Privacy Policy

Last updated 6 September 2026

1. Who this is about

Take a Stance (“the site”) is an independent project, operated from within the European Union. For the purposes of the General Data Protection Regulation (GDPR), the operator is the data controller for the limited processing described here. You can reach the operator at contact@takeastance.world.

2. What the site records when you use it

Your answers

When you answer a question, one record is written containing: which question it was, whether you agreed or disagreed, whether the question was liked at that moment, a two-letter country code, the country’s name, a session id, a short code for how the visit began, and a timestamp. The same answer also increments the running totals shown on the question.

The session id is a random number — a version 4 UUID, such as 0f8f0e2a-4b1c-4d3e-9a77-6c2f5b1d0e44 — that your browser generates for itself the first time you answer something and keeps in its own local storage. It is not an account, it is never shown to you, it is never sent to anyone else, and it holds nothing about you: not your name, not your device, not your IP address, and nothing that could be looked up anywhere. Nothing about it survives leaving this site.

What it does is the whole reason it exists: it links the answers from one browser to each other, so the site can eventually say something about how people who took one stance tend to answer elsewhere. That makes those rows pseudonymous rather than anonymous, and it is the one identifier this site creates. Nothing on the site reads it back yet.

You are never asked to keep it. It resets when you use Delete Everything on the statistics screen, when you clear site data in your browser, and in a private or incognito window, which starts with an empty local storage and so makes up a new one. Answers already written keep the old id, which by then is a random number nothing on your device holds any more.

How the visit began

Links to this site are posted by hand on other platforms, and the code records which of them was followed — one short value from a fixed list, such as x, fb or direct. It comes from the ?s= on the link, or, where the link had none, from the site that referred the visit, which your browser tells the server as a matter of course. Nothing else about that page is kept: not the address, not the post, not the search you typed. Anything that is not one of the codes on the list is discarded rather than stored.

It is recorded only if you answer a question. The code is held in your tab while you read and is sent with a vote or not at all, so if you look around and leave, nothing about how you got here is written down anywhere. It lasts as long as the tab: coming back tomorrow from a bookmark records direct, whatever brought you the first time.

Approximate country

The country code is worked out from your IP address at the moment of the request, using an offline lookup table that ships with the server. No request is made to any third party to do it, and the IP address itself is never written to the database — it exists in memory for the length of the request and is discarded. The result is country-level only: not a city, not a region, not a network.

Likes

Liking a question increments a counter on that question. Nothing about who liked it is stored on the server; the record that it was you lives only in your own browser.

Topic suggestions

If you submit a suggested question, the site stores the text you typed, a two-letter country code and a timestamp. Suggestions are submitted anonymously and no contact details are collected with them, so please do not put personal information into that box — neither yours nor anyone else’s. Approved suggestions may be rewritten and published as questions in the game.

Rate limiting

To stop one machine flooding the counts, the server keeps a short list of recent request times per IP address in memory. It is never written to disk or to the database, it is discarded within minutes, and it exists only to answer the question “has this address made too many requests in the last sixty seconds?”.

Server logs

The hosting platform records standard technical request logs, which can include IP addresses, timestamps, requested URLs and user-agent strings. These are generated by the infrastructure rather than by the site’s own code, are used for security and debugging, and are retained on the platform’s own short rolling schedule.

3. What the site does not collect

• No name, email address, phone number or postal address.
• No account, password or login of any kind.
• No IP addresses stored alongside your answers.
• No advertising or cross-site tracking identifier. The session id described in section 2 is the only identifier this site creates: it is random, first-party, confined to this domain, and never shared.
• No first-party analytics package, and no behavioural profiling. The visit source in section 2 is a count of which link was followed, not a record of what you did afterwards.
• No special-category data — the site never asks about your health, beliefs, politics, ethnicity or sexuality, and answering a question that touches on one of those subjects records only “agree” or “disagree” against a row that carries a random id and a country code.

4. Storage on your own device

Most of what makes the site feel like it remembers you is held in your browser’s local storage. It is what lets your statistics screen work, keeps you from being shown the same question twice in a session, and keeps a like from being counted twice. Only two of these ever leave your device — the session id and the visit source, both of which travel with an answer and only with an answer, as described in section 2. Currently:

• userResponses — how you answered each question.
• answerLog — the order you answered them in, and the date of each, which is what your answer history is drawn from. It is held on your device only and is never sent anywhere.
• likedTopics and likeFloors — which questions you have liked, and the counts you were last shown.
• answerCount and rewardState — how far along you are, and which rewards you have opened.
• seenTopicIds — questions already shown to you, so the next one is new.
• topicCache — a copy of questions you have seen, so the statistics screen does not have to re-fetch them.
• preferredLanguage — the language you chose.
• sessionId — the random id your answers are filed under. Sent to the server with each answer.
• visitSource — the short code for how this visit began, described in section 2. It is the one item here kept in session storage rather than local storage, which means the browser discards it when the tab is closed. Sent to the server only with an answer.

One cookie is set: lang, holding your chosen language code for a year. It exists because the server has to pick a language before it can render anything, and it cannot read local storage. It is a strictly necessary preference cookie, it carries no identifier, and it is the only cookie this site sets itself.

You can clear all of the above at any time: use Delete Everything on the statistics screen, or clear site data for this domain in your browser’s settings. Doing so does not remove answers already counted, and it is what severs them from you: the id they were filed under is gone from your device, so nothing left in your browser can point at them, and anything you answer afterwards is filed under a new one.

5. Service providers

The site runs on Google Cloud and stores its counts in Google Firestore. Google acts as a processor for that data, under Google’s own terms and security practices, and receives only what is described in section 2 — which contains no personal identifiers.

Fonts are compiled into the site at build time and served from this domain, so loading a page makes no request to Google Fonts or any other font host. The site loads no third-party scripts, embeds, social widgets, comment systems, tag managers or advertising of any kind.

One thing is fetched from elsewhere. A trending question may carry links to what was reported about it, and the picture on each of those cards is the publisher’s own, loaded from the publisher’s own servers rather than copied onto ours. Your browser therefore makes a request to them, which tells them an address somewhere loaded a picture; the request is sent without a referrer, so it does not tell them which question you were reading, and nothing is sent back to this site. No other page on the site loads anything from anyone else.

6. Legal bases for processing

• Legitimate interests (Article 6(1)(f)) — counting anonymous answers, deriving a country code so results can be shown by country, and rate-limiting to protect the integrity of those counts. The processing is minimal, uses no identifiers, and could not be done at all without it.
• Legal obligation (Article 6(1)(c)) — retaining technical logs where required, and responding to lawful requests.

Consent is not among them, because nothing here is stored on your device that would need it. The strictly necessary lang cookie and your local storage are exempt from consent requirements under the ePrivacy Directive: both are set at your own request and neither is used for tracking. That is why the site shows no cookie banner.

7. How long things are kept

• Answers and likes — kept indefinitely, because they are the site’s aggregate record and contain nothing personal.
• Topic suggestions — kept while under review and for a reasonable period afterwards.
• Rate-limit entries — minutes, in memory only.
• Platform request logs — the hosting platform’s own rolling retention period, typically weeks.
• Local storage and the lang cookie — until you clear them; the cookie expires after one year.

8. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. You also have the right to lodge a complaint with your national data protection authority.

There is an honest limit to how far those rights can be exercised here, and it is worth stating plainly. Answers are stored under a random session id and nothing else, and that id exists only in your own browser: it is never tied to a name, an address, an account or an IP, and the site holds no way of connecting one to a person. The site therefore cannot find your records for you — it can only find them if you hand it the id yourself, which you can read out of your browser’s local storage for this domain under sessionId, and which no longer exists if you have cleared it. Under Article 11 of the GDPR, a controller who cannot identify a data subject is not required to acquire additional information purely to do so, and asking you for anything more in order to honour deletion requests would make privacy worse, not better. In practice: the data you can delete without asking is on your device, and Delete Everything removes it — including the id, which is what detaches the answers already written from your browser for good.

For anything that can be acted on — answers filed under a session id you still hold and can quote, a topic suggestion you would like withdrawn, a quoted excerpt you want removed, or a request relating to platform logs — write to contact@takeastance.world and include enough detail to identify what you mean. Requests are answered within one month.

9. International transfers

Data is processed on Google Cloud infrastructure, which may involve transfers outside the European Economic Area. Google relies on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework for such transfers. The data transferred by this site contains no personal identifiers.

10. Children

The site is not directed at children and asks for no information from anyone. It discusses adult subjects — politics, faith, relationships — and is intended for readers aged 16 and over. If you believe a child has submitted something identifying through the suggestion box, write to the address above and it will be deleted.

11. Security

The site is served over HTTPS, writes to the database only through server-side code with restricted credentials, and never exposes database credentials to the browser. No system is perfectly secure, but the amount of personal data at risk here is deliberately kept close to zero.

12. Changes to this policy

If what the site collects changes, this page changes with it and the date at the top is updated. Material changes to how personal data is handled will be flagged in the site itself.

13. Contact

Questions about any of the above: contact@takeastance.world, or see the Contact page. The Terms and Conditions cover the rest of the relationship between you and the site.