Privacy

What is collected

Once per cycle, each person answers short sliders on their phone: how well connections between groups work, one or two inner-state items such as energy and safety, the share of their time that reaches the people who judge the result, and whether the project’s goal is understood and should change. Optionally, who they asked for help. Any question can be answered with “can’t judge”, and comments are optional.

Nothing is read from calendars, chat, email or code.

Who sees what

• Results are per team and per group, always with the number of people behind them, and open only after the check-in closes. There is no screen, export or API that returns one person’s answers, and a property test in the code checks that no answer is ever joined to a name.
• Small groups. A person who is alone in their group is told, before answering, that their group’s results will be their own answers.
• No scores on people. No combined “health” score, no ranking, no red, amber and green.
• The cooperation network (who asked whom for help) is optional and is not drawn for teams under five people. A name appears on it only if that person consents in their own questionnaire, and only admins see names. Consent can be withdrawn at any time.
• Respondents see the same team results as the admin, through their own link.

What leaves your server

Self-hosted, nothing does, unless the operator switches on one of two optional services:

• Retro questions by Claude (ANTHROPIC_API_KEY). The model receives group-level numbers and comments with names removed, and writes questions for the team’s retrospective, never verdicts. Every request is logged on your server.
• Email invitations through Resend (RESEND_API_KEY). Resend receives each person’s name, email address and personal link, never any answer.

The licence key is checked offline. There is no phone-home and no telemetry.

Keeping and deleting

Data stays in your database for as long as your policy says. Deleting a person deletes everything they answered; deleting a team deletes the team.

Works council or employee representatives involved? See Gyrator for works councils.