Privacy on this ballot

Who is running this contest

Now Georgia runs this contest. They decide what is collected here and why, and the answers you give belong to them: it is their contest, you are their reader, and they are the ones responsible for it.

Laurel, a product of CopperPress, is the software Now Georgia uses to run it. We hold and process what is collected on their instructions, for them. We do not use it for our own purposes, we do not sell it, and we do not add you to any list of ours. In the language data-protection law uses: Now Georgia is the controller and Laurel is their processor.

So if you want something corrected or removed, or you want to know how your details are being used, ask Now Georgia first — it is their contest and the answer is theirs to give.

What you are asked for

To take part you register once, with a name and an email address. We email you a link to confirm the address is yours. Confirming is not a requirement — an unconfirmed vote still counts in full — it simply makes you easier to tell apart from an automated signup.

Now Georgia may also add up to two opt-in boxes and a few short questions about you. Those are optional, they start empty, and a question you leave blank is not stored. Ticking an opt-in box is what lets Now Georgia email you about the contest through Laurel; leave them alone and they cannot.

If Now Georgia runs a newsletter, the form offers to sign you up, and that box starts ticked. Untick it and nothing is sent. Leave it and your name and email address are passed to Now Georgia's own newsletter service — their account, not ours — and you unsubscribe from it there.

Registering also records the address you connected from and the device fingerprint described below, on the same record as your email.

Now Georgia can see your name and address individually when they are looking into a suspicious pattern of voting. The reports they get about who took part otherwise show counts rather than people.

What is recorded when you nominate or vote

A Best Of contest is worth cheating at, so every nomination and every vote carries a record of how it arrived. That record exists to catch ballot stuffing and it is not used for anything else.

With each submission we record: your IP address and the country Cloudflare reports for it; a fingerprint your browser works out about itself from your screen, fonts, audio and canvas, which is the same for the same device; which family of browser you are using and a one-way hash of the full line your browser sends describing itself (the line itself is never stored); the language your browser asks for; the address — the site name only, never the full link — of the page you arrived from; how long the form was open before you sent it; how many times you tapped or typed in it; whether a hidden field that only automated software fills was filled; and the result of the Cloudflare check described below.

What is not recorded: what you read, how far you scrolled, how long you stayed, or where your pointer went. There is no session recording and no page-view tracking on this ballot, and there is no analytics service of any kind on it.

Bot and spam protection

We use Cloudflare Turnstile to tell people apart from automated abuse. It runs in its invisible mode: on almost every visit it draws nothing at all and you will never know it ran, and it only asks you to do something if Cloudflare wants a closer look.

To make that judgement Cloudflare receives four things about the request: your IP address, a fingerprint of the encrypted connection your browser opened, the line your browser sends describing itself, and the public key identifying the form you are on together with the address of the page it sits on. Turnstile then hands your browser a single-use challenge token, and when you submit the form our server sends that token back to Cloudflare to be checked. The token records that a check happened and how it went. It is spent on that one submission and it is not an identifier for you.

Cloudflare does that check as our processor — on our instructions, for us. It also uses what it sees to improve how well Turnstile tells people from bots, and for that second purpose it is acting for itself rather than for us. Cloudflare states that Turnstile sets no cookies and does not look for them, and that what it collects is not used for advertising: not handing the problem to an advertising business is the reason it exists.

All of that is set out in the Cloudflare Turnstile Privacy Addendum, which forms part of this notice by reference.

On this ballot Turnstile runs in the three places where automated abuse would do real damage: nominating, voting, and registering to vote. It is never a gate — a check that fails, or never loads at all, does not stop your nomination or your vote reaching us. It is one signal among several, and a person reviews the rest.

Cookies, and what your browser keeps

Reading these pages sets no cookie of ours at all, which is why they can be held close to you and load quickly. One cookie of ours is set the first time you register or send something: it carries nothing but an identifier that tells our server it is still you, and it expires. Cloudflare, which sits in front of this site as its network, sets its own cookies for security and traffic.

On a ballot you can answer without giving us an address, one more cookie is set at the moment you answer — never just for reading. It holds nothing but a number that stands for the answer you already gave, and it is what lets us keep the promise that everyone gets one say: without it we could not tell you apart from someone arriving for the first time. It is set only by your own device, is never sent to anyone else, and lasts until you clear your browser data or roughly a year passes, whichever comes first. If more than one person answers from the same phone or computer, that device is treated as one reader.

Your browser also keeps a little on your own device so a bad signal cannot lose your work: the picks you have made but not yet sent, and — only for as long as this tab is open — the device fingerprint. Clearing your browser data clears both.

Other companies involved

Cloudflare is the network in front of this site and the provider of the check described above.

Google's business lookup is used only if you nominate a business that is not already on the ballot: the text you type is sent so the business can be found and matched. It goes from our server, not from your browser, so your address and your identity do not travel with it.

Our email provider delivers the confirmation message and any contest email you opted into. If you joined the newsletter, that is Now Georgia's own provider and it is separate from this.

Sponsors. If a sponsor's panel appears on this ballot, we count that it was shown and whether it was clicked, so the sponsor can be told how it performed. What is stored against that count is a code derived from your address and browser that changes every day and cannot be turned back into either; no cookie is set for it, and it cannot be linked to anything you nominated or voted for. If you click through, the sponsor is not told which page you came from.

If a script on this page breaks, your browser sends us the error, the address of the page without anything after the question mark, and which browser you are on, so it can be fixed. Nothing you typed is included.

How long it is kept

The record attached to a nomination or a vote is kept while the contest is running and for 90 days after it closes — long enough for the result to be certified and challenged. After that the identifying parts of it are cleared automatically: your IP address, the device fingerprint, the browser hash, your language and the site you arrived from.

Two limits on that, stated rather than left to be discovered. Votes and nominations themselves can never be deleted — the database refuses it, and that refusal is what makes a result worth trusting — so a copy of the address and the fingerprint stays frozen beside the vote, and a copy stays on your voter record. Those two are cleared when someone asks for their identity to be erased, not by the 90-day sweep.

Asking about your details, or asking for them to go

Ask Now Georgia. This is their contest and their decision, and we act on their instruction.

Erasure works by severing you from your votes rather than by deleting them: your name and email address are replaced, the address and device details on your record are cleared, and the votes stay counted and anonymous. Nobody's results move because somebody exercised a right.