Transparency & accountability

We don't take "public record" lightly

A public record only means something if people can trust it — and you shouldn't have to trust us to do that. This page explains, in plain terms, how we keep the record honest, how we follow the law when something has to come down, and how anyone can hold us to account.

We are one custodian — not the source of truth

OurSay keeps the public record, but we don't own it. It's designed to be held by many people at once: everything that goes on the record is published so anyone can keep their own copy. The truth of the record doesn't live only on our servers — it lives in every copy people keep. That's the whole point of calling it public.

What we publish

  • The public record of actions — anonymized, signed, and attested by us. Every verified action is there to audit, without revealing who took it.
  • The results of every public vote, broken down by area and verification tier.
  • Every line of code that runs the platform, and a digital fingerprint of every released version, so anyone can confirm the app you use is the code we published.

A public record, but private people

The record holds a digital fingerprint of each action — not your personal message and not your name. Your identity stays off the public record. You can take part anonymously and still be counted in the verified total. We'd rather prove a real person acted than keep a pile of personal details that could leak.

When we must remove something

Sometimes the law requires content to come down — a court order, content that breaks Canada's online-harms rules, or a person exercising their right to be forgotten. We take those obligations seriously, and we handle them in the most minimal way possible:

  • We remove the least possible. The message is hidden or deleted — but the rest of the entry (when it happened, that a real participant acted, its digital fingerprint) stays public.
  • We never silently rewrite history. A removed entry still shows that something existed at that moment; its fingerprint remains, and every other record still checks out.
  • Where the law requires us to keep removed content for lawful access, we keep it privately — never published. It is disclosed only to the authorities entitled to it.

The result: we can comply with a takedown without breaking the record. The fingerprint that's left is enough to prove the entry was real and that everything around it is intact.

Keep your own copy — and hold us accountable

This is the most important assurance on this page, and it only works if people act on it: keep your own copy of the public record. Because every entry carries a digital fingerprint, anyone holding an earlier copy can later prove whether something was changed, redacted, or erased — and confirm we acted in good faith. We actively encourage independent auditors, journalists, researchers, and officials to do exactly that. The more people who keep a copy, the less anyone — including us — could ever quietly alter the record.

For officials

  • You can respond on the record to petitions and public votes that name your office.
  • You can independently audit the signed record itself — every verified action is anonymized, attested by us, and yours to check, without taking our word for it.
  • The one thing that isn't yet trustless is confirming a verified voice belongs to your specific riding — that rests on address verification today. The fully independent path is an electoral-authority integration, and any resident can choose to prove their own record to you.
  • We claim no endorsement, certification, or approval from any government body or electoral authority.
  • Identity verification confirms a real person at a real address; it is not a determination of electoral eligibility or voter registration.

For the technically inclined

The public record is an append-only log. For each action we store a content commitment — a salted cryptographic hash of the content — never the plaintext. Each action is signed with the participant's own digital signature (rolling out before launch). Entries are summarized in batches into a Merkle root, and those roots are anchored to independent public locations so the record can't be quietly changed after the fact. We also publish a signed attestation over the set of valid records, so the list you audit is provably the one we stand behind.

Verification runs offline: given the published data and a root obtained independently, anyone can check a single entry or a whole batch — without trusting our servers. A removed entry still verifies on its fingerprint alone, which is exactly how a takedown can comply with the law while leaving the record provably intact. The tools to do all of this are in our open-source repository.

Questions, or think we got something wrong?

Everything here is open to inspection. Read the code on GitHub, or email us at oursay.ca@gmail.com. If we've got something wrong, we want to know.