Privacy Policyfor the voting service

ZenAwards (“we”, “us”) operates zenawards.com and the voting service described in the Terms of Use. This policy is part of that agreement. If this policy and the Terms conflict on a privacy point, this policy controls.

We are the operator of the Service. We have not published a company registration number, a postal address, or a data-protection officer on this page. Privacy requests go to the contact at the end of this policy.

This policy covers personal information we process when you browse the Service, create or use an account, vote, claim coins, complete an ad task, or write to us. It covers visitors and signed-in users.

It does not cover a site you open from an advertisement, a Google account page, or any other service that has its own policy. When you leave zenawards.com, that destination’s policy applies.

Poll pages, standings, and nominee names are published for the public. They are not a record of who voted.

We collect the following categories. We do not buy marketing lists, and we do not ask you to connect a social network in order to vote.

A new account starts with 30 coins. The display name is the name from Google, the username you chose, or the part of the email before the @ sign, depending on how the account was created. The avatar on a new account is a shared default image, not a photograph of you. We do not copy a Google profile photo into our database.

When you register or sign in with a password, our server passes that password to Google Firebase so the credential can be created or checked. The password is not written into our database. We will not ask you to send a password by email.

A magic link, a verification message, and a password reset are sent to the email on the account. If you ask for a reset with a username, we look up the email on that username and send the message there. If no account matches, we still show the same confirmation, so the form does not reveal whether an address is registered.

The IP address and country code are stored on the account when it is created. We do not add a new location record each time you vote. Country is a code supplied by our host, such as a Cloudflare or hosting header, not a GPS position. The time zone is the one your browser reports, and we use it to record the account’s creation time.

Sign-in, username checks, and reward claims are rate-limited. Those limits use the request IP for a short window. That short-lived limit is not added to your profile as a location history.

A vote spends coins and increases the nominee’s total. One coin equals one vote. The published total for a nominee is an aggregate number. The vote record stores the poll, the nominee, and the count. It does not store your name, email, or account id next to that nominee.

Your account stores how many votes you have cast in total and how many you have cast on the current UTC day. It does not store a list of which nominees you chose. That daily count is what opens check-in, vote goals, and ad tasks.

Reward records on the account are the claims themselves: a streak date, a milestone id, a daily goal for that UTC day, and an ad-task id with the time it was claimed. We do not pay coins for following a social account, and we do not collect your profiles on other platforms for that purpose.

Before a vote finishes sending, the browser may keep a temporary copy of that poll and of votes that have not yet reached the server. That copy is there so the page can retry. It is not a second official total, and it is not published.

Manager accounts may cast votes without spending coins and do not receive coin rewards. The role is stored on the account. It is assigned by us.

The Service uses local storage and session storage on your device. We do not use these keys for advertising profiles.

• Sign-in cache. After you sign in, the header stores your account id, email, and display name so the menu can render. Signing out removes it.
• Stay signed in. If you choose to stay signed in, Firebase keeps the session in browser storage that survives a restart. If you do not, the session ends when the browser session ends. A separate key remembers that choice. It does not contain your password.
• Magic-link address. If you request an email link, the browser stores that address until the link is confirmed, so the same device can finish sign-in.
• Poll cache and unsent votes. A poll page may store the poll you opened and votes that are still waiting to sync.
• Ad-task progress. The Get coins page stores how many visits you have counted today, so a refresh does not reset an unfinished task. The key is the UTC day and the counts. Coins are added only after the server accepts the claim.
• Popunder flag. On pages where a popunder is allowed, session storage records that it has already run in that browser session.

You can clear these in your browser. Clearing them signs you out of the cached header, drops unsent votes that never reached the server, and resets unfinished ad-task progress on that device.

We use personal information to:

• create and authenticate your account, including Google sign-in, email and password, username and password, and one-time email links;
• keep your coin balance, apply votes, and show the balance in the header;
• run check-in, daily vote goals, milestones, and ad tasks, and reject a claim that does not meet the published rule;
• publish aggregate standings and operate polls a manager creates;
• detect extra accounts, automation, and other abuse, using the account, the creation IP, and rate limits;
• send the transactional messages you trigger: verification, magic link, and password reset;
• answer a message you send to our contact address;
• measure which poll pages are visited, using Google Analytics on those pages only;
• keep the Service secure, fix failures, and meet a legal request that is valid where we operate.

We do not use your account email for a newsletter or for other promotional mail. We do not sell personal information for money. We do not build a public profile of your votes.

Where a privacy law requires a legal basis, we rely on the following.

• Contract. Account data, coins, votes, and rewards are processed to provide the Service you asked for under the Terms.
• Legitimate interests. Security, rate limits, aggregate standings, and a basic measurement of poll pages. These interests are running a fair tally and understanding which polls are used. They do not override rights that the law says we must honor.
• Consent. Google sign-in is your choice. Where your law requires consent before analytics or advertising cookies, use the controls in the cookies section. We do not show a separate cookie banner.
• Legal obligation. We process information when a law that applies to us requires us to keep or disclose it.

Mandatory consumer and privacy rights in your country still apply, including rights that cannot be waived in the Terms.

ZenAwards does not set its own advertising cookie. The tools below can set cookies or similar identifiers.

• Google Analytics. Individual poll pages load Google Analytics (measurement id G-GQTGX6D2TP). It can set cookies such as _ga and receive the page address, general device and browser data, and approximate location derived from the IP. It is not loaded on every page of the Service. We use it to see which polls are visited. We do not combine it with your vote total to build a voter profile.
• Display ads. Marked placements load a third-party advertising network inside the page. On a desktop that unit is a wide banner. On a phone it is a rectangle. The network can set cookies and read device data to deliver and measure the ad.
• Popunder. On browsing pages, and not on the vote control, a sign-in page, Get coins, Rewards, or a legal page, one popunder may run per browser session. The script comes from the same advertising network.
• Ad tasks. When you choose Open ad on Get coins, a new tab opens on the advertising network. That site, and any advertiser it sends you to, collects data under its own policy. We count the visit only to decide whether the task rule was met. We do not receive a copy of what you do on the advertiser’s page.
• Firebase. Sign-in uses browser storage more than a tracking cookie. Google’s own domains may set cookies as part of Authentication.

You can block or delete cookies in your browser, and you can use an extension that blocks third-party scripts. Blocking them can stop ads from loading, which also stops ad tasks from completing. It does not stop a signed-in vote.

We do not sell personal information. The advertising network may use identifiers from an ad placement for its own advertising, which some laws treat as sharing for cross-context advertising. We do not offer a separate “do not sell” switch on this site. To limit that use, block the ad scripts or use the network’s own industry opt-out where it provides one.

We use companies to run the Service. They process information on our instructions, or, for ads and analytics, under their own policies as well.

• Google Firebase Authentication. Accounts, passwords, Google sign-in, email-link sign-in, verification links, and password-reset links.
• Google Analytics. Measurement on poll pages, as described above.
• MongoDB. Hosts the database of accounts, polls, and aggregate vote totals.
• Bunny.net. Stores and delivers images, including the logo, nominee images, and files uploaded for a poll. Uploads are sent to Bunny storage.
• Resend. Delivers verification, magic-link, and password-reset email from our sending address.
• Hosting. The website and the API are hosted by infrastructure providers. They may process IP addresses and request logs to deliver traffic and protect their networks. A host may supply the country code we store at sign-up.
• Advertising network. Serves display placements, the session popunder, and the pages opened from an ad task.

Messages you send to support@zenfied.com or contact@zenfied.com are kept so the operator can reply. Support handles accounts, votes, and privacy requests. Contact handles partnerships and copyright notices.

We share personal information only in these cases:

• with the providers in the previous section, for the purpose named there;
• with an advertising or analytics partner, to the extent their script collects data directly from your browser when a placement or a poll page loads;
• if we believe disclosure is required by law, legal process, or a government request that applies to us;
• to investigate abuse, protect the tally, or protect users, including when we reverse votes or close an account;
• as part of a merger, sale, or reorganization of the Service, in which case this policy still describes the processing unless a new policy is posted.

We do not give voter lists to artists, agencies, or fans. We do not rent email addresses.

Anyone can view an open poll, its nominees, and the aggregate totals. Leaderboards use those same totals. Your username, email, and coin balance are not part of that public tally.

A manager who publishes a poll makes the poll title, nominee names, and images public on the Service. Do not submit a private person’s contact details or a photograph you do not have the right to publish. Artist names and images used to identify nominees are there so fans can recognize the poll. They are not an endorsement, as the Disclaimer explains.

We operate an online service for visitors in more than one country. Our providers process information in the United States and in other countries where they run their systems. Image storage is sent to Bunny’s storage region that we use for uploads. Your information can be processed outside the country where you live, including in countries that have different privacy laws.

Where the law requires a transfer tool, we rely on the provider’s applicable contractual terms. We do not claim a specific government adequacy decision on this page.

We keep account information for as long as the account is open. That includes the email, username, display name, coin balance, vote counts, reward claims, creation IP, country code, and time zone.

If you ask us to delete the account, we delete that profile and ask Firebase to delete the matching authentication record. Coins on the account are forfeited because they have no cash value. Aggregate nominee totals stay in the tally. They cannot be traced back to you from the vote record, because that record never stored your identity.

Transactional email is handled by Resend and by our contact mailbox. We do not keep a separate marketing archive. Browser keys remain on your device until you clear them or, for the popunder flag, until that browser session ends. A rate-limit entry expires on its own and is not kept as part of your account.

We may keep a limited record of a deletion request, including the email used to make it, for as long as we need it to show that we handled the request or to defend a claim. Hosting providers may keep their own connection logs under their policies. We do not operate a separate long-term location history.

The public site is served over HTTPS. Authentication credentials are held by Firebase. Account and tally records are stored in our database. Access to the production systems is limited to the people who operate the Service.

No service can promise that storage or transmission will be free of incidents. If we learn of a breach that the law requires us to announce, we will notify the people the law tells us to notify.

You are responsible for the password and for the devices that stay signed in. Sign out on a device you do not control. Use a password you do not reuse on other sites.

The Service is not directed to children under 13. You must be at least 13, and you must meet any higher age your local law requires before you can open an account. We do not knowingly collect personal information from a child under 13.

If you believe a child under 13 has an account, email us the account address. We will delete the account if we can confirm that it belongs to a child under 13. Votes already folded into an aggregate total remain in that total.

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy of the account data, to object to or restrict certain processing, and to withdraw a consent you have given. You may also have the right to complain to a privacy regulator in your country. You will not be discriminated against for exercising a privacy right.

You can use many of these yourself. The header shows the email and display name on the account. You can sign out, stop using the Service, and clear browser storage. You can block analytics and ads in the browser. You can ask Google to remove access from your Google account if you used Google sign-in.

To exercise a right with us, email the contact below from the address on the account, or tell us the username. We may ask for enough information to confirm that you control the account before we release or change data. We will not create a nominee-by-nominee history in order to answer an access request, because we do not keep one. We may decline a request that would reveal another person’s information, that we cannot verify, or that the law allows us to refuse. We aim to respond within 30 days, or sooner if your law requires it.

California residents: we do not sell personal information for money, and we do not offer a financial incentive tied to a sale. Advertising partners may collect identifiers on pages where their scripts run, as described in the cookies section. We do not disclose sensitive personal information in order to infer characteristics about you.

Email us and ask for account deletion. Include the account email and, if you use one, the username. We will confirm that the request comes from the account holder before we delete it.

Deletion removes the profile described in the retention section and the Firebase authentication record. It does not unwind aggregate votes, and it does not delete a message you already sent to our inbox if we still need that message to document the request. Clear the browser on your devices so the sign-in cache and any unsent votes are removed there as well.

Closing the browser is not deletion. Coins are not paid out when an account is deleted.

We may update this policy. The effective date at the top will change when we do. If a change is material, we will post the new policy on this page before it applies. Continuing to use the Service after that date means you accept the update. The Terms explain how to stop using the Service if you do not accept a change.

Privacy requests, deletion, and questions about this policy go to:

support@zenfied.com

Include your account email. We aim to reply within two business days, and to complete a verified deletion or access request within 30 days.