Privacy Policy
Last updated: January 15, 2025
Introduction
Truth Poll ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our decentralized polling platform.
By using Truth Poll, you agree to the collection and use of information in accordance with this policy.
Information We Collect
2.1 Information You Provide
- Authentication Data: Email address (via Magic.link) or wallet address
- Profile Information: Username, avatar (when available)
- KYC Verification Data: Government-issued ID, date of birth, biometric data (processed by Veriff)
2.2 Automatically Collected Information
- Usage Data: IP address, browser type, device information, pages visited
- Blockchain Data: Wallet address, transaction hashes, on-chain voting records
- Session Data: Login timestamps, session duration, user activity
- Technical Data: Error logs, performance metrics
2.3 Third-Party Data
- Magic.link: Authentication tokens and email verification
- Veriff: Identity verification results and compliance data
- Google OAuth: Email address and profile information (if used)
How We Use Your Information
We use your information for the following purposes:
- Service Provision: Enable voting, poll creation, and reward distribution
- Identity Verification: Prevent fraud, Sybil attacks, and ensure one-person-one-vote
- Security: Detect unauthorized access, prevent abuse, maintain platform integrity
- Communication: Send service updates, verification status, and important announcements
- Analytics: Improve user experience, identify bugs, optimize performance
- Legal Compliance: Comply with KYC/AML regulations and legal obligations
Data Storage & Security
4.1 Storage Locations
- Off-Chain Database: MongoDB (user profiles, session data, verification records)
- Cache Layer: Redis (temporary session storage, rate limiting)
- Blockchain: Ethereum/Polygon (verification attestations, voting records, rewards)
- Logging: Sanitized error logs (stdout/stderr only, no third-party error tracking)
4.2 Security Measures
- Encryption: HTTPS/TLS for data in transit, encrypted database connections
- Access Control: Role-based access, minimal privilege principle
- Session Security: HTTP-only cookies, CSRF tokens, session rotation
- Data Sanitization: Sensitive data redacted from error logs
- Privacy Protection: Wallet addresses hashed before analytics tracking
4.3 Data Retention
We retain your information as follows:
- Account Data: Until account deletion or 2 years of inactivity
- Session Data: 30 days for active sessions, 7 days in logs
- KYC Data: As required by law (typically 5-7 years)
- Blockchain Data: Permanent (immutable ledger)
Data Sharing & Disclosure
We do not sell your personal information. We may share data with:
- Service Providers: Magic.link (auth), Veriff (KYC)
- Blockchain: Wallet addresses and transaction data (public by design)
- Legal Authorities: When required by law, subpoena, or court order
- Business Transfers: In case of merger, acquisition, or asset sale
Your Privacy Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of your personal data
- Correction: Update inaccurate or incomplete information
- Deletion: Request deletion of your account and data (subject to legal requirements)
- Portability: Receive your data in a structured format
- Objection: Opt out of certain data processing activities
Note: Blockchain data cannot be deleted due to the immutable nature of distributed ledgers.
Cookies & Tracking
Truth Poll uses cookies for:
- Essential Cookies: Session management, authentication (required)
- Security Cookies: CSRF protection, rate limiting
- Analytics: Anonymous usage statistics (can be disabled)
You can control cookies through your browser settings, but disabling essential cookies may affect Platform functionality.
Third-Party Services
Truth Poll integrates with third-party services that have their own privacy policies:
Children's Privacy
Truth Poll is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware of underage users, we will terminate their accounts and delete their data.
International Data Transfers
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent notice on the Platform. Continued use after changes constitutes acceptance of the updated policy.
Contact Us
For questions about this Privacy Policy or to exercise your privacy rights, please contact us at:
Email: [email protected]
Address: [Your Business Address]
Data Protection Officer: [DPO Contact Info]