VOICE · TRUST

Anonymity & Data

In Voice, we aim to protect organizers and respondents not with promises but with a design that never links or hands over who they are. This page describes only what actually runs today. What we can't do yet is listed under “Limits” at the end.

1. What we collect and what we don't

Organizers
Information	How it's handled
The call (title, description, spec summary, purpose, price bands, period, questions)	Collected. Published on the call page once approved.
Who can see the results (public / private)	Collected. You must choose when applying.
Name and affiliation	Optional. Stored only if entered, and seen only by the operator for review. Never shown on the site.
Contact email	Optional. Seen only by the operator and used only to tell you the review outcome and to resend your management link. Deleted automatically 30 days after the call ends.
Secret management link	The link itself is not stored — only a hash (SHA-256) used to check it.
Site account or Google account details	Not collected. Applying needs no sign-in, and even if you are signed in, the call is not linked to your account.
IP address	Not stored by the site's app (for hosting providers' records, see “Limits”).
Time of application	Recorded for review, but not shown on public pages.

Respondents
Information	How it's handled
Your answers (status, how much you want it, price band, additional questions)	Collected. Organizers receive aggregated results only.
Optional details (age group, gender, region, current car brand and segment, next purchase timing, budget, household, annual distance driven)	Only the items the organizer chose are asked, and every one is optional (“Prefer not to say” is available). Used only in aggregate and stored with each response — never on a profile, and never taken from your Google account.
Remembering your previous details	Off by default. Only if you turn on “Remember my answers on this device” are they saved in your browser (localStorage) and filled in next time. They are not stored on our server. Turning it off deletes them immediately.
The email and Google user ID you sign in with	Kept only within the sign-in system (Supabase Auth). Never published alongside your answers or shared with call organizers or any other company.
Google name and profile picture	Not stored. Even if Google sends them at sign-in, they are removed before saving.
IP address and browser details while signed in	Recorded by the sign-in system to manage sign-in sessions. Not available on the site or through its API, and never given to organizers.
Time and language of your response	Recorded, but not included in the results given to organizers.
Model Voice answers	Answers sent from a model's Voice page or from a Benchmark compare page are tallied as one dataset and the aggregated results are shown on both. Figures for models or groups with fewer than 5 respondents are not shown. Free text is published with contact details masked, and isn't linked to when it was sent or to other answers.

2. Who can see what

For each role: what they can see (check mark) and cannot see (lock).

Organizer
- The call itself (title, description, questions)Can see
- Who posted the callOnly their own
- Respondents' names and emailsCannot see
- Individual responsesCannot see
- Aggregated resultsCan see
- Breakdowns or filters with fewer than 5 peopleCannot see
- Free-text answersCan see, with contact details masked
Respondent
- The call itself (title, description, questions)Can see
- Who posted the callCannot see
- Respondents' names and emailsOnly their own
- Individual responsesOnly their own
- Aggregated resultsOnly for calls with public results
- Breakdowns or filters with fewer than 5 peopleCannot see
- Free-text answersOnly their own
Visitor
- The call itself (title, description, questions)Can see
- Who posted the callCannot see
- Respondents' names and emailsCannot see
- Individual responsesCannot see
- Aggregated resultsOnly for calls with public results
- Breakdowns or filters with fewer than 5 peopleCannot see
- Free-text answersCannot see
Operator
- The call itself (title, description, questions)Can see
- Who posted the callCannot see *
- Respondents' names and emailsCannot see *
- Individual responsesCan see
- Aggregated resultsCan see
- Breakdowns or filters with fewer than 5 peopleCan see
- Free-text answersCan see
* Who posted the call: Calls need no sign-in and are not linked to any account. The operator sees a name, affiliation or contact email only if the organizer chose to enter one.
* Respondents' names and emails: Not visible on the site or through its API. However, the email you sign in with is kept in the sign-in system (Supabase Auth) and can be accessed with database admin rights. Google names and profile pictures are not stored.

3. How data flows

Organizer
Applies (no sign-in) → Secret management link: The link itself is not stored — only its hash
Call
Published after the operator checks it against the terms. Its URL uses a random ID
Respondent
Answers after signing in with Google (one answer per person). Answers are linked to an internal account ID. Google names and pictures are not stored
Aggregation (computed inside the database)
Nothing shown under 5 respondents / groups and attribute filters under 5 hidden / no free text while filtering / contact details in free text masked
Calls with “Public results”
→ Anyone can see the aggregated results (no free text)
Calls with “Private results”
→ Only the organizer, via the secret link

4. Groups under 5 are not shown

Example: the share who answered 4 or 5 to “How much would you want this car?”, by respondent status

Currently shopping12 people · 58%
Considered but passedCount hidden
Hidden to protect another group
Current ownerCount hidden
Hidden: too few respondents
Just interestedCount hidden
Hidden: too few respondents

Groups with fewer than 5 respondents (here, 3 owners and 1 “just interested”) show neither a count nor a share.
If the hidden groups add up to fewer than 5 people, they could be worked out by subtracting the visible groups from the total. So the next smallest group (here, “considered but passed”) is hidden too.
Until at least 5 people have responded overall, no results are shown at all.
The same applies to attribute filters. Filtered results are hidden if fewer than 5 people match, or if removing one condition changes the count by 1–4 (e.g., if “shopping, in their 30s” is 5 and “shopping” is 6, that one person could be singled out). Free-text answers are not shown while filtering.
This happens inside the database before results are sent to the organizer. Hidden numbers never reach the organizer's browser.

5. The secret management link

When you finish applying, a management link containing a long, unguessable token (256 bits) is shown once. With it you can check the review status, response count and results, close the call, or withdraw it.
The database stores only a hash of the link, not the link itself. So the operator can't look up your link and tell you what it is.
If you lose the link, the operator can't verify who you are — they don't know — so they can't hand it back to you. If you gave a contact email when applying, the operator can issue a new link and send it to that address. Issuing a new link disables the old one.
The token sits after the “#” in the URL. Browsers never send that part to the server, so it doesn't appear in access logs when you open the page (management actions send it to the server in the request body). The management page doesn't load ads (Google AdSense), and it removes the token from the address bar as soon as it opens.
Anyone who has the link can manage the call. Don't share it.
Only if you choose, the management link can be saved in a cookie in this browser so the “Your calls” page lists each call's status and response count. The cookie is HttpOnly (scripts and ads on the page can't read it), is sent only to this site, and is never stored in our database. The “Your calls” page doesn't load ads and never shows the token on screen or in the URL. Don't save it on a shared computer.

6. How long we keep data

How long we keep data
Data	Retention and deletion
Call content, questions and responses	Kept until the operator deletes them, even after the call ends or is withdrawn. Contact us below to request deletion.
Contact email (optional)	Deleted automatically 30 days after the call ends (the end date, or the day it was closed, withdrawn, rejected or taken down), by a daily job. Kept while under review.
Name and affiliation (optional)	Kept as long as the call's data.
Hash of the management link	Kept as long as the call's data. Replaced when a new link is issued.
Your own response	Respondents can delete their response at any time from the call page.
Sign-in details (email and Google user ID)	Kept until the account is deleted. You can request account deletion through the contact below. Deleting an account also deletes its responses.
Hosting providers' records	Kept according to each provider's retention (see “Limits”).

7. What the operator does not do

The operator does not try to find out who posted a call. Because calls are never linked to accounts, the operator has no way to know, apart from anything entered in the optional fields.
Calls the operator posts itself are labeled as such: the call page, the call list and the top-page card show “Posted by the operator”. All other calls show “Anonymous organizer”.
The operator does not give data individually or preferentially to any company or organization, including any company the operator is connected with. Organizers receive only the aggregated results of their own calls.
The operator does not sell data.
The operator does not store respondents' Google names or profile pictures, and never publishes the email you sign in with alongside your answers or shares it with organizers or any other company.
The operator never gives individual responses to organizers.

8. Deletion requests and contact

Withdrawing a call: do it any time from your management link.
Deleting a call's data: after withdrawing, send us the call's URL (or the management link). We confirm it has been withdrawn through the management link before deleting.
Deleting your own response: do it from the call page.
Deleting your account and anything else: contact us from the email you sign in with.

Contact: yutaiinfoshare@gmail.com

9. Limits (what we can't do yet, and records that remain)

Respondent status (owner, etc.) is self-reported. We don't verify ownership.
Hosting providers' systems may keep connection records for a period. Vercel (which serves the site) records IP addresses and similar details of requests; how long depends on Vercel's settings, and the operator has not confirmed the exact period. Supabase (database and sign-in) keeps API and sign-in logs (about one day on this site's plan). Signing in with Google also leaves a sign-in record at Google, under Google's policies.
Respondents still sign in with a Google account through Supabase's sign-in system. The email you sign in with is kept there, and because the operator has database admin rights, it is technically possible for the operator to match emails to responses. The operator does not do this.
We respond to legally based disclosure requests to the extent of the data we hold.
Results hide groups with fewer than 5 respondents, filters that match fewer than 5, and filters whose count differs from a broader filter by 1–4. Depending on the combination of demographics or what someone writes in free text, the risk of a respondent being guessed can't be removed entirely. Please don't write anything that identifies you in free-text answers.
To keep reviews from being swamped, applications are limited to 30 per hour across the site.

10. Measuring how the site is used

We use Vercel Web Analytics to measure page views only, without cookies. Clicks, input and answers are not recorded.
It records the page address (without anything after “?” or “#”), the referring site, country or region, and device and browser type. Views of the answer page and the answer-received page give us a rough count of answers started and finished. Those addresses contain only the call's public ID — nothing that identifies a respondent.
Pages that open secret links (management and review links), “Your calls”, and operator screens are not measured.
According to Vercel, visitors are counted with a value derived from the request that changes every day, and IP addresses themselves are not stored. The analytics records can't reveal who answered what.