1. The promise
Nobody sees your answers. Not your school, not your boss, not your family, not us. We count how many people tap each topic. We never know who tapped what.
That sentence is mechanically true, not true as policy. It is not true because we would never look: it is true because the system cannot produce the information. What follows explains how.
2. The two planes
Data lives in two separate databases, on separate instances, with separate credentials. No service in the system has access to both.
- The signal plane is anonymous: how many people tapped each topic, at which site, in which language, in which hour.
- The contact plane identifies: only the people who deliberately asked to be contacted, and only what those people wrote.
There is no foreign key between them, no shared identifier beyond the organisation identifier, and no timestamp precise enough to correlate a submission with a tap. Someone with full read access to both databases could not join them.
3. What anonymous use stores
Each event carries six fields and nothing else:
- The organisation.
- The site or campus.
- The audience pack.
- The topic or mood that was tapped.
- The hour, truncated — never finer than that.
- The language.
It never carries: session identifier, device identifier, cookie, IP address in any form — not even hashed — user agent, browser fingerprint, sequence number, anything linking two events to each other, free text, or precise timestamps.
The test: two taps by the same person in one session are indistinguishable from two taps by two different people. If they could be told apart, the schema would be wrong.
4. What asking for contact stores
Only if the person chooses to ask. What they wrote — their name, their preferred way of being contacted, and their message — is stored encrypted, in the separate database, and delivered only to the recipient the organisation configured.
That information never enters analytics, never appears on a dashboard, never enters an aggregate. It is not visible to the organisation’s leadership: it is visible to the person designated to respond.
It is retained for the retention period the organisation configures and is then automatically purged.
Before typing anything — not afterwards — the person reads that the adults who receive the message may be legally required to act if what they share means a child is unsafe.
5. Crisis topics are not recorded
When someone taps a topic flagged as crisis, no record is written. Not anonymously, not aggregated, not counted. Help appears immediately, ahead of any other flow.
The organisation never sees how many times it happened, and that is deliberate. A leader’s dashboard is worth less than one person’s belief that tapping that button was safe.
6. Small groups
Results below a minimum group size are not shown. The default minimum is ten and it can be raised, never lowered — including by us. When a result is suppressed, the interface says so; it does not show a zero.
Dimension combinations that could re-identify someone are refused rather than silently rolled up. Suppression is enforced in the query layer, so a badly written dashboard gets a refusal, not a leak.
Small groups are where re-identification happens: a shift of eight, a department of four. Those are exactly the people who most need to trust this.
7. No cookies and no trackers
The public experience uses no cookies, requires no account, has no consent wall, and contains no third-party script of any kind: no analytics, no session replay, no advertising pixel, no external webfont. They are not “switched off”: they are not present, and continuous integration fails the build if anyone adds one.
This marketing site is a separate deployment from the public experience. It has no analytics today either. It stores one preference in your browser — the language you chose — which never leaves your device.
8. Who can see what
- Organisation leadership sees suppressed aggregates. Never individuals, never free text, never anything crisis-related.
- The referral recipient the organisation designated sees the submissions routed to them, and only those.
- Our staff access the contact plane only for operational necessity, with an audit record. We cannot see the signal plane at an individual level because no such level exists.
9. Minors
Where the Service is made available to minors, the organisation is responsible for obtaining any authorisation, notice, or consent its jurisdiction requires before deployment. In Texas, if an instrument is considered screening administered to minors on an institutionally branded page, Texas Education Code §26.009 may require parental consent.
Anonymous use collects nothing identifying about a minor, because it collects nothing identifying about anyone.
10. Requests about your data
If you sent a request for contact and want it deleted, write to the organisation that provides the service or to us, and we will purge it. If you know which recipient it went to, tell us: it speeds up locating it.
We cannot locate, produce, or delete your anonymous use — not because we decline, but because there is nothing associating it with you. That is the same property that stops your organisation from identifying you.
11. Security
Contact data is encrypted at rest at the field level with per-plane keys, transmitted over encrypted channels, and backed up with separate keys per plane, so that a backup system does not reunite what the architecture separated.
Every query is parameterised, every input is validated at the boundary, and public routes log no request bodies and no IP addresses anywhere.
12. Changes to this notice
If we change this notice, we will publish the new effective date. No change may weaken the promise in section 1: if something ever conflicts with it, the something changes.