Last updated: August 2026 — your privacy is not a legal clause here; it is the platform’s condition of existence.
The governing principle
Lak Door is a civic participation platform for an audience that may live in sensitive contexts. We therefore commit to data minimisation: we collect only what the principle “one person, one account, one vote” requires — and nothing else.
What we collect, and why
Your name: to show your identity inside the platform (you may post under a pseudonym).
Phone number and email: to verify the account belongs to a real person and for security contact only — never marketing.
National ID number: used once, to guarantee account uniqueness. It is never stored as text: we keep an irreversible cryptographic hash for duplicate checks, and an AES-256-encrypted copy. No employee, moderator or party ever sees it, and we never ask for a photo of the ID.
Your votes, proposals and comments: the participation content itself — the purpose of the platform.
Images you attach to a proposal:metadata is stripped before storage — location coordinates, capture time and device model. A phone photo can carry your position to within metres; whoever uploads a photo of a demolished house may be uploading where they stood and when. So we never store that. We also discard your original file name, because file names carry names of people and places.
Governorate or diaspora country, and year of birth:entirely optional and empty by default, erasable any time from your account page. They serve one question: which governorate, community or age group is missing from the platform. That is why we ask for the governorate, not the town, and the year, not the date of birth — what we do not collect cannot leak and cannot be demanded from us. These fields are never linked to how you voted, never appear on your public profile, and reach administrators only as aggregates after every cell below the declared threshold is suppressed.
What we never do
We do not sell or share your data with any advertiser or data broker — not now, not ever.
We do not hand your data to any faction, party or authority; the platform is fully independent and hosted in Europe under GDPR.
We do not track you outside the platform and use no advertising trackers.
We never show your ID number, phone or email to any other user.
We never compute “how region X voted.” Nothing in the platform crosses your location or age with your opinion — not for administrators, not for researchers, not for us. A map of that kind is not transparency but a targeting tool; the difference is that the first holds power to account and the second endangers people.
Security
All traffic is encrypted (TLS); sessions use short-lived tokens revoked on any suspicion; passwords are hashed with standard algorithms that make them unrecoverable; and every administrative action is written to an immutable audit log.
Your rights
Read and correct your data at any time from your account page.
Delete your account permanently with a single request — your personal data is erased, and your public content remains as “deleted user” or is removed on request.
Post under a pseudonym while your account stays internally verified.
Contact
For any privacy question or request: privacy@lakdoor.ps — we reply within 72 hours at most.
Privacy policy · Lak Door
How long we keep each thing
This table is not a description of the policy — it is the policy itself as the server reads it: the sweeper reads from it and this page renders from it, so neither can contradict the other.
What we do not keep cannot be handed over — not by mistake, not by breach, not by court order. Whatever has served its purpose is deleted on a published deadline; whatever stays, stays with a written reason.
Deleted on a deadline
Verification codes — a week: Every code a week after it was sent — used, expired or burned alike. A code dies in minutes. What outlives it is not a code but a record of when you asked to sign in and through which channel. The week is only the window for "no code reached me".
Expired and revoked sessions — a month: Anything expired or revoked more than thirty days ago — live sessions are never touched. A dead session row protects nobody, and it carries when you signed in, from how many devices, how often you rotated. A month is enough to investigate a stolen session after it surfaces.
Used recovery codes — 3 months: Used ones only — unused codes are live keys and stay until regenerated. A spent code opens nothing afterwards, and keeping it only records when you lost your phone.
Notification inbox — 6 months: Every notification after six months — read or unread. The inbox is the sharpest timeline of a person’s civic life: what they followed, which circle concerns them, when they moved. After six months it no longer serves its owner — only someone profiling them.
Audit log: the sign-in trail only — a year: Sign-in, session and code events only (a published list of 20) — staff, moderation and decision events are kept forever. Accountability needs a record of who decides, not of who signs in. Each sweep is itself written into the surviving log, so deletion is declared rather than silent — and no code path can delete one row, or one person’s trail.
Raised hands by region — 6 months: A raised hand and its region after six months — and immediately when the region’s circle opens. This table **does carry its owner’s id**, and it cannot be otherwise: a raised hand is a promise to notify you when your region’s circle opens, and a promise that does not know whom it belongs to cannot be kept. So the protection is temporal, not structural: the purpose is served and the hand is deleted at that instant, and if it is not served within six months, a record of interest with no purpose left is not kept.
Decided join requests — 6 months: Anything accepted or rejected more than six months ago — pending requests await their decision untouched. An accepted request becomes a membership that supersedes it; a rejected one is a record that someone wanted into a field circle, kept for no purpose — the raised-hand logic again: organizing intent is not stored longer than it must be.
Evidence of decided challenges — 3 months: Task photos and reports ninety days after their assignment was decided — evidence still under review is never touched. A field-action photo served its purpose the day its points were granted or refused. Keeping it afterwards is the most dangerous thing in this database: an archive of who did what, where — and what we do not keep cannot be handed over.
The sweep runs automatically every 24 hours.
Kept — and why
Social sign-in identities: It is your login key itself: the provider and your ID there, nothing more — no access token is stored. Wiped with the account in the same deletion transaction.
Your vision-question ranking: A preference that is yours alone, entering the national tally with no region and no link to any vote. Updating replaces the previous order rather than stacking history, and it is wiped with the account in the same deletion transaction.
Your voluntary electoral-track pledge: A voluntary pledge separate from the civic surface and from any vote. There is no name list, and it is wiped with the account in the same deletion transaction.
Published electoral-track copy: A title and slogan filled by staff from the dashboard. It is not a ballot ledger or analytics, and it holds no joiner’s name.
The account: Deletion is the owner’s alone — immediate, and covering everything that identifies them.
Your declared skills: You wrote them so you would be called on for them; they vanish with your account.
Referendums: A public question put to people; deleting it hides what they were asked.
Ballot options: Without the options a result is meaningless, and an old archive unreadable.
Votes: Deleting them deletes the result itself. They are separated from their casters by construction, not by promise.
Receipt fingerprints: It reveals neither the voter nor their choice, and it is the only way a voter proves their vote was counted in.
The sealed results ledger: A chain that breaks when a link is removed — which is exactly the point: tampering must be visible.
Arguments: People’s public words — we delete no opinion said in the open; only its author withdraws it.
Argument endorsements: It is the argument’s own counter, and it is shown only as a bare number, never as names.
Proposals: A tracking number promises that what you filed will not vanish — and a promise with an expiry date is not one.
Comments: People’s public words — debate that evaporates after months is not public debate but chat.
Stances on proposals: A stance you declared, and the substance of the counters shown on every proposal.
What you follow: A preference in your hands, revocable at any moment, gone with your account.
Reports and their rulings: A moderation ruling with no record becomes arbitrary power. Reports are never shown outside moderation.
Official replies: A reply that can disappear is not a commitment but a courtesy.
If you delete your account
What is yours alone disappears with your account at that instant. What others took part in stays, without your name and attributed to “a deleted user” — because erasing it rewrites a public record other people are part of.
And what stays — and why:
Your stances on proposals: The counter shown on every proposal is built from them; withdrawing them changes a number people already read and cited. Your name was never on it.
Your signatures on demands: A demand you signed alongside others; pulling the signature after the count was published weakens other people’s demand, not only yours. The signer list is shown to nobody, ever.
Your circle memberships: Quorum and session minutes rest on it, and deleting it rewrites decisions already taken. Leaving a circle is in your hands at any time and erases it at once.
Your coordinator offer and its ruling: “How did this person become coordinator” is a fair question for their circle, and half a record does not answer it.
Your attendance confirmations: The quorum of a session already held does not change retroactively; minutes that say “seven attended” and become six a month later are minutes no one can rely on.
Your argument endorsements: The argument’s counter, shown only as a bare number.
Your receipt fingerprints: A hash that reveals no choice, and the proof sheet behind sealed results: deleting it breaks a proof that belongs to everyone who took part in those referendums, not to you alone.
Unified demands: A demand people signed; deleting it cancels their signatures without their leave.
Demand signatures: A demand’s force is its count, and a count with no record behind it is a claim.
Demand sources: It attributes the demand to those who first drafted it; without it the demand has no parent.
Tracked commitments: All accountability lives here: a commitment that can lapse with time is not a commitment.
Commitment events: The timeline is what prevents the past from being rewritten after the fact.
Circles: A public structure people know and join, whose archive explains its decisions.
Memberships: Whoever coordinates a circle is known as such inside it; leaving erases the membership at once.
Coordinator offers: How someone became a coordinator is a fair question for the members of their circle.
Circle recommendations: The output of collective work — some of it becomes a national referendum whose origin is cited.
Sessions: A meeting with no lasting minutes never happened, as far as those absent are concerned.
Attendance confirmations: Quorum and minutes rest on it, and without quorum there is no decision.
Issues: The frame everything else is read under — and a battle won is read years later.
Issue-to-referendum links: Without the link an issue is a headline with nothing showing that anyone ever voted on it.
Open tasks: Work people volunteered for; its disappearance erases their contribution from the record.
Task contributions: Attribution of work to its author — all a volunteer gets back for their time.
Broadcast announcements: The 48-hour ceiling without a record is a promise with no proof. This is the platform’s most dangerous feature: it interrupts everyone at once.
Attachments: It dies with its proposal. Its metadata (location, device, time) is never stored at all — stripped before the file touches disk.
Circle ballots: A circle’s decision about itself, which its members cite in everything that follows.
Circle ballot votes: A secret box and a public result. A circle is a small group whose members know one another and where some lead others, so an exposed internal vote lands harder, not softer — which is why it is held to exactly the national referendum’s standard.
Stories: Published by explicit consent and withdrawn by its author’s right alone, at any time — and withdrawal kills every citation of it.
Local circles: A collective working structure, not a personal file — it stays while it lives; archiving it is its coordinators’ call.
Circle memberships: Leaving the circle is the member’s act and erases it at once; deleting the account erases it with the whole organizing record in the same instant — an organizing membership never outlives its owner.
Published challenges: A task published to circles at large, carrying no one’s personal data — and its awarded points rest on it.
Your challenge assignments: The record of what you took on and how it was decided — it disappears entirely with your account, and its evidence is swept earlier on its own deadline.
Challenge reviews: “Why were these points granted” is a fair question answered by the reviewer’s ruling — it dies with the assignment it belongs to.
Events: A public announcement like a challenge — the personal part is its registration list, which has its own separate ruling.
Your event registrations: Field-event attendance is a movement map — it disappears with the account, entirely and instantly, and the attendance mark goes with it.
Attendance marks: The mark is an attribute of the registration, not a record of its own — deleting the registration cascades it away.
The levels ladder: Level names and thresholds — no personal data at all.
Badge definitions: A badge is a public definition; earning it is the personal part, with its own line.
Your badges: Earned by and belonging to its owner alone — gone with the account at that instant.
Your points ledger: The timeline of your organizing activity — after evidence, the data most telling about you; it disappears entirely with the account.
Your volunteer application: Your domains, your acknowledgement, the ruling on you — a purely personal file, gone with the account at that instant.
Circle announcements: Words addressed to the circle and read by it — kept as “a deleted user” if the author leaves, and gone with the circle if it closes.
Training material: Lessons for everyone, carrying no personal data.
Your support tickets: Your question and your problem in your own words — yours alone, gone with your account at that instant.