Fair Say NZ
Privacy Policy
Last updated: 1 November 2025
Who we are
Fair Say NZ is an independent civic engagement platform. We are not affiliated with any political party, government body, or commercial interest. Our purpose is to give New Zealanders clear, unbiased information about politics and a place to make their voices heard on civic questions.
We are subject to the New Zealand Privacy Act 2020, the Privacy Amendment Act 2025, and the Biometric Processing Privacy Code 2025.
What we collect and why
We collect as little as possible. Here is exactly what we hold and why.
Email accounts
accounts.email) and a one-way HMAC-SHA256 hash of it (in verified_identifiers). The hash is used solely to prevent duplicate accounts. The raw address is retained for login and, if you opt in, for sending app and civic topic updates.Passport-verified accounts
Didit NZ Passport Verification โ Verified NZ Citizen tier
Optional. This is subject to the NZ Biometric Processing Privacy Code 2025.
Polls and votes
Anyone with a Fair Say account can vote in any poll. There is no gatekeeping based on verification tier. Verification affects only how your responses are displayed in results filters โ it does not affect whether your vote counts.
All votes are anonymous. A per-poll hash is generated using your account identifier, the poll ID, a device salt, and a server-side secret. This hash prevents duplicate votes. It cannot be reversed to identify you, and it changes between polls โ so your votes across different polls cannot be linked to each other.
Each vote is tagged with your account's verification tier at the time of voting: email or verified_nz_citizen. This tag identifies the credential type, not you personally.
Poll results are filterable by tier โ all respondents, email accounts, or Verified NZ Citizens. The filter is a transparency tool, not a weighting system. Every vote counts equally in the overall result. Filtered groups with fewer than 5 responses are suppressed entirely to prevent any possibility of de-anonymising small groups.
Individual responses are never shown. Results are published as aggregates only, and always will be.
What we never do
- โWe never sell personal information.
- โWe never share email addresses or any personal data with political parties, advertisers, or government agencies.
- โWe never use biometric information for any purpose other than confirming NZ citizenship.
- โWe never store passport images, biometric templates, or passport numbers.
- โWe never link verification records to votes or browsing activity.
- โWe never email passport-verified users โ no email is stored for those accounts.
Your rights under the Privacy Act 2020
You have the following rights regarding information Fair Say holds about you:
- Right to access: You can request what data we hold about you. Because we store one-way hashes rather than identifiable information, the data we can provide is limited by design.
- Right to correction: You can request corrections to any personal information we hold.
- Right to deletion: You can delete your account at any time. Deletion removes your hashed email identifier, hashed verification session ID, and account record. Vote records are anonymous and cannot be attributed to you โ they are not deleted, as they form part of the aggregate public results.
- Complaints: If you believe we have breached the Privacy Act 2020, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Third-party processors
Didit
Biometric identity verification. Processes NZ passport scans and liveness checks on Fair Say's behalf. Fair Say receives only a pass/fail result.
Privacy policy โSupabase
Database hosting. Data is stored in AWS ap-southeast-2 (Sydney, Australia).
Privacy policy โResend
Email delivery. Used solely to send login codes and (for opted-in email-tier users) newsletter and update emails. Resend does not receive data about passport-verified accounts.
Privacy policy โBiometric processing
Fair Say is subject to the NZ Biometric Processing Privacy Code 2025 (in force 3 November 2025). In accordance with this Code:
- Biometric processing (passport scan and liveness check) is performed solely by Didit, not by Fair Say.
- The purpose is limited to confirming NZ citizenship for inclusion in the Verified NZ Citizens results filter.
- No biometric information is retained by Fair Say โ only a one-way hash of the Didit session ID.
- A Proportionality Assessment has been completed and is available on request.
- Complaints about biometric processing can be directed to the Privacy Commissioner at privacy.org.nz.
Contact
For privacy questions, access requests, or corrections, contact us at privacy@fair-say.nz.
Fair Say NZ is an independent platform. We are not a government body and cannot access government records on your behalf.