Privacy Policy

Anonymeter.com ("Anonymeter", "we", "us", or "our") is an anonymous feedback collection platform. We provide tools that allow registered users ("form owners") to create feedback forms and share them publicly, so that anyone ("respondents") can submit answers without creating an account or revealing their identity.

For questions about this policy, contact us at [email protected].

When you create an account with Anonymeter, we collect:

• Email address - used for login and account-related communications.
• Password - stored as a bcrypt hash. We never store your plain-text password.
• Plan information - which subscription plan you are on (Free, Pro, or Team).
• Form content - the titles, descriptions, and questions you create.
• Payment data - if you upgrade to a paid plan, payments are processed by Stripe. We store only your Stripe Customer ID, never your card details.

We do not collect your name, phone number, or any social media profiles unless you voluntarily provide them.

When someone submits a response to a form, we store only the answers they typed or selected. We explicitly do not collect or store:

• IP addresses
• Browser fingerprints
• Device identifiers
• Referrer URLs
• Geolocation data
• User agent strings

The only metadata stored with each response is the timestamp of submission (e.g., "April 10, 2026 at 14:32"). This timestamp is used solely to display responses in chronological order - it cannot be used to identify a person.

Cookies on the public form page: by default we set none. There is exactly one exception, and the respondent chooses it: if they tick the optional box asking the form owner to be able to send them a private follow-up, we set a single first-party cookie on that form, kept for 30 days. It holds a random token - of which we store only a one-way hash - and its only purpose is to reconnect that person to their own anonymous reply thread. It expires by itself, can be cleared at any time, does not follow anyone across forms or sites, and still tells us nothing about who they are. Leave the box unticked and no cookie is set at all.

AI insights. A form owner on a paid plan can press a button on their responses page to have up to 250 of that form's free-text answers summarised by Anthropic's API. It happens on that button press and never automatically. The answers carry no identity, because none is stored, and they are not used to train models. An owner who never presses it never sends anything.

We use the data we collect for the following purposes only:

• Providing the service - logging you in, displaying your forms, and showing you your responses.
• Account communication - sending you transactional emails (e.g., password resets, billing receipts). We do not send marketing emails without your explicit consent.
• Billing - processing subscription payments via Stripe.
• Security - detecting and preventing abuse, fraud, or unauthorized access.
• Service improvement - understanding aggregate usage patterns (e.g., how many forms are created per day) to improve reliability and features.

We do not use your data for advertising, profiling, or sell it to any third party.

For registered users: We use a single session cookie to keep you logged in. This cookie is HTTP-only, SameSite=Lax, and is cleared when you log out.

For respondents on public form pages: We set no tracking cookies. A minimal PHP session cookie may be set temporarily to validate the form submission (CSRF protection), but it expires immediately and contains no identifying information.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.

We share data with the following third-party providers only as necessary to operate the service:

• Stripe - payment processing for Pro and Team plans. Governed by Stripe's Privacy Policy.
• FastComet - web hosting provider that stores our database on secure servers. Governed by FastComet's Data Processing Agreement.

We also use Cloudflare as the CDN in front of the whole site, which means it sees the IP of every request, form pages included; Anthropic for the support chatbot and, on request, AI insights; and Telegram, which carries our own internal admin alerts and never any respondent data. All five are listed with what each receives on the subprocessors page, and that list is the complete one. We will disclose data if required by law (e.g., a valid court order), but we will notify you unless prohibited from doing so.

Data processing agreement. If you use Anonymeter on behalf of an organisation, we will sign a data processing agreement with you. Write to [email protected] and we will send one. We do not add a subprocessor without updating the subprocessors page.

• Account data - retained as long as your account is active.
• Form data and responses - retained as long as the form exists. Deleting a form permanently deletes all its responses immediately.
• Deleted accounts - when you delete your account, all associated forms and responses are permanently deleted within 30 days.

You have the right to:

• Access - request a copy of all data we hold about you.
• Correction - update your email address or other account details at any time.
• Deletion - delete your account and all associated data at any time from your account settings, or by emailing us.
• Portability - export your response data as a CSV file, available on Pro and Team plans. This is a right rather than a paid feature: on any plan, Free included, email us and we will send you an export.
• Objection - object to any processing of your data that you believe is unlawful.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

We take security seriously and implement the following measures:

• All data in transit is encrypted via TLS/HTTPS.
• Passwords are hashed using bcrypt with a cost factor of 12.
• All database queries use PDO prepared statements (no SQL injection possible).
• CSRF tokens are validated on every form submission.
• Session cookies are flagged HttpOnly, Secure, and SameSite=Lax.
• Sensitive directories (/config, /includes) are blocked from direct web access.

No system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].

Where your data is stored. Anonymeter runs on a single server in Toronto, Canada. Responses, form definitions and account records all live in that one location; we do not replicate them elsewhere. Our hosting provider is named on the subprocessors page.

Anonymeter is not directed at children under the age of 16, which is also the minimum age for an account under our Terms. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users by email. Your continued use of Anonymeter after changes are posted constitutes your acceptance of the updated policy.