Privacy Policy

IMHO (“In My Human Opinion”, accessible at imho.to) is a global platform for answering important human questions, comparing perspectives across countries and demographic groups, and discovering how people think.

IMHO is operated by IMHO SYSTEMS, a business registered in British Columbia, Canada, which acts as the data controller for personal information processed through the platform. Our Privacy Officer is accountable for how we handle it. For any questions or requests about your personal data, you can reach the Privacy Officer at support@imho.to.

We collect only the information needed to run the platform, keep participation human, and compute demographic comparisons and worldview matches:

Waitlist (“Founding Voices”)

When you join the waitlist on our landing page, we collect your email address, your chosen country, and—if you choose to suggest one—a question of up to 100 characters, along with the date you joined and whether an invitation has been sent or accepted. Your email is used strictly to send your invitation and essential account notices; we will not send you newsletters or promotional emails unless you separately sign up for them.

Sign-in (OAuth 2.0)

You sign in to IMHO using a Google account or a personal Microsoft account. When you authenticate, the identity provider shares your email address and the display name on your account. We never receive or store your password. With your account we also keep when it was created, when you were last active, and its standing (for example, whether it is suspended).

Profile and demographic attributes

• Required registration attributes — A unique public handle, year of birth (you must be at least 18), country, employment status, work sector (when employed or self-employed), gender, and highest completed education level, together with the version of our terms you accepted.
• Optional profile fields — Your display name (which you may edit or clear at any time to appear as “Anonymous”), job title or profession, city, a short bio, “secret info” (shared only with mutual followers), and a portrait photo.
• Image metadata — When you upload a portrait photo or an image for an opinion, we re-encode it on our servers and remove its hidden metadata, such as location data, camera identifiers, and editing history, before we store it.

Answers, opinions, and engagement

We store your structured answers to questions (chosen side and conviction strength from 1 to 100%), written opinions (drafts and published headlines, bodies, and inline images), reactions (agree or disagree on published opinions), saved (bookmarked) and recommended opinions, follow and mute relationships, in-app notifications, and moderation reports.

Optional human verification (ZKPassport)

If you choose to earn the “Verified human” seal on your profile, the ZKPassport app generates a cryptographic zero-knowledge proof on your device confirming four facts: you are 18 or older, you were born in the year on your profile, your nationality matches the country on your profile, and your face matches your passport photo. IMHO receives and stores only a domain-scoped, salted cryptographic identifier of the passport (so one passport cannot verify multiple accounts), the confirmed birth year and country (which are then locked on your profile), and the verification timestamp. The identifier cannot be turned back into your passport number, but it is still personal data: we use it only to stop one passport from verifying more than one account.

Cookies

IMHO itself sets only cookies that are strictly necessary to provide the platform, such as the one that keeps you signed in, so it does not show a cookie banner. We do not use analytics, advertising, or tracking cookies. Our Cookies page lists each cookie, what it does, and how long it lasts.

Analytics and security logs

• Visitor analytics — We measure page views, the referring site, the campaign tags in the link you followed, country and region (derived from your IP address), browser and device type, and errors and failed requests in your browser. Our analytics work without cookies or any other storage on your device: each visit gets a temporary identifier that exists only in the open browser tab, and events carry no identifier that outlasts the visit, so analytics data does not link your visits together. Events record whether the page was viewed anonymously, during registration, or by a member, but not which member.
• Anti-abuse and server logs — To keep IMHO secure, we process your IP address, browser user agent, request headers, and the timing of your requests to apply rate limits and detect automated traffic. IP addresses may appear in security logs kept for 1 month. Some forms, such as joining the waitlist and registering, run a Cloudflare Turnstile security check in your browser; when you submit one, we pass its token and your IP address to Cloudflare to verify it.

We use your information to operate and secure the platform and to notify you when others engage with your published opinions. We use your answers, with your consent, in four distinct ways:

• Aggregate results — Your answers count toward each question's results, overall and broken down by country and demographic group.
• Your worldview profile — We summarize your answers by topic for your own profile and personalized insights.
• Compatibility — We compare your answers with other members' answers. Other members can see how compatible their views are with yours, and the topics where you broadly agree or differ, but not your individual answers.
• Publication, only by your choice — Your position on a question is shown to others only if you publish an opinion on it.

• Email address — Never displayed to other users. Used only to match your OAuth sign-in and send waitlist invitations or essential account notices.
• Gender and education — Always hidden from your profile. They are never shown on your profile or match cards and are used only in aggregate results and comparisons, which do not name you.
• Year of birth — Private by default. Comparisons use derived age bands rather than exact birth details. If you turn on “Show age” in your profile settings, your approximate age is shown on your profile.
• Profile visibility controls — By default, your geographic presence (country and optional city) is shown on your profile, while your age and professional background (employment status, sector, and title) are hidden until you opt in from your profile settings.
• Secret info — Any text you enter in the “Secret info” field on your profile is revealed only to mutual followers—members you follow who also follow you back. Its visibility is restricted, but like the rest of your profile it is not hidden from IMHO.
• Platform access modes (Closed vs. Open) — While IMHO operates in Closed (invite-only) mode, questions, opinions, profiles, and demographic breakdowns are visible only to signed-in members, and search engines are instructed not to index them. When IMHO operates in Open mode, questions, published opinions, aggregate demographic breakdowns, and a limited profile teaser at your handle's URL (display name, portrait photo, opted-in demographic badges, and public opinion count) are readable by anonymous visitors and search engines; full profiles, compatibility matches, and personalized insights always require sign-in. In both modes, profile photos and published opinion images are served at links that do not require sign-in, so anyone with an image's link can open it, whereas images in unpublished drafts are shown only to their author.

Legal bases

Where the law asks us to name a legal basis for using your data, we rely on:

• Our agreement with you — To run your account and the platform as the Terms of Service describe: sign-in, your profile, publishing your opinions, follows, reactions, and notifications.
• Your explicit consent — For processing answers and opinions that may reveal your political, religious, or philosophical views, given separately from accepting our terms when you complete registration, and for optional passport verification, given when you start it.
• Our legitimate interests — To keep IMHO secure and human (rate limits, bot checks, Turnstile, security logs), to measure and improve the platform with cookieless analytics, and to manage the waitlist you asked to join.
• Legal obligations — Where we must keep or disclose information to comply with the law.

We never sell your personal data, and we do not share it with advertisers or data brokers. We share it only with the service providers that help us run IMHO, and only what each of them needs:

• Hosting — Amazon Web Services (AWS), for our servers, database, file storage, content delivery, email delivery, monitoring, and analytics.
• Sign-in — Google or Microsoft, when you choose to sign in with an account you hold with them.
• Security checks — Cloudflare, which runs the Turnstile check that tells people from bots.
• Verification — ZKPassport, when you choose to verify as a human, through its app under its own terms and privacy policy. Our server sends ZKPassport only the cryptographic proof and what it should confirm, never your passport data.
• Fonts, scripts, flags, and maps — The public content hosts your browser loads them from, which receive your IP address with each request.

Our Service Providers page names each provider and what it does.

IMHO is operated from British Columbia, and our servers, database, and file storage are hosted by AWS in Canada (Montreal, Quebec), so your information is stored in Canada. Some of the providers above, such as Google, Microsoft, and Cloudflare, process data in the United States and other countries, and AWS delivers pages and images through data centres around the world. While your information is outside Canada, it is subject to the laws of the country where it is, and its courts, law enforcement, and national security authorities may be able to access it. The European Union and the United Kingdom recognize Canada as protecting personal data adequately, so data from those places can come to Canada on that basis. Transfers to providers in other countries are protected by their data processing terms, including the European Commission's Standard Contractual Clauses, or by the provider's certification under the EU–U.S. Data Privacy Framework; you can ask us for details of these safeguards. We may also disclose information if strictly required by applicable law or valid legal process.

We keep personal data only for as long as needed for the purposes described in this policy, and we regularly delete records once their time is up:

• Waitlist entries — Waitlist sign-ups (email address, country, optional suggested question, and invitation status) are retained while we manage waitlist invitations and founding-voice records, or until you ask us to remove your entry.
• Active member accounts — Kept while your account exists. When you ask us to delete it, we delete your account and the personal data tied to it, including your passport verification identifier, within 30 days, except where the law requires us to keep something. Answers you gave may stay reflected in aggregate totals, which do not identify you.
• Abandoned sign-ups and registration drafts — If you sign in with Google or Microsoft but do not complete registration, your saved registration draft is automatically deleted 1 month after it was last updated, and the unfinished account record is deleted once the sign-in is over 1 month old and no registration draft remains.
• Removed opinions and images — When you remove a published opinion, it leaves public view immediately and is kept out of view for 1 year, so we can handle reports, appeals, and legal claims about it, before it is permanently deleted together with its images and everything attached to it, such as reactions and notifications. Images you add to a draft but never publish are kept until your account is deleted. Replacing or removing your profile photo deletes the previous one. Opinions that moderators hide for breaking the rules are kept off public view as part of our moderation record until the account that posted them is deleted. A copy of a deleted image that our content delivery network or your browser has cached may stay reachable at its original, hard-to-guess link until that cached copy expires.
• In-app notifications — All engagement notifications—whether read or unread—are automatically deleted 1 month after creation.
• Operational and analytics logs — Server logs are kept for 1 month, and analytics events for up to 1 year.

We protect personal data with safeguards suited to how sensitive it is:

• Encryption — Connections to IMHO use HTTPS, and our database and file storage are encrypted at rest by AWS.
• Limited access — Only the people who run IMHO can access personal data, through accounts protected by sign-in, and only to operate, support, and moderate the platform.
• Collecting less — We never receive your password or your passport data, and we strip metadata from the images you upload.
• Abuse protection — Rate limits and bot checks protect the platform against automated abuse.

No system is completely secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the relevant privacy regulators as the law requires, and we keep a record of every breach.

Wherever you live—whether under Canadian privacy law (PIPEDA and British Columbia's PIPA), the European Union or UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or other applicable laws—we extend the following rights to every user:

• Access and correction — You can view and update your profile details, display name, handle, bio, secret info, and visibility toggles at any time in your profile settings. (Once you complete optional passport verification, your verified year of birth and country are locked so verification cannot be falsified afterwards; if a verified detail is wrong or no longer true, contact us and we will correct it or reset your verification.)
• Content control — You can edit your answers (we limit how often each answer can change), edit or remove your written opinions, and unfollow or mute other users at any time.
• Deletion and erasure — You may request complete deletion of your account and personal data, or removal of your email address from the waitlist, by emailing us from the address associated with your account.
• Portability, restriction, and objection — You may request a copy of the personal data we hold about you, ask us to restrict how we use it, or object to processing based on our legitimate interests by contacting us.
• Withdrawing consent — You can withdraw your consent at any time by emailing us. We will then stop using your answers and delete them, together with the worldview profile and compatibility data built from them. Because answering questions is how you take part in IMHO, this also closes your account. You can remove your published opinions yourself at any time without withdrawing consent. Withdrawal does not affect processing that took place before it.

To exercise any of these rights, email support@imho.to. We aim to respond to all verified requests within 30 days. Depending on your jurisdiction, you also have the right to lodge a complaint with your local data protection authority (such as the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or your national supervisory authority).

We may update this Privacy Policy from time to time as IMHO evolves. When we make changes, we will update the date and version number at the top of this page, and where required by applicable law, we will notify members or request updated consent. The Cookies and Service Providers pages this policy links to carry their own dates, and we update them whenever we add, change, or remove a cookie or a provider.

Questions, privacy requests, waitlist removal requests, or concerns about how your data is handled can be sent at any time to support@imho.to.