Privacy Policy
Last updated: 1 October 2026
Data controller
The data controller within the meaning of the GDPR is Silvio Lindstedt. For address and contact details, see the Legal Notice.
Overview
This is a static landing page. It sets no cookies. Personal data is processed only as technically necessary by the hosting infrastructure and via a self-hosted, cookieless analytics service. If you create a Votepit Cloud account, your e-mail is additionally processed by the application backend (see below). No third-party tracking, no advertising networks.
Hosting (Cloudflare Pages)
This site is hosted via Cloudflare Pages (CDN). When pages are requested, Cloudflare processes technically necessary server and edge logs as a data processor; these may contain IP addresses, browser identifiers, and timestamps. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the service). For further information see Cloudflare's privacy policy: cloudflare.com/privacypolicy/
Analytics (Matomo)
This site uses self-hosted Matomo for aggregated usage statistics. Matomo is configured cookieless: no cookies are set; IP addresses are anonymised before storage (last two octets removed); no information is stored on or read from the device. No cross-device tracking, no profiling, no sharing with third parties. Data is used solely for aggregated statistics and cannot be linked to individuals. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the site is used). Because tracking is cookieless and IP-anonymised and no information is stored on or read from the device, no consent — and therefore no consent banner — is required under § 25 TDDDG.
External links
This site contains links to external services (e.g. GitHub). When you click these links, you leave this site. The respective provider is responsible for data processing on the linked pages.
Account sign-up and sign-in (Votepit Cloud)
Votepit Cloud (app.votepit.com) is a separate application from this landing page. Signing up only requires an e-mail address. Instead of storing your sign-in e-mail address in plain form, the application stores it exclusively as a keyed HMAC-SHA256 hash (the signing key is kept outside the database); the plaintext address is only used transiently to send you a magic sign-in link and is never itself persisted. You can always sign in with such a link. Optionally, you can also set a password in your profile and add a second sign-in factor (authenticator app, TOTP); we store your password and recovery codes only as hashes and the TOTP key only in encrypted form. When you set a password, we check whether it appears in known data breaches (the “Pwned Passwords” service of Have I Been Pwned); only the first five characters of a SHA-1 hash of the password leave our server — neither the password itself nor any information about you. If the sign-in page offers sign-in with Google or GitHub and you use it, you are redirected to that provider; from there we receive your e-mail address (which we store only as a hash, as described above) and the identifier of your account with that provider, which we store to link it to your Votepit account. The provider’s own privacy notice applies to its processing. E-mail notifications (for example about comments or status changes) are optional: for them you add a separate notification address in your profile, which is only used once you have confirmed it via a link. Unlike your sign-in address, we store this address in plain form because we need it to send the e-mails; you can remove it at any time. Purpose: account authentication and service delivery. Legal basis: Art. 6(1)(b) GDPR (performance of the contract you enter into by signing up). Retention: for as long as your account exists, plus any legally required retention period after deletion. Subprocessor: Netcup GmbH (Germany) hosts the application backend; no additional subprocessor is introduced by signing up. The application sets one technically necessary session cookie on app.votepit.com to keep you signed in; it is not used for tracking, contains no third-party trackers, and requires no consent under § 25(2) TDDDG. Cancellation: cancelling your subscription starts a 30-day deletion grace period after which your account and data are removed. How to export your data yourself and schedule your user profile or your account for deletion is described under “Data export and deletion”.
Data export and deletion
In your profile on app.votepit.com you can download a copy of your data yourself at any time (“Download my data”, JSON file). It contains your profile, your memberships, linked sign-in services, your ideas, comments, votes (including votes cast without an account that you later linked to your account), reactions and notification settings — across all accounts you take part in. Internal security values such as the hash of your e-mail address, the password hash or the TOTP key are not included. Also in your profile, you can delete your user profile: to confirm, you enter the e-mail address you sign in with; a 48-hour period then starts during which you can cancel the deletion. After that, a daily clean-up job deletes your user profile together with sessions, tokens, memberships, linked sign-in services, notifications and profile picture. Your ideas and comments stay on the boards but are attributed to a shared “Deleted user” placeholder; your votes remain in the counts in anonymised form. We do not remove the text of your contributions — if it contains personal information, edit or delete the contribution beforehand or contact the operator of the board concerned. Records showing that terms or operator obligations were accepted are kept without any link to you. If you own an account, you first have to delete that account (or have ownership transferred via support). Account owners can also export all data of their account and delete the account in the account settings; this, too, comes with a 48-hour period during which the deletion can be cancelled. Alternatively, you can exercise your rights at any time via the contact address in the Legal Notice.
Weekly summary e-mail (account owners)
As the owner of an account, you receive a weekly e-mail summary of the activity on the boards of your accounts by default (new ideas, particularly popular, rejected or divisive ideas, and the week’s figures); admins only receive it if they switch it on themselves. Weeks without new ideas or votes do not trigger an e-mail. The summary is sent only to your confirmed notification address (see above) — without a notification address, nothing is sent. It contains only figures and idea titles from your own accounts and no advertising. You can unsubscribe with one click via the link in every summary (no sign-in needed) or at any time with the switch in your profile. All we store for this is your setting, the language of the summary and when it was last sent. Like every other e-mail from the application, it is sent via our host Netcup.
Board pages (anti-abuse & view counts)
When you view a public board or an idea's detail page on app.votepit.com, the backend processes your IP address and browser User-Agent header transiently — to prevent abuse (rate limiting) and to avoid inflating the view counter shown on each idea. Neither is ever stored in plain text: only a keyed HMAC-SHA256 hash (the same signing-key architecture as the e-mail pseudonymization above) is kept, for at most 24 hours, after which it is automatically deleted. No cookie is set for this purpose. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in service integrity and in meaningful, non-inflated usage statistics).
Taking part without an account (voting and submitting ideas)
Board operators can allow visitors to vote and/or submit ideas without an account. If you do, app.votepit.com sets strictly necessary cookies: "vp_anon_voter" (on your first vote without an account, lifetime 1 year) stops the same device from voting more than once; "vp_anon_author" (only after you submit an idea without an account, lifetime 180 days) lets you see your submissions on this device and withdraw an idea that is still waiting for approval. If you voted without an account before, we use the same device value for "vp_anon_author" as for your votes. Both cookies are HttpOnly and contain only a random identifier; in the database we store nothing but a keyed HMAC-SHA256 hash of it, separated by purpose and account, so votes and submissions are not linked there through a shared value. We delete the hash attached to a submitted idea after 180 days. Ideas submitted without an account appear as "Guest" — we collect neither a name nor an e-mail address for them. When voting anonymously you may optionally give an e-mail address for status notifications; it is stored encrypted and deleted together with your vote. To fend off automated submissions and votes we use Cloudflare Turnstile (Cloudflare, Inc.; privacy notice at cloudflare.com/privacypolicy/), which transmits technical browser and connection data to Cloudflare. We process your IP address briefly for abuse limits. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, abuse-protected service); setting the cookies needs no consent under Section 25(2) no. 2 TDDDG because it is strictly necessary for the service you explicitly requested. The operator of a board is responsible for its content and moderation.
Moderation history (member standing)
Draft, pending attorney review. If you are a member of an account (not merely a public visitor) and a comment or idea you submitted is removed through the moderation process described in the Terms of Service and Acceptable Use Policy, we keep an internal record of that removal (the reason category, a snapshot of the removed content, and the date) for a limited retention period, and maintain a rolling violation count and standing state (normal, flagged, warned, or suspended) for you within that account. This is processed to operate the notice-and-appeal mechanism described above, to allow account moderators to recognise repeat violations, and — where your submissions are suspended as a result — to enforce that suspension. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functioning, abuse-resistant moderation) and, for the account operating the board, its own obligations as controller for that board’s content. This data is only visible to that account’s moderators/admins and to Votepit where necessary for platform-wide abuse handling; it is not shared with other accounts.
Integrations set up by operators (Slack, Discord, Linear, GitHub, webhooks)
Account operators can connect their boards to services they choose themselves and for which they are responsible. Votepit then transmits data to these recipients on the operator’s instructions; the terms and privacy notices of the service concerned and of the operator apply to processing there. In detail: (1) Chat notifications to Slack or Discord (Lite plan and above): for new ideas, status changes and merged ideas, Votepit sends the board name, the idea title, the status change or the target idea, and a link to the idea — no names or e-mail addresses of authors, no comments, no idea descriptions and no information about voters. Slack and Discord are based in the USA. (2) Linking with Linear or GitHub (Pro plan): owners, admins and moderators of the account can create an issue in the operator’s project from a published idea; the title, description and a link to the idea are transmitted. The issue’s status can be reported back to Votepit; all we store is the link (issue number and URL). (3) Webhooks: a board can have its own target address that receives a signed message with the idea ID, title and status or target idea for new ideas, status changes and merged ideas. Ideas still awaiting approval are never transmitted in any of these cases. Titles and descriptions may contain personal information if someone wrote it into them; the operator who set up the integration is responsible for passing it on.
Embedded board widget
Board operators (Lite plan and above) can embed a board as a widget in their own website. The widget is loaded from app.votepit.com, sets no cookies and stores nothing in your browser. Optionally, the embedding website can pass you on to Votepit as a person signed in with it, so you can vote, comment and submit ideas in the widget without a separate Votepit sign-in. To do so, it transmits a token it has signed (JWT), valid for at most ten minutes, containing your e-mail address and optionally your name and an identifier from its system. We store your e-mail address only as a keyed HMAC-SHA256 hash that is additionally bound to the operator’s account; we do not store your name or the identifier (the name is only shown in the widget), and the token itself is neither stored nor logged. The resulting widget identity applies to this one account only: it is linked neither to a Votepit sign-in under the same e-mail address nor to widget identities with other operators. The operator of the embedding website is responsible for passing on your identity; we process this data on its behalf.
Agent API, MCP and OAuth sign-in
On the Pro plan, account owners and admins can give programs and AI agents access to selected boards — via the Agent API, the MCP endpoint or the CLI. To do so, they either create an API token themselves (with a label, the boards it may access and an access level) or connect an MCP client through OAuth sign-in: the client registers itself with a name and its redirect addresses; you then sign in and explicitly consent to which client gets access to which account, which boards and at which access level. We store the client registration, the consent (who, which client, what scope, when) and log entries for these actions. API tokens, authorisation codes and OAuth tokens are stored only as hashes; an access token is valid for one hour, a refresh token for 30 days and is replaced each time it is used. A program only gets access to the boards it was granted, at the granted level. Any access can be revoked at any time on the account’s token page; it is revoked when the account moves to a plan without the Agent API and removed when the account is deleted. For client registration and token issuance we briefly process IP-based counters to prevent abuse. Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for the abuse counters, Art. 6(1)(f) GDPR (legitimate interest in a service protected against abuse).
Error monitoring (Sentry)
To detect and fix technical errors in the app.votepit.com application, we use Sentry (Functional Software, Inc.) as a processor; our project uses Sentry’s EU data region (de.sentry.io). When an error occurs, technical details are transmitted — the error message, the program trace (stack trace) and details of the request or browser concerned — which may in individual cases contain personal data. Sentry’s parent company is based in the USA.
Translation on request (Google Cloud Translation)
Where the translation feature is offered, you can have ideas, comments, board introductions, notifications and support messages translated into your language by clicking “Translate”. Only then is the text concerned sent to Google Cloud Translation (Google Ireland Limited / Google LLC) via its EU processing endpoint; nothing is translated automatically in the background. We cache the translation so the same text does not have to be sent again. A translated text may contain personal information if someone wrote it into a contribution. Google acts as a processor under the Google Cloud Data Processing Addendum. As the Google group is based in the USA, any transfers there rely on the EU-US Data Privacy Framework or on standard contractual clauses.
AI-assisted duplicate detection (OpenAI, Pro plan)
For accounts on the Pro plan, AI-assisted detection of similar ideas may be active. It is off by default and only becomes active once the account owner explicitly switches it on for their account; they can switch it off again at any time. If the rule-based search finds no clear match when an idea is submitted or merged, we send the idea’s title and the titles of a few similar, already published ideas from the same board to OpenAI so the model can spot possible duplicates. E-mail addresses and phone-number-like digit sequences in the titles are masked beforehand, and titles are cut to 200 characters. Names, e-mail addresses or user IDs, idea descriptions, ideas not yet approved and content from other accounts are never transmitted. The request goes to OpenAI’s global API endpoint; processing takes place in the USA. All we store for this is the number of requests and tokens used per account and month, no content. An idea title may contain personal information if someone wrote it into it.
Payment processing (paid plans)
If you subscribe to a paid plan (Lite or Pro), your payment is processed by Paddle.com Market Limited, which acts as Merchant of Record and as an independent controller for your billing data (name, billing address, payment method, tax details). Paddle's own privacy policy governs that processing — see the link below. We never receive or store your payment card data ourselves; we only receive your plan/tier status from Paddle's cryptographically verified webhook. paddle.com/legal/privacy
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object. For questions about Cloudflare's processing (hosting), please contact Cloudflare directly. For questions about Paddle's processing (payment), please contact Paddle directly. For analytics data (Matomo), you may object at any time (Art. 21 GDPR) via the opt-out option on this privacy page. You can also trigger the export and deletion of your data yourself (see “Data export and deletion”).