Skip to main content
Last updated: August 2026

​
1. Who We Are

World Republic (“World Republic,” “we,” “us,” or “our”) operates the World Republic application and website at https://www.worldrepublic.org (the “Service”). World Republic is a Swiss association (Verein) under Art. 60 et seq. of the Swiss Civil Code, registered in Zug, Switzerland. For most processing described below we are the data controller. For identity verification, we are the controller and our verification providers (Amazon Web Services and Didit) act as our processors / service providers.

​
2. Scope

This policy applies to everyone who uses the Service, worldwide. Where local law gives you additional rights — including the EU and UK GDPR, the revised Swiss Federal Act on Data Protection (revFADP), the California Consumer Privacy Act as amended by the CPRA, and U.S. state biometric laws (Illinois BIPA, Texas CUBI, Washington) — those rights are described in Section 10. World Republic currently runs non-binding test elections. We are not yet enrolling members; participation is experimental.

​
3. Information We Collect

​
3.1 Information you provide

  • Account information: if you sign in with Google, we receive an authentication token and your Google account identifier. We deliberately do not store your Google name, email, or photo in our user records.
  • Passkey credentials: if you use a passkey (WebAuthn), we store the public key credential, an identifier, and the device metadata needed to authenticate you.
  • Profile information: an automatically generated username and referral code.
  • Content you create: political party names, descriptions, and links.
  • Transaction details: when you withdraw WDD, the destination wallet address, amount, and selected chain.

​
3.2 Identity verification and biometric data

To keep test elections fair (one verified person, one vote) and to prevent fraud and duplicate accounts, we verify that you are a unique, live, real person. See Section 4 for the full, separate explanation of biometric data — please read it carefully.

​
3.3 Information collected automatically

  • Device and log information: device and browser type, operating system, and similar technical data.
  • IP address: we process your IP address to enforce rate limits and prevent abuse (stored short-term in our rate-limit records). We also store your IP address and browser user-agent as part of a consent record when you accept our Terms and Privacy Policy or give biometric consent, as proof of that consent.
  • Usage information: features used and actions taken within the Service.
  • Performance measurement: we measure how quickly pages load and respond on your device (Core Web Vitals) and send those timings to our hosting provider, along with the page’s route and coarse device, connection and country information derived from the request. This is cookieless, stores nothing on your device, and is not linked to your account. The address reported is reduced to the page path before it leaves your device, so query strings — including referral links — are not sent.

​
3.4 Cookies and local storage

We use only strictly necessary and functional cookies and local storage:
  • Authentication and security (session and account-linking cookies).
  • Preferences (e.g. your selected language).
  • Functional state (e.g. referral capture, return-to-page after verification).
We do not use advertising cookies, and we run no advertising or cross-site tracking SDKs. We do run one cookieless performance-measurement SDK (Vercel Speed Insights) to measure page-loading speed: it sets no cookies, stores nothing on your device, and does not identify you — see §3.3.

​
4. Biometric Data (Face Liveness) — Please Read

To vote in test elections you must complete a face liveness check. This involves processing biometric data, which is sensitive / special-category personal data. We want to be fully transparent about it.

​
4.1 What happens

  • Your device captures a short live facial video, which is processed by Amazon Web Services (AWS) Amazon Rekognition Face Liveness to confirm a real, live person is present (anti-spoofing).
  • On a successful check, AWS stores a reference facial image for the session, and we create a facial vector (template) that is added to a secure AWS Rekognition collection.
  • We use that collection to run a one-to-many comparison against other users’ facial vectors so the same person cannot create multiple voting accounts. If a possible match is found, a limited, access-controlled human review may compare the images before a decision is made.

​
4.2 Escalation to Didit

If you cannot complete the AWS face liveness check (for example, a false duplicate match for look-alikes), we offer an escalation to Didit, an identity-verification provider, to confirm your identity. In that flow we ask for your explicit consent, and document, selfie, and liveness data are processed by Didit on our behalf. We receive only the verification result and a minimal record (such as a document expiry date and an internal reference) — not your document images, full name, date of birth, or document number.

​
4.3 Service-provider notice (AWS and Didit)

World Republic uses service providers for identity-verification services. Biometric identifiers and biometric information (“biometric data”), specifically scans of your facial geometry and the related facial images and templates, may be collected, stored, and used by these service providers (AWS and, on escalation, Didit) on World Republic’s behalf for the purpose of verifying that you are a unique, live, real person and preventing duplicate or fraudulent accounts. World Republic will instruct its service providers to permanently destroy biometric data stored on its behalf when the initial purpose for collecting it has been satisfied, when you request deletion, or earlier if required by law. Biometric data may be transmitted between World Republic and its service providers as necessary to provide this service. We process your biometric data only with your explicit, opt-in consent, which we request at the start of the face liveness step. You can decline, but you will not be able to vote in test elections without completing verification. You can withdraw consent and request deletion of your biometric data at any time (see Sections 9 and 10).

​
4.5 Retention and destruction

We retain biometric data only as long as needed for verification and anti-duplication, and we destroy it when the purpose is satisfied, on your deletion request, or within the period set in our written biometric retention and destruction policy — whichever occurs first. Destruction includes deleting the AWS reference image (Amazon S3) and the facial vector (Rekognition collection).

​
4.6 Where biometric data is processed

Your facial templates and reference images are processed and stored by AWS in the European Union (Ireland). Associated verification metadata (for example, confidence scores and storage references) is held in our primary database (see Section 7).

​
6. How We Share Information

We do not sell your personal information. We share it only with processors acting on our behalf, and as required by law:
  • Google — authentication (policies.google.com/privacy).
  • Amazon Web Services (AWS) — Amazon Rekognition Face Liveness, Amazon S3 (reference images), and Amazon Cognito (temporary guest credentials), as our service provider for biometric verification (EU region).
  • Didit — identity verification on escalation. See Didit’s Verification Privacy Notice and End User Terms for Identity Verification.
  • Thirdweb — executes WDD blockchain withdrawals; receives the destination address, amount, and chain only.
  • Neon — database hosting for Service data (Singapore region).
  • Vercel — application hosting, infrastructure logs, and cookieless performance measurement (Singapore region).
A current list of sub-processors is available on request. We may also disclose information to comply with law or valid requests by public authorities, and in a merger, acquisition, or asset transfer (subject to lawful safeguards).

​
7. International Data Transfers

We are established in Switzerland, which benefits from an EU adequacy decision. Your data is processed in more than one country:
  • Biometric data (facial templates and reference images) is processed and stored by AWS in the European Union (Ireland).
  • Account and application data is hosted with Neon (database) and Vercel (hosting) in Singapore.
Singapore is not covered by an EU or Swiss adequacy decision. For transfers to Singapore and to any other country without adequacy, we rely on the European Commission’s Standard Contractual Clauses, the Swiss complement, and appropriate supplementary measures. Where adequacy decisions apply (for example, EU–Switzerland), we rely on those.

​
8. Data Retention

​
9. Account Deletion

You can delete your account in the Service. On deletion we instruct AWS and Didit to destroy biometric data held on our behalf, remove your verification records, and delete or irreversibly anonymize your personal data, except where we must retain limited information to meet legal obligations or to preserve the integrity of concluded test elections.

​
10. Your Rights

Depending on where you live, you may have the rights below. To exercise any right, contact privacy@worldrepublic.org. You will not be discriminated against for exercising them.
  • EU/EEA and UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to your local supervisory authority.
  • Switzerland (revFADP): access, rectification, deletion, objection, and the right to complain to the Federal Data Protection and Information Commissioner (FDPIC).
  • California (CCPA/CPRA): know, delete, correct, opt out of sale/sharing (we do not sell or share), and limit the use of sensitive personal information (which includes biometric data).
  • Biometric laws (Illinois BIPA, Texas CUBI, Washington): we obtain your consent before collecting biometric data, do not sell it, and follow a written retention and destruction schedule.

​
11. Security

We use TLS in transit, access-controlled storage, and least-privilege access. No system is perfectly secure, but we work to protect your data.

​
12. Children

The Service is for adults 18 or older. We do not knowingly collect data from anyone under 18.

​
13. Changes

We may update this policy and will revise the “Last updated” date and, for material changes, notify you in the Service.

​
14. Contact