Privacy Policy

This policy explains what personal data vomatt collects on our website and apps, why we use it, and the choices you have. vomatt is an early-stage project run by Hsiang Chin, an individual based in Taiwan (“we”, “us”), who is responsible for your personal data. If a company is set up to run vomatt, we’ll update this policy and let you know.

1. What we collect

Information you give us

• Email address: to sign you in with a one-time code and to send a welcome email when you join. We don’t send marketing email.
• Passkeys: if you add one, we store its public key, the name you give it, and when it was added and last used. The private key never leaves your device or password manager.
• Profile: username, display name, bio and avatar (picked from our set of characters; we don’t accept photo uploads). Optionally, your first and last name, birthday and location.
• Polls and activity: polls you create, votes you cast, comments and replies (including people you @mention), likes, bookmarks and shares, the people and tags you follow, the people you block, and the invite lists you make.
• People you invite: when you invite someone to an invite-only poll by email, we store that address and send them an invitation on your behalf. Only invite people who would expect to hear from you.
• Reports and feedback: content you report, with the reason and any note you add, and problem reports you send us.

Collected automatically

• Cookies: to keep you signed in and remember your language and settings. See the Cookies Policy.
• IP address and browser details: we use your IP address to limit repeated requests and sign-in attempts, and we record it with your browser type in security logs when you sign in or change your account.
• Poll views: counted so we can show trending polls. A signed-in member counts once per poll per day.
• Usage analytics: only if you accept analytics cookies. Pages visited and general device information, through Google Analytics.

2. How we use it

• Run your account and the Service: sign-in, polls, votes, comments, follows and in-app notifications.
• Send sign-in codes, a welcome email, and poll invitations that members ask us to send.
• Keep votes fair and the platform safe: one vote per member, limiting abuse and fake accounts, reviewing reports and enforcing our Terms.
• Understand how vomatt is used and improve it.
• Meet legal obligations.

Legal bases (where the GDPR applies): performing our contract with you; our legitimate interests in security, preventing abuse and improving the Service; your consent for analytics cookies; and legal obligations.

3. What others can see

• Always public: your username, avatar, the date you joined, and how many polls you’ve created and votes you’ve cast.
• Public unless you hide them: display name and bio.
• Hidden unless you show them: your real name and location.
• Never shown to others: your email address, birthday and block list.
• Polls and comments: a public poll is listed in the feed, Explore and search; an unlisted poll can be opened by anyone with its link; an invite-only poll only by its creator and the people invited. Comments are visible to anyone who can see the poll.
• Votes: while a poll is open, results are sealed: people see turnout, not counts. After it ends, the poll’s creator decides who can see what each person chose: nobody, only the creator, or any signed-in member. This setting is shown before you vote and can’t change once the poll opens.
• Anonymous votes: you can vote anonymously, or make it your default, to leave your name out of voter lists. Once the poll ends, we delete the link between an anonymous vote and the option chosen; only the totals remain.
• Follows: who you follow and who follows you, as shown on profiles.

4. Who we share it with

We don’t sell your personal data or share it for advertising. We share it only with providers who help run vomatt, under contract:

• Vercel: hosting for the website and our servers.
• Neon: database storage for account and poll data.
• An email delivery service: delivering sign-in codes, welcome emails and poll invitations.
• A cache service: short-lived sign-in and rate-limit records.
• Sanity: site content such as this page (no member data).
• Google: analytics, only if you accept analytics cookies.

We may also disclose data if the law requires it, or to protect people’s safety.

Some providers process data outside your country, for example in the United States. Where required, we use safeguards such as Standard Contractual Clauses.

5. How long we keep it

• Account, profile and activity: until you delete your account.
• When you delete your account: everything is deleted immediately and permanently, including the polls you created together with the votes and comments others left on them. Your votes on other people’s polls are removed from their totals.
• Deleted comments: hidden from everyone straight away. We keep the text until your account is deleted so we can handle reports about it.
• Invited email addresses: if the person hasn’t joined, deleted 30 days after the poll ends.
• Sign-in: one-time codes expire after 3 minutes and are stored only in scrambled (hashed) form. Sessions end after 30 days without use.
• Abuse limits: request counters tied to your IP address last a few minutes; records of failed sign-in attempts last up to 24 hours.
• Security logs: 180 days. When you delete your account, your entries are anonymized.
• Poll view counts: 30 days.
• Analytics: up to 14 months in Google Analytics.

6. Your choices and rights

• Download your data: in Account settings, get a file with your profile, polls, comments and votes (once a day).
• Correct it: edit your profile at any time. To change your email address, contact us.
• Choose what’s shown: set who sees each profile detail, and whether you vote anonymously by default.
• Delete your account: in Account settings.
• Withdraw analytics consent: any time, with Cookie settings on the Cookies Policy page.

Depending on where you live, including under Taiwan’s Personal Data Protection Act and the GDPR, you can also ask to access, correct, delete or export your data, and object to or restrict how we use it. Email hello@vomatt.com. You can also complain to your local data protection authority.

7. Security

Sign-in tokens are kept in httpOnly cookies and sent only over HTTPS, one-time codes are hashed and expire quickly, and repeated sign-in attempts are locked out. No system is perfectly secure, so please keep your email account safe: anyone who can read it can sign in as you.

8. Children

You must be at least 13 to use vomatt. If you’re under 18, you need permission from a parent or guardian. If we learn that a child under 13 has an account, we’ll delete it. Parents who think this has happened can email hello@vomatt.com.

9. Changes

We’ll post updates here and change the date at the top. If a change is significant, we’ll tell you on the site or by email before it takes effect.

10. Contact

Hsiang Chin (vomatt), Taiwan: hello@vomatt.com