Last updated 1 November 2026

Privacy

AMU Union Polls is a just-for-fun mock poll, not the official election. Here is exactly what it collects, why, and what happens to it.

Who runs this

This site is run by SDCAMU as a non-commercial student project. For anything about your data, write to [email protected]. That address is also the grievance contact.

What we collect and why

Your enrolment number and email address, to check that each student votes only once, and to email you a sign-in code.
The 6-digit code, stored only as a keyed hash, plus an encrypted copy used to send the email. The encrypted copy is erased once the code is used or expires.
Your votes, linked to your verified enrolment number so the one-vote rule can be enforced.
A sign-in session token, kept in a cookie on your device. We store only a hash of it.
Your IP address and browser details (the user-agent string) when you ask for a code or send a report, and when a sign-in or vote is refused, repeated or rate-limited. These go into an attempts log that the organiser checks for fake or repeated sign-ups. Rate-limit counters store only keyed hashes, not the IP address or email itself.
An anonymous visitor ID: a random value in a cookie, used only to count visitors. It isn't linked to your sign-in.
Reports you send through the contact page: your email, the enrolment number you mention, your message, and your IP address and browser details.
Server logs on our web server, with IP address, time and the page requested.

You give this data by choosing to take part. Candidate profiles, photos, galleries, social links and supporter entries are supplied by or on behalf of candidates and are public. A WhatsApp link on a profile is added only with that person's consent.

What we don't do

We don't ask for your name, phone number or a password. We don't sell or share your data for marketing, we show no ads, we use no advertising cookies, and we don't build profiles of you. Automated checks (rate limits and a bot check) are used only to stop abuse.

Who else handles it

Cloudflare runs the site's DNS and sits in front of it as a proxy and security layer, including the “are you human” check (Turnstile). It sees your IP address and requests.
Oracle Cloud Infrastructure hosts the server and the database.
Resend delivers the code email, so it receives your email address and the code. If it fails or reaches its daily sending limit, Brevo is used instead and receives the same.
Google Analytics (Google) counts visits to the public pages of this site. It receives the page address (without anything after a "?"), the page title, your browser and device type, the page you came from and an approximate location worked out from your IP address, and it sets cookies to tell visits apart (see the Cookies page). Google says Analytics 4 does not log or store IP addresses. We have switched off Google's advertising features, it is not loaded on the admin area, and we never send it your enrolment number, email, sign-in or votes. How long Google keeps it is set in our Analytics account and by Google's own policy, which this site doesn't control and which is not covered by the deletion dates above.
YouTube (Google), only if you tap a video on a candidate's profile. Until you tap, the video is just a card and nothing is requested from YouTube or Google. After the tap, the player loads from youtube-nocookie.com, and the player then loads resources from Google and YouTube domains (for example ytimg.com, googlevideo.com, gstatic.com and google.com). Those services can receive your IP address and the page address, and may set their own identifiers under Google's policy. This site doesn't control that.
Instagram, Facebook and LinkedIn videos are plain links: nothing is requested from those sites until you click, and then the other site opens in a new tab under its own policy.

How long we keep it

Voting closes on 5 November 2026 at 8:00 am (India time). We delete the data below on 12 November 2026 at 8:00 am (India time), 7 days after voting closes, or earlier if the organiser does it sooner. On that date we delete all votes, sign-in sessions, codes, attempt logs, reports and enrolment numbers. We keep your email address for contacting you about this poll and its result, not linked to your enrolment number or votes, until 2027-03-31, or until you ask us to delete it at [email protected]. Backup copies are deleted within 7 days, and server logs within 14 days. Our email provider keeps its own delivery logs under its policy.

Until then, we keep this data while the poll runs and for the days after it. Codes stop working after 15 minutes, and the encrypted copy used to email a code is erased once the code is used or expires. If you ask us to remove your data before the deletion date, the organiser deletes your votes and sign-in sessions, and keeps a marker of the withdrawn enrolment number and email (so they can't be used to vote twice) and the attempt-log entries until the deletion date, when they are deleted as above.

Candidate profiles, photos, galleries, social links (including any WhatsApp number a candidate chose to list) and supporter entries are public campaign content supplied by or on behalf of candidates, not voter data. They are not deleted then and stay on the site. Candidates and supporters can ask for removal through the contact page.

If this setting ever changes, we never keep more than this page has promised: once it has said that email addresses are deleted, they are deleted.

Your rights

You can ask what data we hold about you, ask us to correct it, ask us to delete it, or withdraw from the poll. Email [email protected] from the address you used, and say what you'd like. We'll reply as soon as we can, and within the poll period where possible. If you aren't happy with our reply, write to the same address marked “Grievance”.

India's Digital Personal Data Protection Act, 2023 gives people rights over their personal data. The operator intends to follow it for this poll. This page doesn't claim formal legal compliance or any certification.

Children

The poll is for students of Aligarh Muslim University, who are university students. It isn't meant for anyone under 18. If you are under 18, please don't take part.

Security

The site is served over HTTPS. Codes and sign-in tokens are stored only as hashes, rate-limit counters only as keyed hashes, and the organiser area is protected by a password with repeated wrong guesses locked out. Only the organiser can see the attempts log and reports. No system is perfectly secure; if we learn that your data has been exposed, we intend to tell you by email and on this site.

Changes to this policy

If this policy changes, the date at the top changes too. A change never lets us keep data this page has already said will be deleted (see “How long we keep it”).

Loading…

See also Terms · Privacy · Disclaimer · Cookies · Contact