Data privacy

Who operates the platform

ueb.al / Alpro Development, NIPT M12912403O, Fier, Shqipëri. info@fierinfo.com. In cooperation with Epoka e Re.

What is stored

The title, description, category, general area, submission time and notice version. You may add the issue coordinates, but they are optional. We do not request your name, email or phone number. Original text and coordinates are encrypted. Only owners and authorized moderators can review them.

A reviewed summary may become public and appear in reports prepared for the municipality. Municipality exports contain public fields only. An anonymous report is not linked to your account.

Report correspondence

The team may keep a private correspondence log for a report: institution, date, evidence reference, summary and recording staff member. Corrections are appended without overwriting history. Only updates marked for you appear in your private history. Team references and notes are not included in automatic copies; you can request their review through the privacy office. Each recorded correspondence event keeps the case for at least another 90 days. Deleting the report removes this log too, subject to retention holds.

Report review requests

Your private key or linked account lets you appeal a decision or request reopening with new information. The encrypted request and response refer to a specific report version. Only you and authorized staff can read them; the recorded decision maker cannot review their own decision. They are not automatically published. An open request pauses automatic report deletion until review or withdrawal. Text is erased 90 days after an answer or withdrawal unless a retention hold applies. Deleting the report includes its requests; erasing request text revokes previously prepared account copies.

Questionnaire responses

Questionnaire answers are private. We store encrypted answers, the question and notice versions, receipt time, channel and review state. No account is required. The private key is stored only as a cryptographic fingerprint; anyone holding it can read, correct or request deletion of the response. Do not include identifying or sensitive information in the text.

Responses are retained for 90 days from submission. Correction does not extend retention and returns the response for review. A retention hold restricts correction and analysis; pending deletion completes when the hold is released. After erasure, only key/source fingerprints, reason and ledger expiry are kept for 90 days to prevent replay. Assisted entries record the collector account and an encrypted source reference; this reference is not included in the participant's automatic copy.

Open your response with a private key

Assisted reports

For assisted reports we also record the channel, source reference, original language, collection time, collector account and documented permissions. Collectors can see only the title and status of reports they recorded. Source information is included in your private download and erased with the report.

Digital help requests

When you ask a volunteer to call you, we store the topic, area and time of the request. Your name (optional), phone number, preferred time and notes are encrypted and seen only by the volunteer who takes the request. With the private link you can check or cancel the request; cancelling deletes the contact at once. Contact details are deleted 30 days after the request is closed, unanswered requests close after 60 days and the record is deleted 180 days after closing. For the project report we keep only anonymous counts: topic, area, date, and gender and age group if you choose to give them, without name or contact.

Optional photos

You may upload up to three private photos. We remove camera and GPS metadata, resize the image and do not retain the original file. The processed copy is encrypted and downloadable through your private link. Publication requires your separate permission and moderator review, including masking identifying details. You can delete a photo; deleting the report also erases all its photos unless a retention hold applies. Copies downloaded by other people cannot be recalled automatically.

Maps and location

Address search activates only when you choose it. The street name or reverse-lookup coordinates are sent by our server to Photon (Komoot), using OpenStreetMap data. Your IP address, account and report text are not forwarded. Do not include personal details in a search. Queries and results are held only in server memory for up to 5 minutes to avoid repeated requests; they are not stored in the database. You can disable search and enter coordinates manually.

Weather and air quality are retrieved from Open-Meteo for a fixed point in Fier and temporarily cached on the server. We do not send the provider your IP address. The “Near me” button in the places directory asks for your location only when you press it; it is used in your browser to sort places and is not sent to Fierinfo. The “Get directions” button opens Google Maps only when you choose it. External services apply their own privacy policies. Komoot · Open-Meteo

The public can see only a moderator-approved approximate location on a grid of roughly 400–550 metres in Fier. This does not guarantee anonymity; moderators must omit it when an area could identify someone. Private coordinates are included in your download and erased with the report.

Maps do not load automatically. Choosing to load a map sends OpenStreetMap your IP address, site origin and requested viewing area. Report text, private keys and account data are not sent. Closing the map stops new requests. Coordinate fields and the list work without loading a map. OpenStreetMap privacy policy.

Case handling and history

The team records case progress, assignment, operational deadlines and history. Internal notes and resident updates are encrypted. Updates intended for you appear in the private tracker and data download. Internal notes are not included in the self-service download; contact info@fierinfo.com for further access requests. History is erased with the report unless a retention hold applies.

Case progress is separate from publication. A case can be resolved privately. Assigning staff or a deadline does not guarantee municipal action or change the retention deadline.

Optional email notifications

You can enable notices about reports linked to your account. Authorized editorial staff can separately opt into review and decision emails. Preferences start off. Resend receives the email address and a generic notice linking to the platform; drafts, private feedback and report keys are excluded. The link requires sign-in and the appropriate permission. Your account copy includes your choice, language and preference version. Opting out cancels queued notices; a message already being sent may still arrive. Role or identity changes disable editorial notices until you opt in again. Security emails remain independent of these choices.

Email delivery recovery

If your address is blocked after a bounce or complaint, you can request a review from a recently signed-in account. We retain the request, address fingerprint, time and decision. The owner's private evidence is encrypted and excluded from automatic account copies; contact info@fierinfo.com for further access. Requests expire after 30 days. The record and evidence are removed 90 days after closure or when the account is deleted. Minimal block fingerprints remain to prevent unreviewed re-contact. Approval does not change preferences or resend old emails; a later bounce or complaint blocks delivery again.

Changing your email

To change your account email, confirm the current address and then the new one. Each step requires a recent sign-in and its link expires after 15 minutes. Staff must use two-factor verification. Pending request addresses are encrypted; links are stored only as cryptographic fingerprints. Cancellation or completion deletes the request; expired requests are removed by scheduled retention. Completion revokes all sessions, recovery links and account copies, and notifies both addresses. The security log records the action and account without copying the addresses.

Reading preferences

When you change the accessibility settings in the footer, your browser stores the text size and display preferences in a cookie for one year. This cookie contains no personal identifiers. You can reset the preferences at any time from the same panel.

Your controls

Keep the private report link. It lets you view progress, download data, correct text or request deletion. Correction removes the public version and returns the report to review. If a retention hold applies, deletion requires human review and the report is removed from public view.

Without the private link we cannot automatically verify your connection to an anonymous report. For other rights, third-party information or complaints, contact info@fierinfo.com. You may also complain to the Albanian data protection authority. IDPC

Retention periods

New reports are retained for 90 days. Publishing or updating the public version extends retention to 365 days from that action. Withdrawing publication does not restart that period. A retention hold pauses automatic deletion. The deletion ledger retains the identifier, reason, dates and cryptographic fingerprints of the private receipt and source reference for 90 days, to prevent recreation by retries or imports and support restore controls. It does not retain report content or the private key.

The original CSV file is not retained. Import previews are encrypted for 24 hours; copies of private links for handoff are kept for up to 7 days after import. Cancellation immediately erases the preview. Deleting a report also removes its link from the import batch and cancels pending previews containing the same source.

Optional account linking

A verified email account can link a report only by presenting its private receipt, or by explicitly choosing account linking when submitting. We store the account ID, report ID and association date, without another copy of the private key. This association is not public, does not enable email and does not establish a person's legal identity.

My reports lets you view, export, correct or request deletion of a report and manage private photos. Unlinking ends account access but does not delete the report, invalidate its private receipt or erase the activity record. Report deletion also removes the account association. The original intake channel is retained with the report. A retention hold may restrict changes and deletion; the team reviews these requests.

Voting

Votes are linked to verified email accounts to enforce the limit of three priorities per round. The public sees totals, not voter identities. Voting is advisory and does not guarantee action by the municipality.

We retain a private history of selections, withdrawals and exclusions, with timestamps and structured reasons. You can see your own records; owners with two-factor verification can review the ledger. Evidence notes are encrypted and excluded from automatic copies; you can ask the privacy office to review them. History is erased after closure and 90 days from the round's scheduled end, unless an open appeal or retention hold applies. Erasing a report or account removes its link and the private notes. Closed tallies remain unchanged, without voter identities.

Tally corrections create new versions without changing the original. We retain the author, reason and time; private evidence is encrypted and retained for 90 days unless an open appeal or retention hold applies. Deleting the author or linked report erases private evidence and revokes prepared account copies. Publication needs review by another owner and an explicit decision; the public sees only the revision, date, broad reason and permitted counts.

View your choice history