Anonymity

You are an ID, not a person

This platform never asks who you are. When you join, your browser creates a random ID. That ID stays in your browser: the server only receives a code derived from it and stores a hash of that code. Nobody, including the operator, can recover your ID or tell you what it was.

What we store

• A hash of the code derived from your ID.
• The reports made from your recordings and their summary metrics (heart-rate variability per time window).
• The raw beat-to-beat (RR) intervals of a recording, only if you add it to the research pool. Otherwise: Raw RR stays on this device. Your report and summary metrics are stored.
• Your questionnaire answers, limited to fixed choices.
• An age band and sex, only if you give them.
• Times of your sessions, shifted by a random offset of up to 50 years that only your ID can undo, and the part of the day (morning, afternoon, evening, night). Because times are shifted, stored data and the pool carry no real dates.

How recordings are processed

Recordings pass through PostgREST into a temporary, unlogged processing queue. ECG is used only for processing, never written to the database write-ahead log or included in backups. Queue data is deleted when processing completes or fails.

The application, research API and processing worker use separate database roles. No service connects as a database superuser during normal operation. Only installation and migrations use that account.

What we never store

• Your name, email address, phone number or username.
• Your ID itself.
• Your IP address or any other request header.
• The real date and time of anything you record.
• Free text written by you.
• Who invited whom to the research pool.

Who can see your data

Everything you record is used for research. Members with an invite to the research pool can read the pooled data, which carries a random code per member and never your ID. Your age band and sex are hidden in the pool for any group smaller than five members.

You choose for each recording whether its raw RR is added to the pool. On a report page, "Remove my RR from the pool" takes it out again.

What the operator could still work out

Whoever operates the server could still infer approximate dates, from database internals or by comparing backups taken at different times. Backups are daily, so a date can be narrowed to the day; they are kept for at most 4 weeks, and their rows are reordered before each backup.

Outside services

The platform runs on the operator's own server. It uses no analytics and no error-tracking service.

The only data kept outside that server is the daily backup, stored with Cloudflare R2 in the EU. It is encrypted on the server before upload, with a key only the operator holds, so Cloudflare cannot read it.

Deleting your data

Under My ID, "Delete everything" removes your data immediately from the live database, and it disappears from backups within 4 weeks.

Keep your ID safe

Your ID is the only way back to your data. If you lose it, nobody can give you access again. If someone else gets it, they can see and delete your data.