What we collect, and what we refuse to.

What is public

• Your display name, only if you explicitly chose to be listed
• Your country
• The month you signed
• Your verification status
• Your public receipt ID

If you chose a private signature, none of this appears anywhere. You are still counted.

What is never public, and never searchable

• Your email address
• Your phone number
• Your IP address
• Any government ID or identity document
• Your home address
• Any internal risk or fraud score
• Any identity-provider record

We do not ask for your date of birth

We used to. It checked you were 18 or over, and it went into a one-way fingerprint that helped catch duplicate signatures.

Neither reason survived a second look. A typed date never proved an age, because nothing stopped anyone typing a different year, and your confirmed email address already catches duplicates on its own. So the date was doing very little and it was the most sensitive thing we held about you. It is gone: not asked for, not stored, and there is no column left anywhere that could hold one.

You tick a box to say you are 18 or over. That is recorded. It is a statement you make, not something we checked, and we would rather say so plainly than imply more.

Where your email lives

Encrypted, in a separate database schema from the public application data, with no foreign key joining the two. Search and analytics have no access to it at all. A deterministic keyed hash sits alongside it so we can recognise a repeat signature without decrypting anything.

Cookies

We use no advertising, analytics or tracking cookies, so there is no cookie banner: there is nothing to ask you about. Most pages set no cookies at all.

Three cookies exist, each only while you do something that needs it:

• hasa_signing holds your place while you sign, so the steps of the form belong to you and nobody else. It has no expiry date, so it ends with your browser session.
• hasa_manage keeps you signed in while you correct, hide or withdraw your signature. It also ends with your browser session.
• hasa_admin is for the people who run the site, on the admin pages only. It expires within an hour.

Only our server can read them, not scripts on the page, and they travel only over a secure connection.

Forms are protected from bots by Cloudflare Turnstile. It reads technical signals, such as your IP address and browser, only to tell a person from a bot, never for advertising. Cloudflare explains it in its Turnstile privacy policy.

If you sign with Google, you leave this site for Google’s sign-in page, and Google’s own rules apply there.

What we never do

• Sell, rent or share signer data with anyone
• Let a campaign buy a list of signers
• Send personal data to analytics
• Write personal data into application logs
• Publish a downloadable list of names
• Require a newsletter subscription in order to sign

People who are not signers

The accountability record holds information about people other than signers. It is a different kind of data with a different basis, so it is described separately rather than folded in above.

Public officials

• We record the office, not the person: a ministry, a title, the institution, and an official contact route published by that institution itself.
• Where a current holder is named, that name comes from the institution’s own website and is recorded with the page it was read from and the date.
• No private contact details. A minister’s official inbox is public information. Their personal address, phone or home is not, and nothing here needs it.
• Nothing about an official is published until a person has checked it against the official source. Until then it is a candidate and is invisible.
• Party affiliation, where recorded, is descriptive only. It is never used to rank, filter or infer anyone’s position.

Organisation representatives

• If you apply to endorse on behalf of an organisation, your name and role are published with that endorsement if it is approved. That is the point of an endorsement, and you are told so before you apply.
• Your email address is not stored with the application. It is used once to work out whether your verified address is on the organisation’s own domain, and only that yes-or-no is kept. The address itself stays where every signer address stays.
• Approving an organisation does not change your personal signature. An organisation endorsing is not the same as an employee signing.

Our own reviewers

Every published fact, status label, contact route and correction carries the name of the person who checked it. That is deliberate: a record nobody stands behind is a record you have to take on trust, and this one is meant to be checked instead.

When you contact a decision-maker

• We never send anything. The site drafts a message from published facts and their sources. You read it, edit it, and send it yourself from your own email or through the official contact form.
• We record that an action page was viewed, that a draft was generated or copied, and that a contact link was opened. We do not record who did any of it, those rows carry no signer, no address and no device identifier.
• We never record that a message was sent, because we cannot see that. A count claiming otherwise would be describing activity nobody observed.

The evidence record itself

Claims, sources, treaties, laws and country statuses are records about governments and institutions, not about people. The public API and the data downloads expose that layer and nothing else: no signer, no receipt, no address. There is an automated test that walks every API response looking for exactly those things.

Your rights over your signature

Without creating an account, you can view your signature, change whether your name is public, correct your name, change your country, export everything we hold, and withdraw entirely. We email you a single-use link that expires in 30 minutes. The link always goes to the address already on file.

Asking for a link gives the same answer whether or not a signature exists, so nobody can use it to find out whether you signed.

Manage your signature

Withdrawal

Withdrawing removes your signature from public search and subtracts it from every total. The receipt ID stays valid so the record is honest, and it is never reissued to anyone else.