Privacy Policy

The short version

• Voting is pseudonymous — no name, email, phone number, or location is required.
• We never sell votes, voter profiles, or personal data.
• Sponsorship (advertising) is completely separate from voting.
• Advertisers only ever see aggregate metrics — never voter identities.

Guest voting data

When you vote without an account we store: the state you voted for, the time, your platform, and privacy-preserving anti-abuse signals — a random installation identifier and network/device values that are one-way hashed (HMAC) after your IP address is truncated to a network prefix. We do not permanently store raw IP addresses, and we do not use commercial fingerprinting SDKs. We never ask guests for names, emails, birthdates, precise GPS location, contacts, camera, or microphone access.

Account data

If you create an account (via email link, Google, or Apple) we store your email, display name, followed states, and notification preferences. Authentication is provided by Supabase.

Sponsor / advertiser data

Advertisers additionally provide business display information, creatives (name, tagline, logo, destination URL), and payment. Payments are processed by Stripe; card details never touch StateBrag servers. We retain transaction records (amounts, Stripe references, acceptance timestamps of versioned terms and disclosures) as required for accounting and dispute handling.

Advertisers never receive voter data

Sponsors receive aggregate impressions, clicks, and approximate CTR for their own placements. They never receive voter emails, names, device identifiers, IP hashes, account IDs, or individual voting histories.

Notifications

Email and push notifications are optional and controlled in Settings. Push tokens are deleted when you disable push or delete your account.

Analytics

We use first-party aggregate counters (e.g., "votes today") rather than individual behavioral tracking. Optional error monitoring (Sentry), when enabled, is configured to scrub sensitive data.

Cookies and identifiers

We use a first-party cookie holding a random identifier to enforce the one-vote-per-24h rule, plus Supabase session cookies when you sign in. No third-party advertising cookies.

Retention

Vote aggregates are kept long-term; hourly detail is pruned after 90 days. Analytics counters are pruned after 400 days. Financial records are retained as required for legitimate accounting purposes. See our published retention documentation for details.

Deletion and your rights

You can delete your account from Settings (web and mobile). Deletion removes your profile, follows, notification data, and sessions; ends any active sponsorship placement; and pseudonymizes retained financial records. You can also download your data from Settings. Depending on your state of residence, you may have additional rights (access, correction, deletion, portability) — contact us to exercise them, and we honor them regardless of threshold requirements where feasible.

Children

StateBrag is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child's information was collected, contact us and we will delete it.

Contact

Privacy questions: contact StateBrag.