What we collect
| Data | Why | Kept for |
|---|---|---|
| Username | The only identity shown publicly, on petitions, signatures and comments | Life of the account |
| Real name | Held for accountability if an account is reported. Never published | Life of the account |
| Email address | Login, verification, notifications you opt into | Life of the account |
| Date of birth | Confirming you are old enough to hold an account | Life of the account |
| Password | Stored only as a one-way hash; never readable by anyone | Life of the account |
| IP address | Fraud prevention, rate limiting, abuse investigation | 12 months |
| Petitions, signatures, comments | The public record of the petition | Indefinitely, as a public record |
What is public
Your username only. Nothing else about you appears anywhere on the site.
Your real name, email address, date of birth and IP address are never published, are not visible to other members, and are not shared with the authority a petition is addressed to — it receives the petition text, the supporting documents, and the signature count.
We do not collect a phone number.
Cookies
Who we share data with
Only the processors needed to run the service: our hosting provider and our email delivery provider. Each is bound by contract to process data only on our instructions. We never sell personal data or signatory lists.
Your rights
You can view and correct your details, download everything we hold about you, and close your account, all from Profile & settings. Closing your account removes your profile and your username from public view; petitions you started remain published, because other people signed them in reliance on them, shown as authored by “a former member”.
Security
Traffic is encrypted in transit. Passwords are hashed with a modern, deliberately slow algorithm and are not recoverable. Sensitive actions are rate limited, sessions are regenerated on login, and access to production data is restricted and logged.
Where your data is held
The platform runs on servers in Europe. Your data therefore leaves Pakistan to be stored and processed. We use providers that encrypt data in transit and restrict access to it.
Lawful requests
We may be required to disclose account information in response to a lawful order from a court or an authorised body in Pakistan. Where we are permitted to tell you that we have received such a request, we will.
Breach notification
If a breach affects your personal data we will notify affected users without undue delay, and publish what happened and what we changed.
Contact
Data protection queries: contact the team.