Privacy in practice

What is stored when you answer

Your answers, any files you attached, the language you answered in, and the moment you submitted. That is the substance of it.

Alongside those, two technical details are kept for protection rather than analysis: a scrambled, one-way version of your network address (used to stop the same person answering twice where a survey allows one response, and to trace abuse in our security logs), and your browser's identification string. The real address is never written down — it is passed only to Cloudflare for the automatic bot check.

Measuring how the dashboard is used

Inside the signed-in dashboard we measure how the product is used — the pages visited and the buttons and links pressed — so we can see which parts help and which are getting in the way. It is used to improve the product and for nothing else.

This never runs on a public survey. If you are answering a survey, none of it applies to you: no analytics or advertising tracking loads on the page you are on. The measuring happens only in the dashboard and its sign-in screens, which only a workspace's own staff use — and they agree to it when they sign up or sign in. What a survey page does load is described under What is never done.

• What is recorded is the page visited, the buttons and links used, errors, and coarse technical detail — a page address, roughly where in the world the request came from, and the kind of device.
• Not the contents of a survey, an answer, a contact, or a file — it is not set up to read them. The one thing to know: a click records the label of what was clicked, and a link's label can be, for example, a survey's name.
• Never sold, never shared with advertisers, and never used to follow anyone across other websites.

Three services do the counting: Vercel Web Analytics, which stores nothing on your device; PostHog, which sets a cookie and keeps the account's name and email with what it records; and — where the platform's operator has switched it on — Google Analytics, which also sets a cookie. All three are listed as sub-processors. This help centre and the rest of the public website are measured separately, and only if a visitor accepts in the cookie notice — the Privacy Policy has the detail.

What is never done

• Your data is never sold or rented.
• There are no adverts anywhere on the platform.
• A survey you fill in is never measured for analytics or advertising. No analytics and no cross-site tracking run on a public survey page. Two services do load there: Cloudflare's bot check, and error monitoring (Sentry), which can record a replay of the page with every piece of text and every input hidden, to diagnose faults. Each submission is also counted against the workspace that owns the survey — without its answers or your address.
• Nothing measured anywhere is used to build a profile of you, to target advertising, or to follow you onto another website.
• A public survey sets one cookie only if you switch its language, to remember your choice, and notes in your browser that you have already answered. Elsewhere, cookies keep staff signed in, remember which sign-in method was used last, and remember language and display preferences. Measurement cookies are set only in the dashboard — account holders agree to them when they sign in — and on this website only if you accept them.

If a survey asks for your contact details

Some surveys ask for your name, email address or phone number. Those answers are saved twice: once with the rest of your response, and once in a contact list the team can search — so they can reach you about the survey you answered.

• We never use your contact details for marketing. The team that ran the survey can message you through the platform about it, and what they do with a list they export is governed by their own privacy notice.
• They are never sold, rented or passed to anyone outside the team for their own use.
• Everyone on the workspace's team can see the list; only members, admins and the owner can export it, and every export is recorded.
• Deleting your response deletes the contact entry it created.

Who can see your answers

• Signed-in staff with a role that permits it. Nobody else — a survey link lets you *answer*, never *read*.
• While you are answering, you can preview what you uploaded through its own private link. Once you submit, the file is part of your response and only a signed-in member of the survey's workspace can open it — each download lasts five minutes.
• Every export of responses out of the platform is recorded with who ran it and when, in an activity log kept for 30 days.

How submissions are protected

• Bot protection. Every submission passes an invisible check from Cloudflare Turnstile — no puzzles, no advertising cookies.
• Encryption in transit. Everything travels over HTTPS.
• Passwords are never stored as text. They are hashed, and passkeys keep the secret on your own device.

Asking for your data

You can ask to see, correct or delete the responses you submitted. Contact the team that shared the survey with you — they can edit or delete a response. Responses are kept until the team that owns the survey deletes them.

The binding version of all of this is the Privacy Policy, alongside the Terms of Use.