MyFiji Pulse — Privacy Policy
Effective: 29 May 2026
This policy explains what information MyFiji Pulse collects when you use this site, how we use it, and what choices you have. We've kept it plain. If anything is unclear, contact us — details at the bottom.
MyFiji Pulse is an independent civic initiative based in Fiji. It is not a registered company, charity, or non-governmental organisation. It is operated by a small team of Fijians committed to verified civic participation. If we register the initiative as a formal entity in the future, we will update this policy.
What we collect
When you vote on a poll, we collect:
- Your email address — so we can send you a one-time 6-digit code to verify you are a real person.
- A cryptographic fingerprint (hash) of your email — so the same person cannot vote twice on the same poll. After you verify your code, we do not keep your email address itself; we keep only this hash.
- Your vote choice — recorded as anonymous data linked to a randomly generated token. It is never stored alongside your email or your email hash.
- A cryptographic fingerprint of your IP address and of your browser's user agent string — stored alongside each vote you cast. These fingerprints cannot be reversed to identify you. They exist so we can detect coordinated abuse (one person trying to vote many times under different emails, automated voting, or many devices voting in lockstep) after the fact. We never store the IP address or the user agent string themselves — only the fingerprints.
When you submit a poll for review, we additionally collect:
- The poll question and answer choices you provide.
- Your verified email address (so we can contact you about your submission).
We do not collect:
- Your name (unless you choose to include it in a poll submission).
- Your phone number. (This may change in a future version. If it does, we will update this policy first.)
- Your physical location beyond what your IP address suggests.
- Any data from your device beyond what is necessary for the site to work.
How we use what we collect
| Data | Purpose | How long we keep it |
|---|---|---|
| Email address (plaintext) | Send your verification code | Discarded immediately after verification |
| Notify-me email address (plaintext) | Email you once when the next poll opens | Stored in plaintext until you ask us to remove it |
| Email hash | Prevent duplicate voting on the same poll | Indefinitely, so historical poll results cannot be re-litigated by returning years later |
| Vote choice | Count poll results | Indefinitely, as anonymous aggregate data |
| IP address (transient) | Rate limiting on individual requests | Not stored persistently — held in cache only during the rate limit window (up to one hour) |
| IP fingerprint and user agent fingerprint (on each vote record) | Detect coordinated abuse after the fact; cannot be reversed to identify you | Same lifetime as the vote record (indefinitely) |
| Poll submission content | Review by the MyFiji team before publishing | Retained while the poll is active; deleted on request after a poll closes |
Notify-me email signups
When no poll is currently open, the site offers a "Notify me" form where you can leave your email address to be told when the next poll opens. This is separate from voting. If you use it:
- We store your email address in plaintext — it is not hashed, unlike the email you use to vote.
- We keep it until it is manually removed. There is no automatic expiry.
- We use it only to email you once when a new poll opens. We do not use it for newsletters, marketing, or anything else.
- To have your address removed, email us at myfijiproject@gmail.com and we will delete it.
Two improvements to this flow are planned for a future update: a confirmation step when you sign up (double opt-in), and a self-serve unsubscribe link in the emails we send. Until those are in place, removal is by email request as described above. We will update this policy when they are added.
Who we share data with
We do not sell your data. We do not share it with advertisers. We do not share it with political parties, candidates, or campaigns.
We use third-party providers for email delivery, hosting, error monitoring, and DNS. They receive only what is operationally necessary — for example, your email address at the moment we send your verification code. Some of these providers are based outside Fiji, which means your data may be transferred internationally for processing.
Cookies
We use one cookie: a session cookie set by our web framework. It keeps you signed in to a vote-in-progress so the verification page knows which email you just entered. The cookie expires when you close your browser.
We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
Your rights
You have the right to:
- Ask what information we hold about you.
- Ask us to delete information we hold about you. (Note: we cannot un-cast a vote you have already cast, because votes are stored with no link to your identity — once cast, a vote is mathematically untraceable to you.)
- Ask us to correct anything that is inaccurate.
To exercise any of these rights, email us at myfijiproject@gmail.com.
Under Fiji's data protection law, you also have the right to file a complaint with the relevant authority if you believe we have mishandled your data.
Children
This site is not directed at people under the age of 18. If you are under 18, please do not submit your email address or vote.
Submitting polls
If you submit a poll for review:
- We will review it for clarity, accuracy, and compliance with our content guidelines (separate document, linked from the submission portal).
- We may contact you using the email you submitted with, to clarify, request changes, or decline.
- If we publish your poll, your email address is not displayed publicly. The submitter is not named on the poll page.
- We reserve the right to decline submissions without giving a detailed reason.
Security
- All traffic to and from this site is encrypted (HTTPS).
- Email addresses, IP addresses, and user agent strings are hashed using HMAC-SHA256 with secret keys held only by the platform. Hashes cannot be reversed back to the original values.
- Vote records are decoupled from voter identity at the database level. Vote records share no field with voter records that would allow joining the two. Even an administrator with full database access cannot link a specific vote to a specific email.
- The IP and user agent fingerprints stored with each vote exist solely to detect coordinated abuse on a specific poll. They are not used to identify individual voters and cannot be used to do so.
We follow standard practices, but no system is 100% secure. If you become aware of a security issue, please email us at myfijiproject@gmail.com.
Changes to this policy
We may update this policy as the site changes. When we do, we will update the effective date at the top.
Contact
Email: myfijiproject@gmail.com
MyFiji Pulse (an independent civic initiative)
Fiji
This policy was drafted plainly to be readable. It reflects how the platform actually works as of the effective date. If you have feedback that would make it clearer, please tell us.