Confidentiality & Data Integrity Constitution

Coarse regional context — country and, where available, a broad region code — is read at the CDN edge from request metadata as your contribution is submitted.

Your raw IP address is never written to a log, a database row, or an analytics record. It is mathematically discarded the moment the coarse tag is derived. There is zero raw IP logging anywhere in this platform, at any layer.

Abuse throttling uses a one-way cryptographic hash that cannot be reversed into an address.

If you opt in to receive the macro synthesis report, your email address is written to an isolated table that holds no session identifier, no transcript reference, and no foreign key back to your qualitative contribution.

There is no join, no lookup, and no reconstruction path between an email address and a transcript. The separation is structural, not procedural — it cannot be undone by policy change or human choice.

Before any contribution enters aggregate analysis, a dedicated redaction pass (GPT-5.6 Luna) replaces personal names, employers, client names, team names, and locations with generic placeholders such as [a colleague] or [my company].

The same pass translates profanity, expletives, and any derogatory language targeting protected characteristics into precise, executive-grade qualitative prose.

Critically, sanitization never softens substance. Criticism, frustration, disagreement, and grievance intensity are preserved exactly as expressed. Only identifying detail and explicit phrasing change.

The raw, audio-derived text of your contribution is discarded as soon as the scrubbed version is written — within 24 hours at the outside.

This applies equally to abandoned sessions. If you close the tab partway through, the raw text of what you said is purged on the same retention clock; it is never held indefinitely simply because the conversation was left unfinished.

Only the scrubbed, de-identified version and its coarse analytic tags survive into aggregate research.

This platform is engineered exclusively to capture authentic, real-time human reflection. Synthetic contribution has no place in a qualitative record.

Active filtering rejects automated scripts, bot submission patterns, invisible-field trap triggers, implausibly fast submissions, and speech-recognition artifacts or null audio.

A privacy-preserving 24-hour participation window keeps every response considered and unhurried, and prevents a single actor from distorting a cohort.