Privacy and Submission Data

Updated 21 October 2026. This page describes the current website and its limits.

Who is responsible

UER is an independently maintained proposal operated as Tony's project. Use Contact for access, correction, deletion, security, or review requests. A government or independent election authority does not certify this website.

What a submission contains

A voting submission contains your name, birth date, email, country, document type and number, ID image, selfie, typed acknowledgement, YES or NO choice, creation time, and review status. An administrator's name and review time are recorded when reviewed. Contact messages contain the details you enter.

Identity and political choice are stored together. This is not a secret-ballot system. The eligibility review page hides the choice, but privileged database operators can access it. The reference permits status lookup; keep it private. Lookup responses exclude your identity evidence, country, and vote choice.

Purpose and access

Documents support manual identity review and intended duplicate prevention. There is no automated AI identity match, liveness check, or independent election certification. Review access requires administrator authentication. Images open separately through protected routes; the review list does not embed them.

New images are decoded, size-limited, and re-encoded without their original EXIF or location metadata. Verified transport encryption is used for remote database connections. The application does not currently encrypt individual identity fields with a separate application key; infrastructure access remains a sensitive privilege.

Service providers and messages

UER runs on DigitalOcean infrastructure. Paradise Modern receives public editorial analytics, network context for abuse assessment, and transactional mail requests. Shield assessment excludes document contents, identity form fields, and vote choices. Mail receipts use your email and submission reference; political choices and document images are excluded.

Submission and status routes are excluded from editorial analytics. Public editorial visits may use a first-party visitor cookie and ad-click attribution cookies. Google Fonts requests may disclose ordinary browser network information to Google. This site displays no ad banners or ad slots.

A native submission is not marketing consent. Mail marked accepted means the mail provider accepted a request; it does not establish inbox delivery. Operator access and provider operation remain necessary to process your request.

Retention and your choices

A fixed automatic deletion schedule has not yet been established. Records and backups are retained pending an explicit retention policy and reviewed requests. Do not send documents if this retention or the combined identity-and-choice record is unacceptable to you.

You may request access, correction, deletion, or a review of a rejected submission through Contact. Include your reference if available; never attach another identity document to a contact message. The operator must verify a request privately before acting. Deleting a live record and expiring backup copies are separate operations; no automatic completion time is promised here.

You can read every proposal page and ask questions without submitting identity evidence. A submission does not establish legal assent to a governmental constitution. Future changes to the proposal do not reinterpret an existing submission.