Privacy and data handling
This guide summarizes how the platform stores and protects participant data, so you can describe it accurately to your participants and your ethics board. It covers what is collected, where it lives, how long it is kept, and who can see it.
You remain the controller of your study's data. The platform provides the storage, access controls, and deletion tools described here; decisions about what to collect, what to tell participants, and when to delete are yours.
What is collected
The platform collects only what your study is configured to collect:
- Session recordings: camera video, microphone audio, and an optional screen recording, when the study uses them.
- Behavioral data: task responses, timing, markers, and (when enabled) interaction telemetry.
- Participation form data: any demographic or custom fields you add to the participation form.
Participants are signed in anonymously. The platform does not ask participants for an email or a name on its own. Any identifying information exists only because your study collects it, or because you add it (see below).
How participants are identified
- System identifier: every participation gets an opaque, system-generated identifier. On its own it does not reveal who the participant is.
- Participant ID (optional): a label you can set to link a participation to your own records (for example a panel or recruitment ID). Because you choose what goes here, you are responsible for keeping it confidential and for deciding whether it should be pseudonymous.
- Labels (optional): tags attached to invite links or added during review, copied onto the participation for filtering and export.
The platform does not, by itself, prevent the same person from taking part more than once. To control who can participate and how many times, use single-use invite links (see Design a study).
Where data is stored
Data is hosted on Google Cloud:
- Participation records, results, and metadata are stored in the project database.
- Recordings, uploaded media, and exported artifacts are stored in cloud file storage, organized per study and per participation.
Data is encrypted in transit and at rest using Google Cloud's standard encryption. The hosting region depends on how your project is configured; contact your administrator if your ethics board requires a specific data residency.
Participant uploads are size-limited (for example, image uploads up to 20 MB, audio up to 50 MB, and video up to 100 MB), which helps keep sessions reliable.
How long data is kept
- Participant data (recordings, results, participation records) is kept until you delete it. There is no automatic expiry; it stays available for as long as your study exists.
- AI study assistant logs (the design requests you send to the assistant, if you use it) are automatically removed after 90 days.
If your protocol requires deleting participant data after a set period, you are responsible for doing so using the deletion tools below.
Deleting data
- Delete a participation: removes that participation's record and all of its files (recordings, uploaded media, and data). This cannot be undone. You confirm by typing the participation's system identifier.
- Delete a study: removes the study configuration and its invite links. It does not automatically delete the participations already collected under it. To remove participant data, delete the participations first, then delete the study.
Because deleting a study does not remove its participations, plan a deletion in two steps when you need participant data gone: delete each participation (which erases its recordings and data), then delete the study.
Who can see participant data
When you share a study (see Share a study with collaborators), every access level, Viewer, Analyst, and Editor, can view the full participation results, including recordings and any demographic information collected. The access levels differ in what a collaborator can do (annotate, run analyses, edit the study), not in what they can see. There is no view that hides participant data from a collaborator.
Only share a study with people who are authorized to access its participant data, and remove access when it is no longer needed.
Telling participants
Because what is collected is driven by your configuration, make sure your consent and information screens match your study. In particular:
- Disclose that the session is recorded (camera, microphone, and screen, as applicable).
- Cover any demographic or custom fields you add to the participation form.
- Describe how long you will keep the data and how a participant can ask you to delete it.
The platform provides the consent and information screens; the wording is yours to write.