Privacy notice

About members of your district: name, email address, club, member number, and the role that decides their vote. A phone number only if they give one for text reminders.

About guests a district invites to watch a meeting: name and email address. These people are not on the district’s roster and are not members of it — there is a section about them below.

About people who sign in: email address and sign-in history.

For security: the IP address a voting link is opened from, so we can spot a link being shared or attacked.

We do not use tracking cookies or advertising trackers.

When your meeting chooses an anonymous ballot, the vote is stored without any link back to the person who cast it. We have deliberately built it so that we cannot reconstruct that link either.

When your meeting chooses a recorded vote, the ballot names the voter — because that is what your meeting decided it should do.

A district can invite someone who is not on its roster — a visiting officer, a former member, someone from the press — to watch one of its meetings. To send that invitation we hold the name and email address the district gave us, which meeting it was for, when it was sent and how many times, and what our mail provider told us happened to it: delivered, failed, or not attempted. Nothing else. A guest is not added to the district’s roster, cannot vote, and counts towards nothing that the meeting decides.

If an invitation bounces, or a guest reports it as spam, we add that address to that district’s do-not-mail list so it cannot be written to from Red Vote again. The list belongs to the one district that mailed you; it says nothing to any other district on Red Vote.

How long. We hold it for as long as the district does. If the district asks us to remove a guest, we do it then; there is no other point at which it goes on its own. When a district closes its account we delete its data, guest invitations included, thirty days later.

To be removed, reply to the invitation. It goes to the district that invited you, not to us, and the district’s owner can then erase you: your name, your address and the provider’s reason for any failed delivery are cleared, the do-not-mail entry for your address is removed with them, and the link stops working. You can also ask us at vote@taverns.red. Two things worth knowing: simply cancelling a link does not by itself remove your name and address — the removal above is what does — and, as with a member, the meeting’s audit trail keeps a note that a removal took place, never what was removed.

Our mail provider has its own copy. The invitation is sent through Resend, so Resend is given your address and the message itself, and keeps its own record of both under its own privacy policy. Being erased here does not reach Resend’s copy: Resend offers its customers no way to delete a single message once it has been sent. Resend lists a 30-day retention for the messages and delivery logs its customers can search, and the only deletion it commits to in its data processing terms is within 90 days of a customer closing its account. The one thing a removal deliberately keeps is the provider’s reference for each message — it identifies no one on its own, and it is how a message is found in Resend’s records.

A district can publish a page for a meeting where a member can ask for their registration link again. You type your Toastmasters member number and last name. If they match someone on that meeting’s list, we re-send the link they already have — their registration link, or their guest link if the district added them as a guest — to the email address the district already holds for them. We do not create a new link, and you never type or see an address. The page gives the same answer whether or not anything matched. Attempts are limited per network address, and the number of emails any one person or meeting can be sent is capped. We log each attempt with the member number in hashed form, never the number itself, the name typed or an address, and the meeting’s audit trail notes that a link was re-sent and nothing more.

We hold it to run the service your district asked us to run. Your district decides what goes in; we process it on your instructions.

We use a small number of suppliers to run Red Vote: Supabase (database), Google Cloud (servers), Paddle (payments), Resend (email), Twilio (text messages), Upstash (rate limiting), Sentry (error reports), and OpenAI and DeepL for the optional document-assistant and translation features.

We do not sell your data, and we never share it with advertisers.

Your district’s data is stored in a database in Canada. The application that reads it runs on servers in the United States, so data is processed there in the course of serving your pages, and some suppliers above operate outside Canada.

While your district is active, we keep it. When a district closes, we delete its data thirty days later.

One thing survives on purpose: for each certified meeting we keep a record that the meeting happened, when it was certified, who signed it, and a cryptographic fingerprint of its audit trail. That record contains no member names, no contact details and no votes. It exists so anyone holding an exported audit bundle can still prove it has not been altered.

Ask us at vote@taverns.red and we will tell you what we hold about you, correct it, or remove it. Your district’s administrators can also remove a member’s details directly.

When we remove someone, we clear their name, email, phone number and any contact details we copied elsewhere. One thing we cannot remove is the audit trail of the meetings themselves. It is built to be tamper-evident, which means entries cannot be altered or deleted without destroying the proof that the results are genuine. So the trail keeps a note that a removal took place and which fields were cleared — but not the name, the address or anything else that was cleared.

Write to us first at vote@taverns.red. If we cannot sort it out, you can complain to the Office of the Privacy Commissioner of Canada, or to your province’s privacy regulator.