonymous question, because we do not hold that link. Where the law allows, we tell the person concerned.

11. Security

Data is encrypted in transit and at rest. The strongest protection, though, is structural: the data most worth stealing — identity documents and who voted how — is data we never have. If a breach puts your rights at high risk, we will tell you without undue delay.

12. Age

Democracy is for people aged 18 and over. When you create an account you confirm that you are. To vote, your phone checks the date of birth on your document, and only a yes/no answer leaves it. We close accounts we find to belong to someone under 18.

13. Changes

We will announce material changes in the app and on this page before they take effect, and ask for new consent where the law requires it.

14. Contact

democracy@fineapps.gr — or see the contact page.