Privacy on this ballot

Who is running this contest

NJ Monthly runs this contest. They decide what is collected here and why, and the answers you give belong to them: it is their contest, you are their reader, and they are the ones responsible for it.

Laurel, a product of CopperPress, is the software NJ Monthly uses to run it. We hold and process what is collected on their instructions, for them. We do not use it for our own purposes, we do not sell it, and we do not add you to any list of ours. In the language data-protection law uses: NJ Monthly is the controller and Laurel is their processor.

So if you want something corrected or removed, or you want to know how your details are being used, ask NJ Monthly first — it is their contest and the answer is theirs to give.

What you are asked for

To take part you register once, with a name and an email address. We email you a link to confirm the address is yours. Confirming is not a requirement — an unconfirmed vote still counts in full — it simply makes you easier to tell apart from an automated signup.

NJ Monthly may also add up to two opt-in boxes and a few short questions about you. Those are optional, they start empty, and a question you leave blank is not stored. Ticking an opt-in box is what lets NJ Monthly email you about the contest through Laurel; leave them alone and Laurel will not send them. Whether you ticked one is shown to NJ Monthly beside your name and address (see below).

NJ Monthly signs up everyone who submits a form on this site to their newsletter, as the small print on the form says. Your name and email address are passed to NJ Monthly's own newsletter service — their account, not ours — and you unsubscribe from it there, at any time.

Some of NJ Monthly's quick polls ask for your name, email address and, where asked, phone number in order to enter. Those details are stored with your entry so NJ Monthly can run the prize draw and contact the winner, and so that one email address can enter each poll only once. If you also sign up for the newsletter they are passed to NJ Monthly's newsletter service as well. Nobody here uses your phone number to call or text you about anything else.

Registering also records the address you connected from and the device fingerprint described below, on the same record as your email.

NJ Monthly can see the name and email address of everyone who nominated or voted, with how many nominations and votes each person made and whether they ticked the newsletter box. They also see your name and address when they are looking into a suspicious pattern of voting.

What is recorded when you nominate or vote

A Best Of contest is worth cheating at, so every nomination and every vote carries a record of how it arrived. That record exists to catch ballot stuffing and it is not used for anything else.

With each submission we record: your IP address and the country Cloudflare reports for it; a fingerprint your browser works out about itself from your screen, fonts, audio and canvas, which is the same for the same device; which family of browser you are using and a one-way hash of the full line your browser sends describing itself (the line itself is never stored); the language your browser asks for; the address — the site name only, never the full link — of the page you arrived from; how long the form was open before you sent it; how many times you tapped or typed in it; whether a hidden field that only automated software fills was filled; and the result of the Cloudflare check described below.

That record does not include what you read, how far you scrolled, how long you stayed, or where your pointer went, and there is no session recording on this ballot. Visits to its pages are counted separately, with Google Analytics, as described under “Other companies involved” below.

Bot and spam protection

We use Cloudflare Turnstile to tell people apart from automated abuse. It runs in its invisible mode: on almost every visit it draws nothing at all and you will never know it ran, and it only asks you to do something if Cloudflare wants a closer look.

To make that judgment Cloudflare receives four things about the request: your IP address, a fingerprint of the encrypted connection your browser opened, the line your browser sends describing itself, and the public key identifying the form you are on together with the address of the page it sits on. Turnstile then hands your browser a single-use challenge token, and when you submit the form our server sends that token back to Cloudflare to be checked. The token records that a check happened and how it went. It is spent on that one submission and it is not an identifier for you.

Cloudflare does that check as our processor — on our instructions, for us. It also uses what it sees to improve how well Turnstile tells people from bots, and for that second purpose it is acting for itself rather than for us. Cloudflare states that Turnstile sets no cookies and does not look for them, and that what it collects is not used for advertising: not handing the problem to an advertising business is the reason it exists.

All of that is set out in the Cloudflare Turnstile Privacy Addendum, which forms part of this notice by reference.

On this ballot Turnstile runs in the three places where automated abuse would do real damage: nominating, voting, and registering to vote. It is never a gate — a check that fails, or never loads at all, does not stop your nomination or your vote reaching us. It is one signal among several, and a person reviews the rest.

Cookies, and what your browser keeps

Reading these pages sets no cookie of ours at all, which is why they can be held close to you and load quickly. One cookie of ours is set the first time you register or send something: it carries nothing but an identifier that tells our server it is still you, and it expires. Cloudflare, which sits in front of this site as its network, sets its own cookies for security and traffic. Google Analytics, described below, stores its own cookies in your browser too.

On a ballot you can answer without giving us an address, one more cookie is set at the moment you answer — never just for reading. It holds nothing but a number that stands for the answer you already gave, and it is what lets us keep the promise that everyone gets one say: without it we could not tell you apart from someone arriving for the first time. It is set only by your own device, is never sent to anyone else, and lasts until you clear your browser data or roughly a year passes, whichever comes first. If more than one person answers from the same phone or computer, that device is treated as one reader.

Your browser also keeps a little on your own device so a bad signal cannot lose your work: the picks you have made but not yet sent, and — only for as long as this tab is open — the device fingerprint. Clearing your browser data clears both.

Other companies involved

Cloudflare is the network in front of this site and the provider of the check described above.

Google's business lookup is used only if you nominate a business that is not already on the ballot: the text you type is sent so the business can be found and matched. It goes from our server, not from your browser, so your address and your identity do not travel with it.

Google Fonts supplies the typeface NJ Monthly chose for these pages. Your browser downloads it from Google, which sees your IP address and browser details as it would for any download.

Google Analytics counts visits to these pages so that how the contest is being read can be measured. It runs in your browser, which tells Google which pages you open, for how long and how far you scroll, which links and buttons you use, the site that sent you, and your browser, device and approximate location; Google also sees your IP address. It keeps a random identifier in cookies so a return visit can be recognised. It is not given your name, your email address, or anything you nominated or voted for.

Our email provider delivers the confirmation message and any contest email you opted into. If you joined the newsletter, that is NJ Monthly's own provider and it is separate from this.

HubSpot is the newsletter service NJ Monthly uses. If you sign up for their newsletter, the details you gave on the form are sent there, to NJ Monthly's own account.

Sponsors. If a sponsor's panel appears on this ballot, we count that it was shown and whether it was clicked, so the sponsor can be told how it performed. What is stored against that count is a code derived from your address and browser that changes every day and cannot be turned back into either; no cookie is set for it, and it cannot be linked to anything you nominated or voted for. If you click through, the sponsor is not told which page you came from.

If a script on this page breaks, your browser sends us the error, the address of the page without anything after the question mark, and which browser you are on, so it can be fixed. Nothing you typed is included.

How long it is kept

The record attached to a nomination or a vote is kept while the contest is running and for 90 days after it closes — long enough for the result to be certified and challenged. After that the identifying parts of it are cleared automatically: your IP address, the device fingerprint, the browser hash, your language and the site you arrived from.

Two limits on that, stated rather than left to be discovered. Votes and nominations themselves can never be deleted — the database refuses it, and that refusal is what makes a result worth trusting — so a copy of the address and the fingerprint stays frozen beside the vote, and a copy stays on your voter record. Those two are cleared when someone asks for their identity to be erased, not by the 90-day sweep.

Asking about your details, or asking for them to go

Ask NJ Monthly. This is their contest and their decision, and we act on their instruction.

Erasure works by severing you from your votes rather than by deleting them: your name and email address are replaced, the address and device details on your record are cleared, and the votes stay counted and anonymous. Nobody's results move because somebody exercised a right.