A security vulnerability
Report it before publishing it, and give us a way to reply. We will acknowledge first and investigate second, and credit you if you want that.
Write to hello@democrez.com with subject “SECURITY REPORT” · disclosure policy
Harm, attack, and honest limits
Trust and safety.
Three separate questions sit under this heading: what a situation is allowed to ask, whether an answer can be traced back to a person, and whether an aggregate can be pushed by somebody determined to push it. This page answers all three, including the places where the honest answer is that no website can settle it for you.
The content line
What a situation
is not allowed to ask.
A card has to be difficult without being harmful, and the two are easy to confuse. Difficulty comes from every option costing somebody something. Harm comes from asking a person to occupy a place they should not have to occupy in order to answer.
| Excluded | Why |
|---|---|
| Politics and religion | Answers become declarations of identity rather than accounts of what somebody would do, and the platform would be read as taking a side regardless of the wording |
| Self-harm and crisis | A situation of this kind cannot be answered in a minute on a phone without cost to somebody currently in it. There is no version we would run |
| Real, identifiable people | A card about an actual person makes the platform a place to judge them, which is not what it measures |
| Anything where honesty is shameful | If the truthful answer would embarrass, people give the acceptable one — and the aggregate records that instead |
| Anything with a legal answer | The law has already decided, so the card measures whether somebody knows the law |
| Groups as a subject | A situation whose difficulty comes from who somebody is, rather than what they are choosing, collects prejudice rather than judgment |
Who applies this test, and what happens to the cards that fail it. The Human Seal
When review is not enough
A card can still land badly.
Review catches most of it and will not catch all of it. A situation about family obligation is ordinary for most people and lands on somebody's actual week for a few. That is not a failure of the test; it is a limit of it.
You can skip any situation
Nothing requires you to answer a particular card, and skipping costs nothing — there is no streak to break and no completion figure being kept.
Nothing follows you
No interpretation of your answer, no follow-up prompt, and no notice that you avoided something. A skipped card leaves no trace about you.
Tell us about the card
If a situation should not be in the deck, we would rather hear it than not. Write to us and say which card and why. Contact
What we cannot do
Withdraw a reading that has already been published. The record is append-only, so a card can be retired from circulation while its existing reading stays.
Security
Anonymity is built,
not promised.
The strongest thing that can be said about a piece of data is that it was never recorded. Most of what follows is that claim rather than a claim about how well something is protected.
Structural
The link does not exist
A phone verification confirms a distinct person and is separated from the response at the point of collection. No record connects a person to an answer, so there is no lookup to secure, no export to restrict, and nothing to hand over under pressure.
Ordinary
The rest is normal practice
Encryption in transit, access limited to people who need it, and the usual operational care. This is table stakes rather than a differentiator, and a website claiming more than this in confident language is usually claiming it instead of doing the first part.
What we will not claim
That the platform is unbreachable. Nobody can say that, and a page saying it is telling you something about its authors rather than about its systems. What can be said is narrower and more useful: the most sensitive thing — who answered what — is not in the system to be taken.
Retention policy: Raw identity-verification documents, if collected, are deleted within 30 days after successful verification. Only the verification result and necessary audit/security logs may be retained for up to 1 year, or longer where law requires. See privacy policy.
Attack
Can somebody push
an aggregate?
This is the question a sceptical reader should ask, and the answer is partly reassuring and partly not.
One person cannot
Verification means a single participant answers once. Repeating requires repeating the verification, which is the whole reason the step exists.
A small group cannot
A card only publishes after enough verified responses. A handful of coordinated answers cannot reach that threshold, and below it nothing is shown at all.
A large group is harder to stop
Enough real, verified people answering deliberately would move a figure, because they are real people answering. No platform of this kind is immune to that, and claiming otherwise would be dishonest.
But it would be visible
Readings are appended with their response counts and timing, and nothing is edited afterwards. A sudden coordinated push leaves a shape in the record rather than disappearing into a recalculated average.
Why append-only matters here
A system that recalculates in place would absorb an attack invisibly — the figure would simply be different afterwards, with nothing showing that it had moved. Because entries are added and never edited, an unusual pattern stays legible to anybody reading the record later. The Reality Bank
Telling us
Three ways to report
something.
A situation that should not exist
Tell us which card and why. A card can be retired from circulation, though a reading already published stays in the record.
Write to hello@democrez.com with subject “URGENT SAFETY”
A formal grievance
A complaint about data handling or about a breach of our stated obligations. This goes to a named person rather than a shared inbox, as Indian law requires.
Grievance Officer Gourav Sharma, Director, Nayaha India Techno Private Limited (hello@democrez.com; subject “GRIEVANCE”; registered office: 3, Clerk Colony, Opp. Readymade Complex, Nanda Nagar, Indore, MP – 452011) · the process
A report about a card is worth more than a complaint about the platform. Review catches most problems before release; the ones it misses are found by the person the card landed on.
Questions
Straight answers.
Could a court or an employer obtain my answers?
There is nothing to obtain. No record links a person to an answer, so a demand for one would be a demand for something that was never created. This is a stronger position than a policy of refusing such requests, because it does not depend on us refusing.
What happens if there is a breach?
What could be exposed is the verification layer and operational data, not a mapping between people and answers, because that mapping does not exist. We would say what happened rather than describe it in the softened language these notices usually use, and the obligations under Indian law apply regardless of what we would prefer.
Can a group of people deliberately shift a result?
Enough real verified people answering deliberately would move a figure — they are real people answering, and no platform of this kind is immune. What the design does is make it visible: readings are appended with counts and timing and are never edited, so an unusual pattern stays legible instead of being absorbed into a recalculated average.
Why are politics and religion excluded?
Because answers there become declarations of identity rather than accounts of what somebody would do, and because a platform measuring them would be read as taking a side however carefully the cards were written. Excluding is more honest than attempting balance.
What if a situation is genuinely upsetting?
Skip it. Nothing requires you to answer a particular card, skipping costs nothing, and no record is kept that you avoided it. If you think the card should not be in the deck, tell us which one and why — review catches most of these before release, and the rest are found this way.
Can a card be removed after it has been published?
A card can be retired from circulation so that nobody else is shown it. A reading already published stays, because the record is append-only and a record you can delete from is not evidence of anything.
Do you moderate what people answer?
There is nothing to moderate. Participants choose between written options rather than submitting text, so no free-form content enters the platform from users at all.
What happened to the separate security page?
It is this page. Keeping them apart meant a reader had to visit two pages to learn that the important security claim is a content decision — that the sensitive link is never recorded — so they were merged.
Tell us what we have missed.
A card that should not be in the deck, or a hole in something on this page.