Privacy

The Survey Validator and the Survey Analyzer are built around specific privacy commitments. None of them claim end-to-end privacy — that's not something any third-party tool can deliver. They describe what the two apps do and don't do, so you can decide whether the tradeoff fits your survey and your data.

What the Survey Validator does

• Processes the survey content you submit (question text and response scales) by sending it to Anthropic's Claude API and OpenAI's GPT-5.5 API for analysis.
• Returns a structured validation report, an AI-revised version of your survey, and a Word (.docx) export with a methodology appendix documenting design decisions.
• All output files exist on the server only for the duration of your browser session and are deleted there when the session ends.

What the Survey Analyzer does

• Reads the response file you upload and analyses it inside the app. Everything that doesn't use AI (response quality, scale reliability, groupings, group differences, sentiment and topics in written comments) runs there and sends nothing to an AI provider.
• The AI features, which you start yourself, send computed results to the AI provider selected in the app (Anthropic, OpenAI or Google): averages, reliability figures, factor loadings, sentiment scores, response counts, topic word lists, and your survey and question names. Ask a question also sends the question you type. These features never send your uploaded table or individual people's answers.
• One feature sends written comments themselves: asking the AI to explain why a question scored low sends the comments that share its words, with email addresses and phone numbers taken out. Names people wrote inside their comments are not removed. The app asks you to confirm before each send.
• The app asks for your consent before its first AI request in each session. Please don't upload data containing personal identifiers.
• Your uploaded file, the analysis and the report or slides you download exist on the server only for your browser session.

What we keep

• Questions asked in the Analyzer. Questions you ask with Ask a question, and the answers, are saved on the app's server with the survey name, so you can look back at them. They are tied to your PIN: anyone signed in with the same PIN (for example, a colleague you share it with) can see them, and no one else can. You can delete any of them in the app.
• The Validator's AI assessments. The AI's assessment of each question is kept on the app server for up to 30 days, so that checking the same survey again gives the same score instead of drifting by a few points. It is filed under a one-way fingerprint of the survey, is not linked to your PIN or email, and is deleted after 30 days or when the app is redeployed.
• Usage records. For each AI request, both apps record the date, the feature used, the amount of AI processing and its cost, against your PIN. The Validator also records a fingerprint (a one-way hash) of the survey's question text, which can't be turned back into the questions. These records hold no survey content and no response data.
• Access dates. The start and end date of each six-month term on your PIN.

What your browser keeps

• Your last survey, so you can pick up where you left off. If the connection drops (a long break, a laptop going to sleep), the app's session ends. So each app keeps an encrypted copy of your last survey and its results in your browser's storage for 7 days: for the Validator, your questions, the results and your changes; for the Analyzer, the responses as loaded (comments included), the AI reads, the report, the slides and your questions and answers. When you next sign in on that browser, the app offers to continue. Only the app, with your PIN, can open the copy. It is replaced by your next survey and deleted when you choose Start a new survey, after 7 days, or when you clear this site's data in your browser. A private window keeps nothing after you close it.

What the apps do not do

• No copy of your survey as you wrote it, or of your response data, is kept on our side after your session, and there is no survey history. (The exceptions are the Validator's AI assessments, above, and the encrypted copy in your own browser.)
• No user accounts beyond a simple PIN; no separate password.
• No analytics or behavioural tracking added by us.
• No publication, redistribution, or sharing of your survey content or results. Your downloads are yours alone.

What happens at the AI providers

• Whatever an AI feature sends goes to Anthropic, OpenAI or Google (whichever is in use) for processing.
• Under their stated commercial API terms, these providers don't use API content to train their models, and keep it for a limited period (about 30 days for Anthropic and OpenAI) for trust-and-safety review.
• During that window the data exists on their servers under their access controls.

About hosting

• Both apps run on shinyapps.io, operated by Posit.
• This marketing site is hosted on Cloudflare Pages.
• Both keep standard operational logs (IP, timestamp, request) as part of normal hosting. We don't control these logs.
• Neither, by default, injects behavioural tracking into deployed apps.

Legal jurisdiction (CLOUD Act)

• Anthropic, OpenAI, Google, Posit, Cloudflare, and Stripe are US-headquartered companies. The US CLOUD Act allows US authorities to compel disclosure from US companies regardless of where the data is physically stored — including Canadian servers.
• Low probability but a real category, and it applies to any US cloud provider.

Confidentiality and research ethics — the contractual layer

• NDAs and client agreements covering a survey or its results often forbid sharing with any third party — an AI provider counts as a third party even if it deletes the data in 30 days and doesn't train on it.
• Research ethics approvals (IRB / REB) and consent forms may limit who can process participants' responses. Check yours before using the Analyzer's AI features on research data.
• The breach happens the moment the data crosses to the third party, regardless of what the third party then does with it.

What the apps do and don't remove

• Removed: email addresses and phone numbers in comments sent for an AI explanation.
• Not removed: names, places, job titles, or other details people wrote in their comments, and anything identifying in your survey or question names.
• For high-sensitivity data, use the features that don't send anything, or remove identifying details before you upload.

Email handling for paid accounts

• When you purchase a PIN, your email is stored as the contact reference for that PIN. We use it to deliver the PIN, to match renewals and top-ups to it, and to email you about account issues if needed.
• Your email is not stored with a name or a password. You sign in with your email and PIN; the PIN is the only secret.
• Your email is not sold, passed, exchanged, or shared with any other party for marketing, analytics, or any other purpose.

Where PIN, email and usage records live

• PINs (stored only as a one-way hash), contact emails, access dates and usage records are kept in a private Google Sheet accessible only to the service administrator via a service account.
• Like the other providers above, Google is a US-headquartered company subject to the same legal jurisdiction considerations described earlier on this page.
• Standard Google access controls apply. We do not add additional safeguards beyond those.

Payment processing (Stripe)

• Payment is processed by Stripe. We never see your full credit-card details — Stripe handles the entire payment flow.
• Stripe collects billing information per their own privacy policy: stripe.com/privacy.
• We receive only the email address you supply at checkout (used to deliver your PIN, or to find it for a renewal or top-up) and a confirmation that the charge succeeded.

Last updated 2026-10-23.