How We Handle Your Data

What is encrypted, and what isn't

Your recording is never stored. It is held in memory, sent for transcription, and discarded — there is no audio file to encrypt, and no audio column in our database. What we keep is the text.

Beyond that we would rather be exact than reassuring:

• •Everything between your browser and this site travels over HTTPS.
• •The private keys to the Solana wallets holding reward money are encrypted with AES-256-GCM before they are stored.
• •Transcripts and campaign details are stored as ordinary rows in our database, protected by our hosting provider's encryption at rest rather than by a separate layer of our own. We don't describe this as end-to-end encryption, because it isn't.

Threshold Privacy Model

Individual responses are never released until your campaign reaches its minimum response threshold (at least 50% of participants). This prevents any single response from being isolated or attributed to a specific individual.

• •Responses remain locked until threshold is met
• •No way to identify which participant gave which response
• •Designed for situations where anonymity enables honesty

Automatic Data Deletion

Thirty days after a campaign completes, a job erases what it holds about the people in it. Here is the actual list, so you can hold us to it:

• •Response transcripts and the AI summary built from them
• •The delivery record for every message sent, including the recipient's address and the copy of the message itself
• •Any email addresses left with us by open-link respondents, and the IP and device fingerprints used to stop one person answering twice

Three things deliberately survive. Invite records stay, but an invite only ever held a one-way hash of an address, never the address. Payout records stay, because they are the audit trail for money that moved. And the fact that a message was sent stays, with its contents erased, so nobody can be sent the same invitation twice.

Your recording is deleted far sooner than any of this — it is never written down at all. Database backups are a separate matter and roll off on their own schedule, so a copy can briefly outlive the deletion above.

Email List Privacy

We never share or sell your list, and we never use it to market anything. The addresses you upload are used to send your invitations and for nothing else.

• •The list you upload is deleted as soon as every invitation has been queued — not 30 days later
• •The one exception is your choice: at launch you can tick "save this list to my account" — off by default — to keep it as a named cohort for next time. A saved cohort stays until you delete it or remove people from it, and anyone who has unsubscribed is never sent to, saved or not
• •The delivery record keeps each address until the campaign's 30-day deletion, because that is what lets us tell you whether a message actually arrived
• •Anyone can unsubscribe from the link in the invitation. We record it against a hash of their address and never send to them again — on your campaigns or anyone else's

Unclaimed Rewards

Rewards that participants do not claim belong to the person who ran the campaign, not to us.

• •Participants have 30 days after the campaign ends to claim, and are told the date when they finish the survey
• •When the claim window closes, whatever is unclaimed is sent back automatically to the refund wallet the campaign owner gave when funding it
• •We never move unclaimed rewards into our own treasury