What we know about you. It is a short list.

• ✓ No advertising, no ad trackers, and nothing sold or shared for marketing.
• ✓ Two cookies exist. Both are needed for the site to work, so there is no cookie banner to dismiss.
• ✓ Survey answers are stored without a name, email or IP address.
• ✓ Accounts hold a name, a work email and a password we can’t read.

We store your answer to each statement (a number from 1 to 5), anything you write in a comment box, the department and time-here band if you choose them, and the time you submitted. We do not store your name, your email address or your IP address with a response, and the survey link is the same for everyone at your company.

Your employer sees nothing but a count of responses until the survey closes, and after that only totals, and only if at least 5 people answered. A department or time-here band with fewer than 5 responses is never broken out. The rules are set out in the methodology.

Comments are the exception to “totals”: they are shown to your employer word for word, in alphabetical order. If you write something in a comment that identifies you, it identifies you.

Because a response isn’t tied to a person, we can’t find yours afterwards to show it to you, change it or delete it. Your employer can delete a whole survey, which deletes every response to it.

We store your name, your work email address, your password as a one-way hash (we can’t read it), and what you tell us about the company: its name, headcount, industry, location, departments and description. We also store the surveys you create, their results, and the date of a pinky promise if you made one.

We email you to confirm your address and when you ask to reset your password. There is no newsletter and no marketing email.

If you turn on public listing, the company’s name, industry, location, headcount, description, certification result and the domain of your email address (the part after the @) appear on The List. Your name and full email address are never shown. Listing is off until you turn it on, and you can turn it off again.

Page views on the public pages are counted with Umami, a privacy-focused analytics service. It sets no cookies and does not follow you between sites. It records the page, the referring site, and details such as your browser, device type and country. It is not loaded on survey pages or inside the dashboard.

To slow down password guessing and spam, signing up, a failed sign-in, asking for an emailed link and using the contact form each leave a short-lived entry identified by a one-way hash of your network address or email address, or by your account. The network address itself is not stored. These entries stop counting after 15 minutes and are cleared out afterwards. Answering a survey records none of this.

A message sent through the contact form is emailed to the person who runs this site, along with the name and email address if you gave them. It isn’t saved in our database; it lives in that inbox.

There are two, both first-party and both strictly necessary for something you asked the site to do. Neither is used for analytics or advertising, which is why you were not asked to accept anything.

• tw_session30 days, or until you sign out

  Set when you sign in to an account. Keeps you signed in. Holds a random token and nothing else.

• tw_done_…120 days

  Set when you submit a survey. Remembers that this browser has answered that survey, so it isn’t answered twice. Holds the value “1”, and no answers.

We use four companies to run the site. They process data on our behalf and only to provide their service.

• VercelHosts the site. Like any web host, it keeps request logs that include IP addresses for a limited time.
• TursoHosts the database: accounts, surveys and responses.
• ResendDelivers our emails: address confirmation, password resets, and messages from the contact form.
• UmamiCounts page views on the public pages, without cookies.

These providers may process data in the United States and other countries where they operate. We don’t sell personal data, and we don’t pass it to anyone else unless the law requires it.

Account and company details are kept until you ask us to delete the account. Surveys and their responses are kept until the account holder deletes the survey or the account is deleted. Sign-in sessions expire after 30 days. Emailed links expire after 7 days (confirmation) or 60 minutes (password reset).

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account and everything in it. Use the contact form and leave the email address the account uses. A person will answer, within 30 days.

If you are in the EU or the UK: we rely on our agreement with you to run your account, and on our legitimate interest in keeping the site secure and knowing roughly how many people visit it. You also have the right to complain to your data protection authority.

This site is for people at work. It isn’t meant for children, and we don’t knowingly collect data from them.

If what we collect changes, this page changes first and the date at the top moves. Tolerable Workplace™ is run by one person; the contact form reaches them.