Privacy

Survex is built for honest answers in a room full of colleagues. That only works if anonymity is real, so this page describes exactly what we store — no more, no less.

If you answer a survey

• No account, no name, no email. You join with a short code. We never ask who you are.
• A random token instead of an identity. Your device keeps a random token for the session so a page refresh doesn’t lose your place. We store only a one-way hash of it — it cannot be traced back to you, and it lives only in your browser tab.
• Your answers and when they arrived. Nothing else is attached — no IP address, no browser fingerprint, no location.
• Small groups stay hidden. Results are withheld until enough people have answered (the facilitator sets the threshold, three by default), so a single early answer is never exposed.
• Abuse protection without identity. To rate-limit joins we briefly keep a salted hash of your network address — deliberately unlinkable to your answers — and purge it within 24 hours.
• Answers can expire. Facilitators can set raw answers to auto-delete after the session; only aggregate results remain.

If you run surveys

• Your email address, and that’s it. You sign in with a link we email you — there is no password to store, so none can leak.
• Your sessions are yours alone. Sessions, questions, and results are visible only to the account that created them. Results stay private to you unless you set a results password to share them — the join link participants use never opens results.
• Deleting means deleting. Deleted sessions are purged permanently after 30 days, along with all their answers.

Cookies

• Facilitators: sign-in session cookies and a last-activity timestamp that signs you out after 8 hours of inactivity.
• Results viewers: entering a results password sets a signed cookie for that one session, valid 24 hours.
• Participants: no cookies. No analytics or tracking cookies anywhere.

Where data lives

Data is stored in a managed Postgres database (Supabase) and served over HTTPS. Session pages are excluded from search engines. Aggregated results travel to the presenter screen over authenticated channels; individual answers never leave the server unaggregated, except in the facilitator’s own CSV export, where participants appear as anonymous numbers (P1, P2, …).

Questions

Ask the facilitator who invited you, or write to us — the answer to “do you store X?” should always be on this page.