DRAFT · Not in force
Research and retention
Effective date: {{EFFECTIVE_DATE}}
Operator: {{ENTITY_NAME}}, {{ENTITY_ADDRESS}}. Rights and withdrawal contact: {{PRIVACY_EMAIL}}. This notice supplements the Privacy Policy for US adults aged 18 or older.
What happens today
Continuous research copying is not built and is not collecting data. Settings labels research contribution “not active yet”, and the server rejects enabling it. Outside-result research switches record versioned, default-off choices only; no outside result is copied into research. Community naming and percentiles are a separate product feature controlled by the member community-contribution choice, not this research program.
Deleting an account creates no research copy. Older research snapshots from a previous process may remain. Their schema has no saved account/session mapping, so an account cannot reliably locate one person's older records. Their anonymity has not been verified; we will not try to identify their authors by comparing answer patterns. The same limitation applies to older records after an under-18 correction. No active research-withdrawal tool is claimed.
Decision: optional and off by default
Future research must be a separate optional choice, initially off. Refusal cannot prevent ordinary product use. Product consent, a community-contribution choice or an existing outside-result choice cannot silently enroll a member in a new research program. Before activation, the operator must publish the purpose, included fields, recipients, retention period and withdrawal process, update the policy and obtain fresh consent. Sensitive political/religious item answers require an additional separate choice before inclusion.
No new research collection is authorized by this notice alone. First-party CAT-Q, dedicated monotropism/neurodivergence measures, health-adjacent Neuroticism scores and associated health answers, experimental H-H, under-18 records and outside self-reported results are excluded from the initial research plan. Outside-result switches remain dormant consent records; expanding that scope requires a new notice and fresh consent, not merely reading an old grant.
Future collection and withdrawal safeguards
The proposed scope is eligible completed non-health first-party answers/scores, instrument/scoring versions and explicitly selected broad About-you categories. Incomplete/unknown-version records are excluded. About-you collection is not active. Exact times, email, account/session identifiers, free text, IP/device information, social content and Nearby coordinates are excluded from research releases. Retakes may be grouped over time only under the newly disclosed research design.
The operator must implement restricted research access, separate credentials and access logs before copying begins. A limited protected mapping is required while individual research records are retained so withdrawal, correction, account deletion and under-18 removal can find the records. No indefinite retention of individual research rows is authorized. The activation notice must specify a finite period. Withdrawal must stop new copying and delete linkable research records and controlled exports; account deletion and under-18 correction must also remove linkable records. Truly non-identifying published aggregates may remain, but a claim of de-identification requires an assessment of answer-pattern and combination risks. A random identifier alone does not establish anonymity.
These safeguards are activation requirements, not implemented controls. They replace the earlier proposal to keep unlinked individual records indefinitely after account deletion. Existing older snapshots cannot be retroactively made linkable by this policy.
Access, publication and prohibited uses
No raw respondent-data releases are authorized. Any future recipients need written purpose limits, confidentiality, deletion obligations and a ban on re-identification. The operator will not attempt re-identification or permit recipients to do so. Linking while records remain identifiable is limited to administering choices, correction and withdrawal.
Future published aggregates require at least 30 distinct participants and an effective weighted sample of at least 30, suppression/merging of rare combinations, and protection against identifying people by comparing outputs. Calibration and confidence intervals cannot remove volunteer-sample bias. Cognitive-by-race/ethnicity rankings or member comparisons are prohibited. Independent ethics review is required before publication or university partnership. These are release gates, not claims that a research pipeline or review board exists today.
Research will not be sold or used for advertising, political targeting, matching, diagnosis, employment, insurance, credit or education/career eligibility decisions. Transcript extraction, occupation licensing and sensitive demographic collection require their own scope, licensing and privacy checks before implementation.
Requests and backups
Contact {{PRIVACY_EMAIL}} without creating an account to request access, correction, deletion or withdrawal. We respond within 45 days, with one explained extension of up to 45 days where permitted and notice during the original period; shorter mandatory deadlines control. Reply to a denial to appeal. We respond to appeals within 45 days. Requests can cover processors and controlled copies; older unlinked records have the limitation stated above.
Product backups use configured 30-day retention for nightly database dumps, operator-PC copies and encrypted OneDrive copies. Offsite staging keeps three dumps by count, and account deletion does not trigger backup/provider erasure. There is no universal 30-day deletion guarantee. Before restoring data to use, the operator must reapply deletions and withdrawals manually. Research-specific deletion and restore controls must work before research activation. See the Privacy Policy for current retention exceptions.