Privacy in practice

What is stored when you answer

Your answers, any files you attached, the language you answered in, and the moment you submitted. That is the substance of it.

Alongside those, two technical details are kept for protection rather than analysis: a scrambled, one-way version of your network address (used only to stop the same person answering twice where a survey allows one response), and your browser's identification string. The real address is never written down.

Measuring how the dashboard is used

Inside the signed-in dashboard we count page views, so we can see which parts of the product are used and which are getting in the way. It is used to improve the product and for nothing else.

This never runs on a public survey. If you are answering a survey, none of it applies to you: the page you are on loads no analytics at all. The counting happens only on /app pages, which only signed-in staff of a workspace ever see.

• What is recorded is the page visited and coarse technical detail — a page address, roughly where in the world the request came from, and the kind of device.
• Never the contents of a survey, an answer, a contact, or a file. Customer data does not enter this at all.
• Never sold, never shared with advertisers, and never used to follow anyone across other websites.

Two services do the counting: Vercel Web Analytics, which stores nothing on your device, and — where a workspace's operator has switched it on — Google Analytics, which does set a cookie. Both are listed as sub-processors, and both are confined to the dashboard.

What is never done

• Your data is never sold or rented.
• There are no adverts anywhere on the platform.
• A survey you fill in is never measured by anyone else. No analytics and no cross-site tracking run on a public survey page — not one script, not one request.
• Nothing measured anywhere is used to build a profile of you, to target advertising, or to follow you onto another website.
• The only cookies used are the ones that keep staff signed in and remember your language and display preferences.

If a survey asks for your contact details

Some surveys ask for your name, email address or phone number. Those answers are saved twice: once with the rest of your response, and once in a contact list the team can search — so they can reach you about the survey you answered.

• Your contact details are never used for marketing — no promotional messages, no mailing list.
• They are never sold, rented or passed to anyone outside the team for their own use.
• Only staff who need them can see the list, and every export of it is recorded.
• Deleting your response deletes the contact entry it created.

Who can see your answers

• Signed-in staff with a role that permits it. Nobody else — a survey link lets you *answer*, never *read*.
• Files are downloadable only through short-lived links generated for a signed-in staff member on the spot.
• Every export of responses out of the platform is recorded with the person's name and the time.

How submissions are protected

• Bot protection. Every submission passes an invisible check from Cloudflare Turnstile — no puzzles, no advertising cookies.
• Encryption in transit. Everything travels over HTTPS.
• Passwords are never stored as text. They are hashed, and passkeys keep the secret on your own device.

Asking for your data

You can ask to see, correct or delete the responses you submitted. Contact the team or programme that shared the survey with you. Responses are kept only as long as the programme they belong to needs them.

The binding version of all of this is the Privacy Policy, alongside the Terms of Use.