Privacy, explained

Your answers stay on your device.

This page says what that means in practice. The formal policy is on the privacy page; this is the plain version.

What stays on your device

Every answer you type. The questionnaire runs in your browser; nothing is posted to a server while you type.
The preview and the PDF. Both are built in your browser from your answers. The fonts for the PDF are two static files loaded from this site, like an image.
The answers file you save. It is a plain file on your computer or phone. We never see it.
The “remember on this device” copy, if you switch it on. It lives in your browser’s storage until you erase it.

What leaves your device

The payment. Stripe receives your email address, billing country and payment details, as it would in any online shop. It does not receive your answers. Your email is used to send you the unlock link or the download link.
The unlock check. When you open an unlock link, your browser sends the unlock code (a signed reference to your purchase) to our server, which answers “valid” or “not valid”. Nothing else is in that request.
A visit count. A small script counts page views on all our sites: the page path, the time and a non-reversible daily identifier. It sets no cookie, builds no profile and never sees form contents. It is the same counter we use on every site we run.
Ordinary hosting logs. Our host keeps short-lived server logs (IP address, time, page) for security.

How we check this

Before each release an automated test fills the organizer with unique made-up answers, previews, exports and unlocks, while recording every network request the page makes. The test fails if any of those answers appears in any request. It also fails if the organizer code contains any network call other than the unlock check and the font files.

What you can do

Use a private device, not a shared or public computer, and leave “remember on this device” off on anything shared.
Keep the answers file and the printed folder with your other private papers.
On the last step of the organizer, “Erase everything stored on this device” removes answers, the remember setting and the unlock from that browser. Files you already downloaded are yours and stay where you put them.

What we cannot do

Recover an answers file you lost, read your folder, or reset a password: there is none. Support can only help with the site, the payment and the download or unlock link, and will never ask you to send your folder.

Formal details: privacy policy · legal notice.

Why is the answers file not encrypted?: Because an encrypted file needs a password, and a lost password would mean a lost folder with no way back. We chose no password on purpose. The file holds the same information as the printed folder; keep it the same way.
Does the unlock link contain my answers?: No. It contains a signed reference to your purchase and an expiry date, nothing else. Anyone with the link could unlock the clean export on their device, so keep the email as you would a receipt.
Can you see what I typed if something goes wrong?: No. Error reports, if any, contain no form contents. If you write to support, please describe the problem with made-up data.