Privacy & Data Handling

​

Core Privacy Principles

• No backend server receives your responses
• No cloud storage or databases
• No third-party analytics tracking individual responses
• All scoring calculations performed client-side
• Optional local storage for resume functionality

​

Data Storage Options

​

Option 1: Save Progress

• Your responses to each question (numeric values 0-3)
• Privacy consent status
• Current question index (for resume functionality)

• Browser localStorage on your device only
• Specific to the domain/URL of the application
• Not accessible to other websites

• Until you click “Delete My Data”
• Until you clear browser data/cache manually
• Until localStorage is cleared by browser maintenance

• Resume questionnaire if interrupted
• Close browser and return later
• Navigate away and come back
• Protection against accidental page refresh

​

Option 2: No Thanks

• Responses stored only in browser memory (RAM)
• Data lost when page is closed or refreshed
• Must complete questionnaire in one session

• Using a shared or public computer
• Don’t want any local data persistence
• Can complete in one sitting (typically 15-25 minutes)
• Maximum privacy preference

• Cannot resume if interrupted
• Must retake from start if browser crashes
• More vulnerable to accidental data loss

​

Privacy Banner Details

​

Banner Behavior

• Appears at bottom of screen with semi-transparent backdrop
• Blocks access to questionnaire until choice is made
• Choice is saved (if “Save Progress” selected) or discarded
• Does not reappear once dismissed

​

What Data is Collected

​

Response Data

type Response = 0 | 1 | 2 | 3;  // Numeric index only
type Responses = Record<number, Response>;  // Question ID -> Response index

{
  "1": 0,  // Question 1: "True now and when I was young"
  "2": 3,  // Question 2: "Never true"
  "3": 1,  // Question 3: "True only now"
  // ... up to 80 question IDs
}

• Your name or personal identifiers
• IP address (not accessible to client-side code)
• Device information beyond standard browser metadata
• Timestamps (except in exports, generated on-demand)
• User account information (no accounts exist)

​

Privacy Consent

{
  "privacyConsent": true
}

​

Data Processing

​

Scoring Calculation

export function scoreItem(responseIndex: number, isNormative: boolean): number {
  return isNormative ? responseIndex : 3 - responseIndex;
}

export function computeResults(responses: Responses, dataset: Dataset): Results {
  // Calculation runs entirely client-side
  // No server requests made
}

1. You select responses in the browser UI
2. JavaScript stores responses in memory/localStorage
3. When viewing results, scoring runs in your browser
4. Calculations use the scoring.ts module locally
5. Results displayed without any network activity

​

Export Processing

1. Response data read from browser memory
2. Export functions process data into target format
3. Blob created in browser memory
4. Download triggered using browser File API
5. No data transmitted over network

​

Deleting Your Data

​

Delete My Data Button

1. See confirmation prompt: “Are you sure? This will remove all saved data.”
2. Click “Confirm” to delete or “Cancel” to abort
3. All localStorage data is immediately cleared
4. You’re returned to the landing page
5. No recovery is possible after deletion

​

Manual Deletion

​

What Gets Deleted

​

Third-Party Services

​

Cloudflare Pages Analytics

• Page view counts (aggregate)
• Referrer information (where visitors come from)
• Geographic region (country-level)
• Browser and device type (user-agent)

• Individual questionnaire responses
• Personal identifiers
• Tracking across sites
• Detailed user behavior

• Understand site usage patterns
• Monitor performance and errors
• Aggregate statistics only

• Complies with privacy regulations
• No cookies used for analytics
• No persistent user tracking
• Data controlled by site operator

​

No Other Third Parties

• Google Analytics or similar detailed tracking
• Social media pixels
• Advertising networks
• Third-party authentication services
• External API calls for functionality
• CDNs for user data (code assets only)

​

Self-Hosting Privacy Benefits

• Host on your own infrastructure
• No dependence on third-party services
• Audit source code before deployment
• Control over analytics (enable/disable)
• Compliance with organizational policies
• Air-gapped deployment possible

• Internal corporate network
• Personal server or VPS
• Localhost (single-user)
• Isolated network segment
• Offline deployment (no internet required)

​

Compliance Considerations

​

GDPR (General Data Protection Regulation)

• Minimal data collection: Only essential questionnaire responses
• Purpose limitation: Data used only for scoring
• Storage limitation: User controls retention via “Delete My Data”
• Right to erasure: Immediate deletion capability
• Data portability: Export in standard formats (JSON, CSV)
• No cross-border transfer: Data stays on user’s device

​

HIPAA (Health Insurance Portability and Accountability Act)

• No PHI (Protected Health Information) transmitted
• Local-only data storage
• No business associate agreements required (no third parties)
• Audit capability through open source code

• Deploy on HIPAA-compliant infrastructure
• Implement appropriate access controls
• Maintain audit logs at hosting level
• Consider additional encryption at rest
• Document policies and procedures

​

Other Regulations

• CCPA (California Consumer Privacy Act)
• PIPEDA (Canada)
• DPA (UK Data Protection Act)
• Various healthcare privacy laws worldwide

​

Security Measures

​

Client-Side Security

​

Deployment Security

• Serve over HTTPS to prevent tampering
• Implement Content Security Policy (CSP) headers
• Use Subresource Integrity (SRI) for dependencies
• Regular security updates for hosting platform
• Access controls at hosting level if needed

​

Browser Security

• Keep browser updated to latest version
• Use reputable browsers with active security support
• Enable security features (e.g., Enhanced Safe Browsing)
• Be cautious of browser extensions that access all sites
• Use private/incognito mode on shared devices

​

Best Practices for Users

​

Privacy on Shared Computers

1. Use browser’s private/incognito mode
2. Select “No Thanks” to privacy prompt
3. Complete questionnaire in one session
4. Export results before closing browser
5. Close private browsing window when done
6. Do not leave browser unattended during questionnaire

• Clear browser history (Ctrl+H → Clear browsing data)
• Close all browser windows
• Log out of browser profile if using one
• Verify no files left in Downloads folder

​

Transparency & Trust

​

Open Source Code

• Full source code available on GitHub
• All data handling logic is public and auditable
• Community review and contributions welcome
• No proprietary tracking or hidden features

​

Clear Communication

• Privacy banner explains data handling upfront
• Documentation clearly states what is/isn’t collected
• No hidden terms of service or privacy policy surprises
• Honest about third-party analytics (Cloudflare Pages)

​

User Control

• You choose whether to save progress
• You can delete data at any time
• Export capability ensures data portability
• No account lock-in or platform dependence

​

Questions or Concerns

1. Review the source code to verify data handling
2. Check browser DevTools Network tab to confirm no data transmission
3. Open an issue on GitHub for technical questions
4. Consult your organization’s privacy officer for compliance questions
5. Consider self-hosting for maximum control

​

Privacy Summary

• ✓ Local-only data storage
• ✓ Client-side processing
• ✓ No server transmission
• ✓ User-controlled deletion
• ✓ Export capability
• ✓ Open source transparency
• ✓ Optional localStorage (not required)
• ✓ Self-hosting support
• ✓ Minimal third-party services
• ✓ Compliance-friendly architecture