What we hold, why we hold it, and what we will not claim.

The short version

We ask you one question a day about how you would vote. That answer is sensitive information under the Privacy Act 1988 (Cth), because political opinion is treated as sensitive in a way that most personal information is not. We treat it accordingly.

We link your daily answers to your account. We have to: the entire method depends on following the same people over time, and an anonymous daily poll would tell you nothing you could not get from a nightly phone survey.

So the honest promise is this: no one can see how you individually voted in anything we publish. It is not that we do not know. We do know, and we must, or none of the analysis on this site would be possible. Any organisation running a daily panel that tells you otherwise is describing something they have not built.

Who we are

Plumbline Report is the publication. Contact details are at the end of this page. We are the entity responsible for the personal information described here.

What we collect

When you join

• Email address — to identify your account and send the daily prompt.
• Password — stored only as an Argon2id hash. We cannot read it, and neither can anyone who obtains the database.
• Mobile number — to confirm one person is not registering many times. We check the line type so that disposable internet numbers are refused.

Each day you vote

• Your voting intention, and the date it was recorded in the election's timezone.
• Your approximate location, as a region — see below.
• Your IP address, and a one-way hash of your browser's user-agent string, to detect many accounts operating as one.

If you choose to answer

• Demographic questions such as age, education, and how you voted at the last election. These are optional, asked one at a time, and never required to vote.

Location, specifically

We do not store your coordinates. When your browser provides a location, we resolve it to a region in memory, keep the region, and discard the coordinates in the same operation. There is no column in our database for latitude or longitude, by design.

Location never stops you voting. It is recorded in three states — in the election's jurisdiction, outside it, or unknown — and "unknown" is reported as its own category. If you decline the location prompt, nothing happens to your vote. A meaningful share of any panel sits in "unknown", and treating that as evidence of anything would be wrong.

We are also candid that location data is weak evidence. It is straightforward to falsify. We use it as a disclosure statistic and as one signal among several, not as proof of anything about you.

Your consent

Because your voting intention is sensitive information, we collect it only with your consent. Joining the panel and recording a vote is that consent. You can withdraw it at any time by deleting your account, which removes your answers as described under Retention.

What we publish

Only aggregates. Every published figure is a count across a group, never a row about a person.

We apply a minimum cell size before publishing any breakdown. Where a group is too small, we publish a dash rather than a number. This is not a courtesy — a sufficiently narrow crosstab ("male, 35–44, regional Victoria, teacher") describes one identifiable person, and publishing it would be a disclosure regardless of the fact that no name appears.

Who else sees your information

We use a small number of service providers, and only for what they are named for:

• Google Cloud — hosting and the database, in the australia-southeast1 (Sydney) region.
• Mailgun — sends our email. It handles your email address and the content of the messages we send you.
• Twilio — sends the verification code. It handles your mobile number.

Mailgun and Twilio are United States companies, and your email address and mobile number are handled by them outside Australia. That is an overseas disclosure and we state it plainly rather than burying it. Your voting answers are not sent to either of them.

We do not sell your personal information. We do not share it with political parties, campaigns, or candidates, and we will not, in any form that could identify you.

Artificial intelligence

We use an AI service (Synap AI Pty Ltd) in our administration tools, to help staff draft the configuration for a new election — its name, date, timezone and the parties on its ballot.

No panellist information is sent to it. Not your answers, not your email, not your number. It is given a description of a public election and nothing else, and a person reviews everything it proposes before it is saved.

Retention and deletion

You can ask us to delete your account at any time. When you do, we delete your email address, your mobile number, and the link between you and your daily answers.

We keep the answers themselves in aggregate. Once a day's figures have been published, removing individual rows from behind them would falsify a published record, and we are not willing to do that. What is removed is everything that connects those answers to you.

Accounts that are inactive for an extended period are closed and their identifying information deleted on the same basis.

Seeing and correcting what we hold

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Write to the address below. We will need to be confident you are who you say you are before we send anything, for obvious reasons.

One thing we cannot correct is a past vote. Answers lock when you save them, and a record you can revise afterwards is not a record of what you thought that day.

Security

Traffic is encrypted in transit. Passwords are hashed with Argon2id. Verification tokens are stored only as hashes, so the values in our database cannot be used to confirm an address. Access to the underlying data is restricted to named administrator accounts, and administrative actions are written to an append-only audit log.

No system is beyond compromise, and we will not pretend otherwise. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Email you receive from us

We send one prompt a day while an election you have joined is running, plus occasional messages about your account. Every one carries a working unsubscribe link.

We would rather you paused than left. An unsubscribe is permanent and costs us a panellist; a pause is not. Both options appear in every email.

Complaints

If you think we have mishandled your personal information, tell us first and we will investigate. If our response does not satisfy you, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy in a way that materially affects you, we will tell you by email rather than quietly updating the date at the top.

Contact

hamish@synap.au