Privacy

For short

Di service dey keep username, password hash and wetin you write for dialogues. Confirmed address go change to keyed hash, unless you ask make dem dey send you reminders. Inside dialogue, notin wey you write dey show under your name, and seven days afta dialogue finish, dem go seal am: evri name inside am go change to random one, so nobodi fit tok again who write wetin. No trackers, no analytics, no advertising, and we no dey sell anytin. Dem dey delete dialogues wey no finish afta fixed number of days; di ones wey finish go remain. You fit ask for copy of your data, correction, or make dem delete your account. Di servers dey for European Union.

Translation to help you. Na di English text wey dey below get legal force.

Privacy

Last update 1 September 2026. Wetin we dey hold, why, and for how long — we write am from di code, no be from template.

Wetin we dey hold

Username and password hash. E get salt and hash; we no fit read your password.
Address only if you give us one, and only until you confirm am. Wen you confirm am, dem go delete di address and replace am with keyed hash — e dey enough to enforce one mailbox, one account, and to send password reset; e no reach to recover di address. One exception, by your own choice: if you ask for your dashboard make di coordinators of dialogues wey you dey inside dey send you reminders, we go keep dat address for dat one purpose — at most one mail for each stage, wey di platform dey send wen coordinator ask, we no dey ever show am to di coordinator — and we go remove am di moment you tok, or with your account.
Wetin you write: cards, explanations, side-chat turns, votes, links, nominations. Inside dialogue, di interface no dey show your name on any of dem anywia. While di dialogue dey run, di database dey record who write wetin, so one-vote-each and round robin fit work at all. Seven days afta dialogue finish, dem go seal am: evri name inside am go change to random one and dem no dey write di list of di changes anywia. Di coordinator name dey stay only as di room coordinator; wetin di coordinator write or vote dey change like evribodi else own. From den, notin for dis server fit tok who write which card, cast which vote, or tok wetin for side chat — no be di coordinator, no be di operator, no be court order. Your own record dey keep three tins: say you bin dey dat room; di sentence wey you write about wia you stand bifor and afta, with wia your stickers land for im map; and your own numbers from am, like how many cards you write, how many stickers dem get and how often your vote match di room verdict, as numbers wey no name any card. Na only you fit read dem, unless you share your totals for link of your own (neva your rooms or cards), wey you fit end any time; if you delete your account, e go delete dem and end di link. Di room dey keep one more tin: keyed code for each pesin wey sit inside am, neva for anytin wey dem do, so two groups of rooms wey share pipo no go count as independent. Dem dey make am from random value for your account, no be from your name; once dem delete your account, e no dey point to anybodi.
Which dialogues you bin dey inside. List for your record of room ids, neva of cards. Na wetin dey let you find room again, read private room wey you bin dey part of afta dem seal am, and make dem refuse you second seat for group of rooms wey you don already sit inside.
Private dialogues. Room wey dem open as private, na im members fit read am and nobodi else, for evri stage and afta e settle — no be pesin wey apply, no be pesin wey get di link. Di API, di page and di change feed all dey refuse di same way.
Signed session cookie, wey dey expire afta 14 days. No third-party cookies, no analytics, no advertising, no trackers.
Organisation lists: keyed hashes of di addresses wey administrator give, plus two-character hint so dem fit recognise one row. We no dey store di addresses themselves.

Wetin we no dey hold

No location, no phone number, no advertising identifiers, no profile wey dem build from how you dey behave, no IP logs pass wetin di web server dey keep for small time. We no dey sell anytin to anybodi.

Who else dey see am

Oda participants dey see wetin you write, but dem no dey ever see say na you write am.
Coordinator dey see di username of pesin wey dey ask to join, becos dat one na decision about whether one particular pesin belong.
Oda rooms dey see card only if you release am.
Processors: mail provider for confirmations and resets; payment provider if you subscribe; di server host. If di optional logic assistant dey on, di sentences of argument wey you submit to am dey go to Anthropic — no account details, and dem dey calculate di verdict for dis server anyhow.
Di operator fit read di database. Di records neva dey tamper-evident, and we dey tok am for di sign-in page instead of making pipo tink say e be anoda way.

How long

Dialogue wey no reach im map within 60 days afta e open, we go clear am, with evritin inside am: we no dey keep work wey no finish. Once di map don lay out, di record go remain.

Your account and wetin you write go remain until you delete dem. Addresses wey neva confirm dey expire with dia link. If you delete your account, e go remove di account and im contact hash. Wetin you contribute to dialogue go remain, without your name, becos oda pipo votes and maps stand on top am — to remove am go rewrite dia record. Na di same rule wey dey stop anybodi from editing history for dia own favour. Sealing (wey dey above) dey make di no-name permanent: afta am, to delete your account dey remove di last link between you and one room, di note say you bin dey inside.

Wetin we dey learn from am

For sealing, and only den, dialogue dey calculate one tin about imself: which cards bin dey di sticker sets of di pipo wey dia view change, against di ones wey dia view no change. Dem dey keep am as numbers for each card, neva for each pesin, and dem dey calculate am bifor dem change di names becos dem no fit calculate am afta. E dey show for di settled map with im size beside am, as description, no be finding.

Your rights

Ask for copy of wetin we hold about you, ask make we correct am, ask make we delete your account, or object to how we dey use am: hello@mg.truecauses.org. If we no fit do wetin you ask, we go tok why. You fit complain to your data protection authority.

Wia

Servers dey for European Union. Mail and payment providers fit process data outside am under dia standard safeguards.

Di English text wey get legal force

Privacy

Last updated 1 September 2026. What is held, why, and for how long — written from the code rather than from a template.

What we hold

A handle and a password hash. Salted and hashed; we cannot read your password.
An address only if you give one, and only until you confirm it. On confirmation the address is deleted and replaced by a keyed hash — enough to enforce one mailbox, one account, and to send a password reset; not enough to recover the address. One exception, at your choice: if you ask on your dashboard to receive reminders from the stewards of dialogues you are in, that address is kept for that one purpose — at most one mail per stage, sent by the platform on a steward's request, never shown to the steward — and removed the moment you say so, or with your account.
What you write: cards, clarifications, side-chat turns, votes, links, nominations. Inside a dialogue these are not attributed to you anywhere in the interface. While the dialogue is running, the database records who wrote what, so that one-vote-each and round robin can work at all. Seven days after a dialogue completes it is sealed: every name inside it is replaced by a random one and the list of replacements is not written anywhere. The steward's name stays only as the room's steward; what the steward wrote or voted is replaced like everyone else's. From then on nothing on this server can say who wrote which card, cast which vote, or said what in a side chat — not the steward, not the operator, not a court order. Your own record keeps three things: that you were in that room; the sentence you wrote about where you stood before and after, with where your stickers ended up on its map; and your own numbers from it, such as how many cards you wrote, how many stickers they drew and how often your vote matched the room's verdict, as counts that name no card. Only you can read them, unless you share your totals at a link of your own (never your rooms or cards), which you can end at any time; deleting your account deletes them and ends the link. The room keeps one more thing: a keyed code for each person who sat in it, never for anything they did, so that two groups of rooms sharing people are not counted as independent. It is made from a random value on your account, not from your name; once your account is deleted, it points at no one.
Which dialogues you were in. A list on your record of room ids, never of cards. It is what lets you find a room again, read a private one you were part of after it is sealed, and be refused a second seat in a group of rooms you already sat in.
Private dialogues. A room opened as private is readable by its members and by nobody else, at every stage and after it is settled — not by an applicant, not by someone holding the link. The API, the page and the change feed all refuse the same way.
A signed session cookie, expiring after 14 days. No third-party cookies, no analytics, no advertising, no trackers.
Organisation rosters: keyed hashes of the addresses an administrator supplied, plus a two-character hint so they can recognise a row. The addresses themselves are not stored.

What we do not hold

No location, no phone number, no advertising identifiers, no profile built from your behaviour, no IP logs beyond what the web server keeps transiently. We sell nothing to anybody.

Who else sees it

Other participants see what you wrote, never that you wrote it.
A steward sees the handle of someone asking to join, because that is a decision about whether a particular person belongs.
Other rooms see a card only if you released it.
Processors: a mail provider for confirmations and resets; a payment provider if you subscribe; the server host. If the optional logic assistant is enabled, the sentences of an argument you submit to it are sent to Anthropic — no account details, and the verdict is computed on this server either way.
The operator can read the database. Records are not yet tamper-evident, and we say so on the sign-in page rather than implying otherwise.

How long

A dialogue that does not reach its map within 60 days of opening is purged, with everything in it: unfinished work is not kept. Once the map is laid out, the record stays.

Your account and what you wrote stay until you delete them. Unconfirmed addresses expire with their link. Deleting your account removes the account and its contact hash. What you contributed to a dialogue stays, unattributed, because other people's votes and maps were built on it — removing it would rewrite their record. That is the same rule that stops anyone editing history in their own favour. Sealing (above) makes the unattribution permanent: after it, deleting your account removes the last link between you and a room, the note that you were in it.

What we learn from it

At sealing, and only then, a dialogue computes one thing about itself: which cards were on the sticker sets of the people whose view moved, against those whose view held. It is kept as counts per card, never per person, and it is computed before the names are replaced because it cannot be computed after. It is shown on the settled map with its size next to it, as a description, not a finding.

Your rights

Ask for a copy of what is held about you, ask for it corrected, ask for your account deleted, or object to how it is used: hello@mg.truecauses.org. If we cannot honour a request we say why. You may complain to your data protection authority.

Where

Servers in the European Union. Mail and payment providers may process data outside it under their standard safeguards.

Terms · About · How e dey work