Sorkia

Sorkia Privacy Policy

Version: 2026-10-04-v1 Effective: 2026-10-04

This policy explains what personal information Sorkia handles, why, for how long, who receives it, and what you can do about it. "Sorkia", "the state" and "NMT" have the meanings in the Terms of Citizenship.

1. Who is responsible

1.1 Sorkia is operated by one individual under the name Need More Truth (needmoretruth, "NMT"), who is the controller of the personal data described here and, being one person, is also the person in charge of personal data protection (개인정보 보호책임자). NMT lives in the Republic of Korea and runs Sorkia as a non-profit personal project. Sorkia has no company and no business registration.

1.2 Contact: contact@sorkia.org. There is no phone line and no postal counter.

2. What Sorkia handles and why

2.1 Your application and account

  • Items: your Sorkia name (first, middle and last name, or one name); the login name made from it; your display nickname; your password; the language you chose on the site; your message to the state; the status of your application and its dates and times; a status-check link, stored only as a hash; once approved, your citizen number, account ID and name history.
  • The citizenship site passes your password to the login gateway (Keycloak) and does not store it. The login gateway stores it only in hashed form.
  • Purpose: to decide your application, create and run your account, keep the registry of citizens, and let you log in.
  • Required: yes. Without these items you cannot apply.

2.2 Your e-mail address (optional)

  • Items: the e-mail address you give.
  • Purpose: to tell you whether your application was approved or refused, and to help you recover your account. Sorkia's e-mail comes from sorkia@needmoretruth.com and is sent through Proton.
  • Required: no. Giving the address is your consent to this use. Without it, you see the result on the status page instead.

2.3 Required survey answers

  • Items: your answers to 3 questions. Each is needed for citizenship:
    • the place you live (its country, and its state where the age of majority is set by state), because it decides which age of majority applies to you;
    • your age band, because it confirms that you are at least 18;
    • the languages you will use in Sorkia, because they place you in language channels.
  • These questions need a real answer. If you do not answer them, you cannot apply.
  • You also confirm your adulthood in a separate declaration.
  • Purpose: to check that you can become a citizen and to place you in language channels. The answers are also counted in Sorkia's statistics (section 6).

2.4 Optional survey answers

  • Items: your answers to any of the 20 optional questions that are not sensitive, such as your native language, how you found Sorkia and what you want to do in Sorkia.
  • Sorkia processes them only if you check the optional box for them. Without that box the optional questions are disabled, and you can still apply.
  • Each answered optional question earns Sorki when you are approved: 10 or 20 Sorki, shown next to the question. The state gives Sorki no monetary value.
  • Purpose: research and statistics about Sorkia and its citizens, and publishing aggregate counts (section 6).

2.5 Sensitive answers (optional)

  • Seven optional questions ask for sensitive information: your political leaning, your economic leaning, the way of making decisions you prefer, your religion, how satisfied you are with the politics of your country, whether you have experienced internet censorship, and whether you use Tor or a VPN.
  • Sorkia processes these answers only with your separate, explicit consent, given with its own optional box. Without that box these questions are disabled, and you can still apply.
  • Each answered sensitive question earns 30 Sorki when you are approved. All optional answers together earn at most 510 Sorki.
  • Purpose: the same as section 2.4.
  • Your individual answers are not shown to other citizens. Aggregate counts for these questions are not published by default. If Sorkia publishes them, the rules in section 6 apply.

2.6 How Sorkia uses survey answers

Your answers are linked to your account and kept for the periods in section 8. Your optional and sensitive answers are not used to decide your application. You can withdraw any consent at any time (section 9).

2.7 Chat

  • Items: the messages, files, images and reactions you post; the rooms you are in; who sent what, when and in which room; your display name and avatar; the devices and sessions you log in with.
  • Purpose: to run the chat, keep Sorkia's records and enforce the Terms. The state may use and disclose messages to enforce the Terms, protect people or comply with the law.
  • Messages are not end-to-end encrypted. The state account is a member of every room, including direct chats and your desk room. The state and NMT can read every message and file. Server administrators can see which account sent what, when, and in which room.
  • If Sorkia lets you post under a pseudonym or with your name hidden, the state keeps the link between the post and your account.

2.8 Network information from your signup

  • When you submit an application, Sorkia reads your IP address once and does not store it. It stores only what it derives from it:
    • the country of the address, from the public-domain IPtoASN data;
    • the network: its AS number and name;
    • whether the address is a Tor exit;
    • an estimate of whether the network is a hosting or VPN network;
    • a keyed hash of the address that only lets Sorkia tell whether two applications or citizens came from the same address.
  • If the country of the address differs from the country you declared, the form asks you once to confirm your answer.
  • Purpose: to detect fraud and duplicate applications. The shares of citizens who applied from Tor and from hosting or VPN networks are counted in Sorkia's statistics like the other answers (sections 3.1 and 6).

2.9 Other technical data

  • The proxy deletes IP address fields from its logs.
  • The login gateway does not receive your IP address. It records each login (time, account, app, session and the proxy's internal address) and keeps the record for 60 days, so that an approval can be cancelled only when it was not used (section 11.2).
  • The chat server does not see your IP address. The only address it stores for a device is the proxy's internal address.
  • The citizenship site limits repeated submissions with a keyed hash of your address that is held only in memory.
  • Server logs are kept for at most 14 days.

2.10 Mail you send to Sorkia

  • Items: your e-mail address and the content of mail you send to contact@sorkia.org.
  • Purpose: to answer you and to handle your requests, including requests under section 9.

2.11 What Sorkia does not collect

Sorkia does not store your IP address. It does not ask for identity documents, your legal name, your postal address, your phone number or payment details.

3. Legal bases

3.1 Korea (PIPA).

  • Processed without consent, because they are needed to carry out your application and citizenship (Art. 15(1)(iv)): sections 2.1, 2.3, 2.7 and 2.9.
  • Processed with your consent (Art. 15(1)(i)): section 2.8 (required consent, box 3); section 2.2 (optional; giving the address is the consent); section 2.4 (optional, box 4).
  • Sensitive answers (section 2.5): your separate consent (Art. 23(1)(i)).
  • Mail you send (section 2.10): to meet Sorkia's legal duties on your requests (Art. 15(1)(ii)), and otherwise Sorkia's legitimate interest in answering you (Art. 15(1)(vi)).
  • Keeping data after your citizenship or application ends (section 8.1–8.2): Sorkia's legitimate interest in detecting repeat or fraudulent applications and in handling disputes (Art. 15(1)(vi)).
  • Counting answers and network information in aggregate statistics is an additional use without consent under Art. 15(3). Sorkia checks it against these criteria (Enforcement Decree Art. 14-2):
    • it is related to the original purpose, because it describes who applies and who joins;
    • it is foreseeable, because this policy and the signup form announce it;
    • it does not unduly harm you, because only counts are published, groups under 10 are shown as "<10", and sensitive questions are not published by default;
    • it is protected, because only the aggregate leaves Sorkia, and access to the underlying data is limited (section 12).
  • NMT, as the person in charge of personal data protection, checks the statistics against these criteria.

3.2 European Union (GDPR).

  • Sections 2.1 and 2.3: needed to provide citizenship to you (Art. 6(1)(b)).
  • Section 2.7: needed to provide citizenship to you (Art. 6(1)(b)); for reading and keeping messages to enforce the Terms and prevent abuse, Sorkia's legitimate interest in keeping Sorkia lawful and safe for its citizens (Art. 6(1)(f)).
  • Sections 2.2 and 2.4: your consent (Art. 6(1)(a)).
  • Section 2.5: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)).
  • Sections 2.8 and 2.9: Sorkia's legitimate interest in preventing fraud, duplicate accounts and abuse (Art. 6(1)(f)).
  • Section 2.10: to meet Sorkia's legal duties on your requests (Art. 6(1)(c)), and otherwise Sorkia's legitimate interest in answering you (Art. 6(1)(f)).
  • Statistics and keeping data after your citizenship or application ends: Sorkia's legitimate interest in knowing its own population, in detecting repeat or fraudulent applications and in handling disputes (Art. 6(1)(f)).
  • For the EU, checking box 3 is acceptance of this notice. It is not the legal basis; the bases are the ones listed here.

3.3 You have the right to object at any time to processing based on Sorkia's legitimate interest (Art. 6(1)(f)), on grounds relating to your situation. Send your objection as described in section 9.

4. Who receives your information

4.1 Sorkia does not sell your personal information for money and does not share it for advertising.

4.2 Sorkia uses these service providers. Each processes information on Sorkia's behalf.

| Provider | What it does | Information | Country | |---|---|---|---| | OVH Hosting Inc. (OVHcloud) — 1801 McGill College Avenue, Suite 800, Montréal, Quebec H3A 2N4, Canada · rprp@ovh.ca | Hosts Sorkia's server in Beauharnois, Quebec, and keeps one automatic whole-disk copy of it, replaced daily | Everything in section 2 | Canada | | Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA · dpo@cloudflare.com | DNS for Sorkia's domains; Email Routing, which forwards mail sent to contact@sorkia.org; R2 storage of Sorkia's daily off-site backups | Mail: sender address and content. Backups: everything in section 2, encrypted before upload | USA; backups in Cloudflare's "Eastern North America" location (USA or Canada) | | Proton AG — Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · privacy requests: https://proton.me/support/contact-product | Sends Sorkia's e-mail; receives and stores mail sent to contact@sorkia.org in NMT's mailbox | Your e-mail address, the messages sent to you, and the sender address and content of mail you send | Switzerland |

4.3 Sorkia's own off-site backups at Cloudflare are encrypted on Sorkia's server before they leave it, and Cloudflare does not hold the key. OVH's whole-disk copy is not encrypted by Sorkia; OVH holds it in Canada.

4.4 The signup form shows Cloudflare Turnstile. It reads device signals needed to tell people from bots, such as IP address, TLS fingerprint and browser type. Cloudflare collects these directly from your browser, as its own controller under its own Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/) and Privacy Policy (https://www.cloudflare.com/privacypolicy/). Sorkia provides nothing to Cloudflare for this; it receives only the result of the check.

4.5 Proton receives your e-mail address if you give one, and the sender address and content of any mail you send to contact@sorkia.org.

4.6 Mobile apps deliver notifications through their maker's push service and through Apple or Google. Notifications pass through those services and may include message content, depending on the app. Sorkia does not control them.

4.7 If you use Element's web app, Element runs it under its own policy.

4.8 Sorkia gives personal information to public authorities only when the law requires it.

5. Transfers abroad

5.1 NMT lives in Korea and accesses Sorkia's data from there. Sorkia's data is stored in Canada. Your information is transferred abroad as follows.

  • Items: section 4.2, per provider.
  • Countries: Canada; the United States (Cloudflare); the United States or Canada (Cloudflare's "Eastern North America" backup location); Switzerland (Proton).
  • When and how: over the internet, encrypted in transit, when you use Sorkia or write to Sorkia. Off-site backups are uploaded once a day.
  • Recipients and contacts: section 4.2.
  • Purpose and retention by the recipient, for the services in section 4.2 (Cloudflare's own use of Turnstile signals is covered by 4.4, not here): for as long as Sorkia uses the provider; Sorkia's off-site backups for 14 days; OVH's whole-disk copy for 1 day; mail as in section 8.6.
  • How to refuse and the effect: you can refuse only by not applying, not writing, or leaving Sorkia. Sorkia cannot run without these transfers.

5.2 Korea: these transfers rest on PIPA Art. 28-8(1)(iii)(a). They are entrustment and storage needed to provide citizenship, and the items of Art. 28-8(2) are set out in this policy.

5.3 European Union: the European Commission has adequacy decisions for Canada (commercial organisations), Switzerland and the United States (organisations in the EU-US Data Privacy Framework). Cloudflare states in its Privacy Policy that it is certified under that framework. Because NMT accesses the data from Korea, the Commission's adequacy decision for the Republic of Korea also applies.

6. Public statistics

6.1 The state publishes the total population live.

6.2 The state publishes a pie chart for each survey question, updated live. It also publishes the shares of citizens who applied from Tor and from hosting or VPN networks. The charts count approved citizens only. Any group of fewer than 10 people is shown as "<10".

6.3 Charts for the seven sensitive questions are not published by default.

6.4 Because the charts update live, a change right after someone joins can hint at that person's answers. This can happen even where a count is 10 or more, and it applies to the required answers too.

6.5 To keep an optional answer out of every chart, leave the question blank. If you withdraw a consent, the information it covers is deleted. Statistics already published stay as they are.

7. Cookies and similar tools

7.1 The login gateway and the citizenship site use cookies to keep you logged in.

7.2 The Turnstile captcha runs in your browser on the signup form (section 4.4).

7.3 Sorkia does not use advertising or analytics cookies.

7.4 You can block cookies in your browser. You then cannot log in.

8. How long Sorkia keeps information, and how it is deleted

8.1 Citizens: your account and registry data, e-mail address, survey answers and network information are kept while you are a citizen. They are deleted 1 year after your citizenship ends, unless a law requires Sorkia to keep them longer. The year is kept to detect repeat or fraudulent applications and to handle disputes.

8.2 Applications that were refused, withdrawn or expired, with their answers and network information: 3 years from the decision, withdrawal or expiry, to detect repeat or fraudulent applications and to handle disputes.

8.3 If you withdraw a consent, the information it covers is deleted.

8.4 Chat content: as long as it stays in the rooms. Messages stay after you leave unless they are removed.

8.5 Server logs: at most 14 days. Login records at the login gateway: 60 days. Sorkia's off-site backups at Cloudflare: 14 days. OVH's whole-disk copy: 1 day, replaced daily.

8.6 Mail sent to contact@sorkia.org: as long as needed to handle your request, and at most 3 years after the request is closed, to handle disputes about it.

8.7 Published aggregate statistics are kept without limit.

8.8 Deletion: Sorkia deletes the information from its live systems so it cannot be restored there. Copies disappear when each backup is replaced or deleted: within 1 day in OVH's copy and within 14 days in Sorkia's off-site backups.

9. Your rights

9.1 You can ask Sorkia to:

  • show you your personal information;
  • correct it (your age band only after NMT reviews the request);
  • delete it;
  • stop or limit processing it;
  • give you a copy in a common format;
  • stop processing based on legitimate interest (objection, section 3.3).

9.2 You can withdraw any consent at any time. Withdrawal does not affect processing before it.

  • Withdrawing box 4 or box 5 deletes the answers it covers. Sorki already earned for them are kept. Statistics already published stay.
  • Box 3 is needed to apply. Withdrawing it withdraws your application or ends your citizenship.

9.3 Send requests and withdrawals to contact@sorkia.org, or use the status page reached by your status-check link. Sorkia confirms who you are as follows:

  • citizens: a message from your Sorkia account;
  • applicants: the status-check link;
  • former citizens: a reply from the e-mail address on file, or the status-check link.

9.4 Someone else may make a request for you with your written authority (PIPA Art. 38).

9.5 If Sorkia refuses a request, it tells you why. You can appeal by replying to that answer; Sorkia decides the appeal in writing within 60 days and, if it denies it, tells you how to complain to the authority where you live (in the US, your state's attorney general).

9.6 You can complain to a supervisory authority: in Korea, the Personal Information Protection Commission (PIPA Art. 62); in the EU, the authority in your country (GDPR Art. 77). You may also go to court.

10. Children

10.1 Sorkia does not knowingly accept children. Only people who are at least 18 and adults where they live may apply.

10.2 If Sorkia learns that an applicant or citizen is not an adult, it refuses the application or revokes the citizenship, and deletes that person's account and registry data, e-mail address, survey answers and network information.

11. Decisions about you

11.1 No decision on your application is made by automated means alone. NMT decides every application, and may take network information (section 2.8) into account.

11.2 Two things happen automatically:

  • The site refuses a submission that fails its checks: a failed captcha, repeated submissions, a missing required field, a forbidden name, or a message that is empty or too short. You can correct it and send it again.
  • An approval is cancelled if you do not log in within 28 days.

11.3 You can contest either at contact@sorkia.org.

12. Security

  • Connections to Sorkia are encrypted (TLS).
  • Passwords are stored only in hashed form by the login gateway. Repeated wrong passwords lock the login for a while.
  • IP addresses are not stored; the proxy deletes them from its logs.
  • The login gateway's administration console cannot be reached from the internet.
  • Access keys are kept in locked folders on the server.
  • Sorkia's off-site backups are encrypted before they leave the server. OVH's daily whole-disk copy stays with OVH in Canada and is not encrypted by Sorkia.
  • Operating-system security updates are installed every day.
  • Only NMT administers the server.
  • Individual answers, network information and direct chats are accessed only by NMT and the state's automated accounts.

13. United States

13.1 The California Consumer Privacy Act applies to a "business" that is operated for profit and meets size thresholds (Cal. Civ. Code §1798.140(d)). Sorkia is a non-profit personal project, so it does not apply.

13.2 COPPA does not apply: Sorkia is not directed to children and is not operated for commercial purposes.

14. Changes to this policy

14.1 Each version of this policy is posted on sorkia.org with its date and version number.

14.2 When a change needs your consent under the law, Sorkia asks for it before the change applies to you.

15. Language

This policy is written in English. The Korean text is a full translation. If they differ, the English text prevails, without taking away any protection that the law of the country or state where you live gives you.

16. Contact

Need More Truth (NMT), Sorkia — contact@sorkia.org