Data protection & participant privacy

Last reviewed: October 10, 2026

ThisStudy is a survey platform for academic research. This page describes, in plain terms, what happens to the data participants provide — so researchers can describe it accurately in consent forms, and participants can check it for themselves. It is a factual description of how the platform works, not a legal document.

What is collected automatically

When someone takes a survey, the platform records:

• Their answers, with timestamps and per-page timing (used for data-quality checks, such as detecting inattentive responding), and how many times the session timed out through inactivity and was continued.
• Coarse interaction measurements, used for the same data-quality checks: whether text was typed or pasted and how many characters of each, how long was spent actively typing, how long it took to first click or press a key on a page, counts of clicks, key presses, copy events and times the survey tab lost focus, how many of those key presses and pastes happened while the tab was in the background, how long the tab spent hidden, a count of how often the pointer moved (sampled at most ten times a second — how often, never where), how many answers arrived in a field without any typing in it first (autofill, a password manager, or dictation), and the automation indicators the browser itself reports (navigator.webdriver, and whether answer fields were set by a script rather than typed). These are counts, durations, and yes/no values only. Measurement begins as soon as a survey page loads, including the consent page.
• Coarse device information: device type (desktop, mobile or tablet; "bot" when the browser identifies itself as automated software, and "unknown" when it cannot be told), browser family, and operating system family. These are derived from the browser's user-agent string, which is itself discarded, never stored.
• Two one-way codes derived from the IP address. The IP address itself is never stored or written to logs. Before anything is saved, the address is put through a salted cryptographic hash (SHA-256) and truncated. One code is made from the full address. The other is made from only its network part (the first three blocks of an IPv4 address, or the first three groups of an IPv6 one), so participants connecting from the same network, such as one household, office or campus, share that code. Both are used only to detect duplicate or automated responding, and neither can be converted back into the IP address. Whether the address was IPv4 or IPv6 is also kept.
• A coarse network category derived from the IP address: whether the connection is a home/business internet provider, a mobile carrier, or a datacenter/VPN. This category is used to spot automated or masked responses. Like the device information, it is derived at the moment of collection and only the category is kept — the IP address itself is still never stored, and the category is not a location.

The platform does not collect names, email addresses, location, or anything else from participants' devices. It never records what was typed key-by-key or which keys were pressed, mouse positions or paths, screen contents, or clipboard contents — when text is pasted, only its length is measured; the pasted text itself is never stored or sent anywhere, and copying is counted, never captured. Nothing is recorded outside the survey page. Participants never create accounts. Survey pages contain no analytics, advertising, or third-party tracking scripts. The fonts, styles and scripts a survey page uses are served by the platform itself, not fetched from another company.

Media a researcher adds from elsewhere is the exception. A study can show an image, a logo or a video file hosted on another site, or a video embedded from YouTube, Vimeo or Loom. The participant's browser fetches that media from its host, so the host receives the participant's IP address and the usual details a browser sends with any request, and may set cookies of its own.

Cookies

Survey pages set one cookie: a session cookie containing only a random identifier, used to keep a participant's place in the survey and to protect against request forgery. It is HTTPS-only, inaccessible to page scripts, and expires after one hour of inactivity. The platform sets no third-party cookies. Media a researcher adds from another site, described above, comes from that site, which may set cookies of its own.

Where data lives and how it moves

All traffic between participants and the platform is encrypted in transit (HTTPS, with HSTS enforced). It reaches the platform through Cloudflare's network, which stands in front of the hosting provider and filters out attacks. As with any website's network providers, Cloudflare and the hosting provider process each request in order to deliver it: they see the visitor's IP address, and the contents of the request pass through their systems on the way. What the platform itself keeps of the IP address is described above, under what is collected automatically. Responses are stored in a PostgreSQL database hosted by Render, a cloud provider that encrypts data at rest and is SOC 2 Type II certified; Render's own security practices are documented on its Security and Trust page. Within that encrypted database, responses are stored in readable form — the platform does not add a second layer of application-level encryption. In practical terms: data is protected from interception and from unauthorized access, but someone with legitimate database access (see below) can read responses, as on virtually every survey platform.

Who can see responses

Only the study's owner — the researcher who created it, or a researcher it has since been transferred to — and its collaborators: researchers an owner has explicitly shared it with, and a previous owner who stayed on after a transfer. A platform administrator who is not one of these can open a study only through a time-limited grant that is recorded in an audit log, used for support and moderation. An administrator can also move a study to a different account (for example when its owner has left the institution). They can move it to their own account only when the platform has no other administrator who could make the move. Either way, the move takes effect at once, is recorded in the same audit log with the reason given, and both researchers are emailed. ThisStudy itself never sells participants' data, shares it with third parties, or uses it for any purpose other than running the study. Researchers with access to a study can export its responses, and what happens to an exported file is outside the platform's control.

Deletion

When a researcher deletes a single participant's data, all participants' data, or an entire study, the data leaves the study at once and is held in a restorable trash for 30 days. After that it is permanently erased within a day. Render retains short-term database backups for disaster recovery for 3–7 days, after which erased data is gone from backups as well.

A researcher can erase data from the trash straight away. This needs a code sent to their email, so that someone who has only their password cannot do it; for the same reason, no code is sent for 30 days after an account's email address changes. Researchers honouring a participant's request to have their data erased should use this option. Answers given before consent can also be discarded: those on pages before a study's consent page, and those on the consent page itself from anyone who did not go on to consent. That is permanent at once, not held in the trash, and needs the same emailed code.

If a study asks for identifying information

Researchers may choose to ask participants for identifying information (a name, an email address, a participant ID from a recruitment platform). The platform treats those answers like any other response: encrypted in transit, stored in the provider-encrypted database, open on the platform only to the people described under Who can see responses, and permanently deletable. But no internet-based system can guarantee absolute security, and this page makes no such guarantee. If your study collects identifying information, do not describe it as anonymous.

For researchers: consent-form language

Sentences you can adapt, consistent with how the platform actually works:

For studies collecting no identifying information:

"Responses are collected anonymously through ThisStudy, a survey platform that does not record names, email addresses, or IP addresses (IP addresses are irreversibly hashed for duplicate detection only)."

For studies collecting identifying information:

"Responses are collected through ThisStudy, a survey platform. Data are transmitted over an encrypted connection and stored in an encrypted, access-controlled database. As with any internet-based data collection, absolute security cannot be guaranteed."

These sentences describe the platform only. Who sees the data, what happens to it once it is exported, and how long it is kept are for you to describe in your own words.

If your study shows an image or a video hosted on another site, add a sentence saying so: that site receives the participant's IP address, which the first wording above does not cover.

Platform details: thisstudy.com/privacy