Privacy

To vote, the site stores a random voter ID in your browser. It is kept in a signed, httpOnly cookie named pba_voter, and it is how each browser gets one vote per category. The ID is a random value, not your name or email address, and scripts running on the page cannot read it. The cookie is set when you open the voting page and expires after 180 days.

Your IP address is never stored. With each vote the site stores two one-way keyed hashes (HMAC-SHA-256): one of your network address, which is your IP address or, on IPv6, the network part of it, and one of your browser’s user-agent string. They are used only to limit votes per network and to detect ballot stuffing.

No name, email address or account is required to vote.

When the organizers turn it on, Cloudflare Turnstile checks that a vote comes from a person and not a bot. Turnstile is run by Cloudflare, in your browser, under Cloudflare’s privacy policy. To confirm the result, the site sends your IP address to Cloudflare along with each vote’s check.

Tickets are sold by Eventbrite. You pay on Eventbrite’s checkout, and what you enter there is handled by Eventbrite under Eventbrite’s privacy policy.

When on-site checkout is turned on, your browser loads Eventbrite’s checkout script from eventbrite.com as the ticket section of the home page comes into view, or when you point at, tab to or touch a ticket button. Eventbrite then receives your IP address and browser details, even if you do not buy a ticket.

The site uses Vercel Web Analytics, which sets no cookies and reports aggregated numbers. If the organizers enable it, the site also uses Google Analytics 4, which does set cookies.

Both are used to count page views, ticket-button clicks and voting activity. No personal data is sent in these events.

The home page draws a 3D night scene on your device with WebGL. It is drawn by code that ships with this site, and nothing about it, or about how you move through it, is sent anywhere. The scene is skipped, and a still picture takes its place, when your browser asks for data saving, when your device reports very little memory, and when WebGL is unavailable. If you have asked your device for reduced motion, the scene is still drawn but nothing in it moves.

We delete vote records, or anonymize them by removing the voter ID and both hashes, within 90 days after the event on Friday, October 9, 2026.