Privacy Policy

The rest of this page is the longer version. We've kept it as plain as we can without giving up legal precision.

When you take the assessment without an account

The DNA Scan, Origins, Dynamics, and Civics assessments can all be completed anonymously. When you do:

• Your responses to each question
• Computed scores and archetype match derived from those responses
• Timing data — total completion time and (in some cases) per-question dwell, used to flag low-effort or rushed responses during research
• An anonymous device fingerprint — a hashed identifier stored locally that lets us match you back to your prior result if you return to claim it under a new account
• A share code — e.g., DNA-M01-WTY-729-QYJ — which lets you reload your result later or send it to a friend for comparison
• Browser and device information at a coarse level (browser family, OS family) for technical compatibility

Anonymous results live on our servers under that device fingerprint. They are not tied to a name, an email, or any persistent identifier you didn't choose to provide.

When you create an account

You can sign up with Google or with a passwordless email link. When you do, we keep:

• Your email address
• Your display name (if you provide one)
• Any prior anonymous results from your device, linked to your new account so you can see them in your dashboard

The anonymous-to-account linking happens through a server-side function that matches your device fingerprint to prior results and re-keys them under your account ID.

Optional follow-up — the validation feedback widget

After your result, you may see a four-button feedback widget asking how well the archetype describes you (Spot on / Pretty close / Somewhat / Not me) and optional follow-up questions about your political background. These are explicitly opt-in:

• You can skip them; nothing about your result changes if you do
• Responses are stored alongside your quiz result and used to calibrate the assessment
• "Prefer not to say" is available on every demographic question
• Self-identification feedback feeds the research dataset described below

Share codes

A share code carries your dimension scores and archetype match. It does not carry your email, name, or any personal identifier. Anyone with the code can load the result; nobody with the code can learn who you are from it.

Technical data

Like every website, our hosting infrastructure logs basic technical events:

• IP addresses (used for rate limiting and abuse prevention; not linked to result data)
• Browser and OS family
• Pages visited and time spent
• Referring URL
• Application error logs (used to debug crashes and regressions)

To compute your result

• Score your responses across the four axes
• Match those scores to one of the thirty-two archetypes
• Render your result page and let you re-load it later via your share code

To calibrate the instrument

Political DNA is a research instrument as much as a self-knowledge tool, and instruments need calibration. Aggregated response data — with personal identifiers stripped — is used to:

• Identify questions that fail to discriminate or that confuse respondents
• Refine the archetype-matching logic
• Track aggregate archetype distribution across the respondent base
• Validate the four-axis structure against new respondent data

For research

Advancing understanding of political identity is a core purpose of the project. Response data informs research in the following ways:

• Publishing aggregate statistics about archetype distribution and dimension scores
• Analyzing de-identified individual-level response patterns to improve the instrument's validity and reliability
• Sharing de-identified response data with academic research collaborators when there's a clear research purpose and a data-use agreement in place
• Including findings in articles, talks, and (where appropriate) peer-reviewed publications

De-identified versus anonymous. "Anonymous" means you took the assessment without an account; we still associate your responses with your device fingerprint to make them recoverable to you. "De-identified" means responses entering the research pipeline have personal identifiers (IP, device fingerprint, account email, country-finer-than-country location) removed before analysis. Researchers see response patterns; they do not see people.

The PoliticalDNA Panel

The Panel is our opt-in research pool. You join only by an explicit act — ticking the panel box on a results page, or pressing the join button in your dashboard — and we record that consent with a timestamp. Membership means we email you a short survey a few times a year. Survey findings follow the research principles above: published in aggregate, never at the individual level.

Your address lives on the same email list described under Data Retention and is never shared with researchers or anyone else. Every email we send carries a one-click unsubscribe that ends panel membership on the spot; writing to support@politicaldna.org works too.

Political DNA runs on a small set of infrastructure services. Each is bound by its own privacy policy and (where applicable) a data-processing agreement with us:

The list is short by design. We do not run ad networks, behavioral-tracking pixels, or session-replay services.

A closer word on PostHog, since analytics on a site about political views deserves more than a table row. We use it to see which pages and features get used — nothing more. Automatic click-capture and session recording are disabled outright, so the only events that exist are the ones we explicitly send, and your individual quiz responses are never among them. Events travel through our own domain to PostHog’s US servers. If your browser sends the Do Not Track signal, PostHog is never loaded at all. The analytics dashboard we publish is built on our own Supabase tables, not on this event stream.

What we store on your device

• localStorage — your share code, last-viewed result, anonymous device fingerprint, minor UI preferences, and (unless your browser sends Do Not Track) the PostHog analytics identifier described under Third-Party Services. Persists until you clear it.
• sessionStorage — in-flight quiz progress. Clears when you close the tab.

Cookies we set

• Authentication session (only after you sign in) — a Supabase-managed session cookie that keeps you logged in. Strictly necessary; no account, no cookie.
• Analytics identifier — a first-party cookie set by PostHog so that repeat pageviews aren't counted as new visitors. It carries a random ID, not your identity, and is never set if your browser sends Do Not Track.

We do not set advertising cookies or any third-party (cross-site) tracking cookies. To opt out of the analytics identifier, enable Do Not Track in your browser — we honor it completely.

You can clear everything we've stored on your device by clearing site data for politicaldna.org in your browser. Doing so removes your local cached result and signs you out; your account record on our server is unaffected unless you specifically request deletion.

Depending on where you live, the following may apply — and even where they don't formally apply, we treat them as the floor.

Everyone, regardless of location

• Access — ask what data we have on you and get a copy in a standard format
• Deletion — ask us to remove your data. We honor these requests promptly.
• Portability — export your responses and results
• Research opt-out — ask to be excluded from future research datasets without deleting your account

California residents (CCPA / CPRA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we don't sell data, period)
• Right to non-discrimination for exercising any of these rights

EU / UK residents (GDPR)

• Right of access
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

Account holders can delete their account directly from Settings — we email a confirmation link before anything is removed. To exercise any of the other rights (or to request deletion by hand, including for anonymous results), email support@politicaldna.org. Include your account email or share code so we can find your records.

The site runs on infrastructure that handles the heavy lifting on security:

• All connections to and from the site use HTTPS / TLS
• The Supabase database encrypts data at rest
• Database access uses row-level security policies; the application has the narrowest permissions it can
• Authentication is handled by Supabase Auth (email/password, Google OAuth, or passwordless magic links); passwords are hashed by Supabase and are never visible to us
• Server logs are scoped to debugging and rate limiting; they aren't merged into the research dataset

No system is perfectly secure. If we ever discover a breach that compromises your data, we'll notify affected users promptly with a description of what happened, what was exposed, and what we're doing about it.

Political DNA isn't intended for users under thirteen. We don't knowingly collect data from children under thirteen, and if we learn we have, we delete it promptly. For users between thirteen and seventeen, we expect a parent or guardian to be aware of and comfortable with their use.

The site is operated by Michael Sertic from California, USA. Hosting infrastructure is US-based (Vercel) with data stored in US-located Supabase regions. If you access the site from outside the United States, your data is transferred to and processed in the US.

For EU and UK respondents specifically, we rely on the lawful basis of legitimate interest for the research uses described above, take a data-minimization-first approach to what we collect, and honor the GDPR rights enumerated in the prior section. If you'd prefer your data not be transferred or processed in the US, the cleanest remedy is to email us and request deletion before signing up.

This policy will evolve as the site does. When we update it, the "Last Updated" date at the top changes. Material changes — new categories of data collected, new third-party services, changes to the research uses described above — will be announced with a prominent notice on the site for at least thirty days before they take effect. Older versions can be requested by email.