Privacy

The poll itself: its title, description, options/questions, and any pictures you upload. This is the content needed to run the poll and show results — kept for as long as the poll exists.

Votes: each vote ("ballot") stores a random id, a timestamp, the choices/ranking/rating given, and — only if the poll's creator turned on "Require a name to vote" or a voter chose to enter one anyway — a name. No IP address or other identifying information is stored with a vote unless the creator has explicitly turned on voter tracking for that poll (see the next section) — there is no hidden per-vote record beyond what's described here.

Comments: if the poll's creator enabled comments, a voter can attach an optional free-text note to their own vote. It's stored with that vote and is never shown to other voters or on the public results page — only to that poll's creator (from the manage page) and whoever administers this VotePoll site (from the admin panel).

Duplicate-vote protection: a random id in a browser cookie (vp_device, kept up to ~400 days) lets the app recognize repeat visits from the same browser, so it can enforce whatever "how often can someone vote" setting the creator picked. This is an ordinary cookie, not a device-fingerprinting technique — it can't identify a physical device, doesn't look at browser/hardware characteristics, and isn't tied to your name or any other identifying information. It's reset by clearing cookies, using a different browser, or private/incognito mode, and it's the only thing used to enforce duplicate-vote limits — nothing about your IP address or connection factors into it.

Creator accounts (optional): if you create a login to manage your polls later, we store your email, an optional display name, and your password (as a bcrypt hash — never in plain text or shown back to anyone, including via any API response). This is used only to authenticate you and to associate polls you create while logged in with your account. See "Deleting your account" below for exactly what deleting it does and doesn't remove.

Managing a poll without an account: if you create a poll without logging in, you're given a private management link, and this browser is remembered as that poll's creator (see the cookie described below). What's actually stored is a one-way hash of a random secret from that link — not the link itself — so reading the database can't be used to manage your poll, and a random visitor stumbling onto a poll id has no way to guess it. Nobody but you (whoever holds that link, or uses this same browser) can manage that poll; the site admin still can, the same as for any poll.

A logged-in creator can turn on "Log voter IP, country & device" for a specific poll — off by default, and only ever available to a logged-in creator (an anonymous poll can never have this on). When turned on, each vote on that poll additionally stores the voter's real IP address, a country code (read directly from Cloudflare's CF-IPCountry header — no separate geolocation lookup or third-party service involved), and a browser/OS string parsed from the request's User-Agent (e.g. "Chrome on Windows" — not a unique device identifier, just a general description). This is real, identifying information about a voter, and it's visible only to that poll's creator and whoever administers this site — never to other voters, and never through any public endpoint. If a poll has this turned on, voters are shown a notice about it directly on the voting page before they submit, stating exactly what gets recorded.

Both are visible to exactly two parties, using the same access rule: that poll's creator (from the poll's manage page) and whoever administers this VotePoll site (from the admin panel). Never to other voters, never in the public results view, and there's no way for either to reach anyone outside those two roles through the app's normal features.

Every uploaded picture is decoded, resized to fit within 1600×1600 pixels (never enlarged if it started smaller), stripped of all metadata (including EXIF data like camera info or embedded GPS location), and re-encoded to a plain WebP file under a random filename — the original file you uploaded is never itself written to disk or kept. Malformed files, and anything that isn't really a PNG, JPEG, or WebP image no matter what it claims to be, are rejected outright. Animated GIFs aren't accepted at all.

Unlike most self-hosted apps' upload folders, these images are not sitting in a public folder anyone can browse or link to directly — every image is served through the app itself (at /api/options/<id>/image), which checks the same access rules as the poll it belongs to. A public poll's images load for anyone; a password-protected poll's images require that same password to be unlocked first (or being the poll's owner or the site admin) — there's no separate, weaker path to reach a private poll's pictures. Removing an option's picture, or deleting the poll it belongs to, deletes the underlying file from disk (immediately for a removed picture; after the recycle-bin period described next for a deleted poll).

A poll (with its votes, comments, and any tracking data) is kept for as long as it exists — closing a poll (it stops accepting votes) does not delete anything by itself. Three things eventually remove a poll:

• You (or the site admin) delete it. It disappears from every normal view immediately, but sits recoverable in an admin-only recycle bin for 7 days before being permanently and automatically erased — at which point its votes, comments, tracking data, and uploaded images are all destroyed for good.
• An anonymous poll goes stale. A poll created without being logged in, with nobody who could come back to "Manage my polls" for it, is treated as abandoned once it's been closed for 90 days — it's then moved into the same 7-day recycle bin as above, not destroyed outright. This never applies to a poll created under an account, or to one that's still open, no matter how old.
• You delete your account and chose to take your polls with you — see below.

Short of one of those, a poll can stay in the database indefinitely, including after it closes.

From "Manage my polls," deleting your account is an explicit choice about your polls, not a side effect: you pick whether to keep them (they stay live, but lose their owner — visible only to the site admin afterward, the same state any anonymous poll is in) or delete them along with your account (into the same 7-day recycle bin a manual poll deletion uses). Either way, your account's own credentials, email, and display name are deleted immediately and completely — there's no leftover, ownerless account record.

This app sets up to three cookies, all strictly functional — no advertising, analytics, or tracking cookies of any kind:

• vp_device — the random duplicate-vote-protection id described above.
• vp_session — holds your login state (if you're logged in) and, for a password-protected poll you've unlocked, a marker that you've already entered its password this session. Cleared automatically after 12 hours, or immediately on logout.
• vp_creator — only set the first time you create a poll without logging in. A random id, unrelated to vp_device above, that lets "Manage my polls" find polls you created anonymously from this same browser. Kept up to ~400 days; clearing it just means this browser stops remembering those polls — each one's own private management link keeps working regardless.

Nothing is stored in your browser's local storage or session storage by this app, and no third-party scripts, fonts, or analytics are loaded — every script and stylesheet this site uses is served from this same site.

This installation is self-hosted: it runs on hardware controlled directly by the person or organization operating it, not on a shared third-party cloud platform built for this app specifically. The operator is the right person to ask about the exact physical location and jurisdiction of that hardware. Cloudflare sits in front of this app as a reverse proxy (terminating HTTPS and routing traffic to the server) — it sees connection-level information the way any such proxy would, but the app itself doesn't send your data to Cloudflare or any other third party beyond that normal proxying.

This page is a factual description of what the software does, written from its actual source code and database schema. It is not a substitute for legal advice, doesn't establish a jurisdiction or legal basis for processing, and doesn't make any compliance certification. If you operate this instance for others, you may need your own additional terms depending on who uses it and where they're located.