Privacy

Short version: the test is anonymous and the creek check is pseudonymous. Here is exactly what that means.

What we store

• Test: a random session id. Your group. Your answers. How long each screen took. A hash of a random token your browser made. Your device type: phone, tablet or desktop. The version of the consent text. A coarse label from the link you used: poster, chat, friends, creek group, research panel or other.
• Second look, if you take it: which test it follows. Your group. Your first and final answer to each of its eight photos. Whether the checker asked you to look again, and whether you chose Keep or Change. How long each answer took. The same hash of your browser token. If you say No thanks, we keep only this: that you said no, when you said it, which test it follows, your group in that test and the same hash. These records link to the same random session id as your first test. We keep no name, email or other details that identify you.
• Creek check: your answers. The language the questions were shown in. Where the spot is, rounded to about 1 km unless you placed the pin yourself. The time. Your contributor token, if you chose to keep your score.
• Photos: kept private, location data removed on arrival, deleted after 30 days. A short note about each photo stays after that: its id, its file type, its size, when it came in, and a hash of the key that opens it.
• Video walk: which clip, your answers, the follow-up answers, the language the questions were shown in and the time you finished. Kept 30 days as a demo record, then deleted. It is never counted and never sent to OneAquaHealth. It holds no token and no place.
• On your phone only: your random browser token. Your contributor token. Saved spots. The language you chose for the questions. Which test and which second look you have open, so a reload finds them. Checks and their photos that wait to be sent while you are offline. A check that waited stays here after it is sent, without its photos. The answers of a video walk you have not finished. A finished walk stays here too, until you press Start again. Until you close the tab: the kind of link you came from and your pick on the first page.

Both study windows have closed. The first closed on Sep 28 at 01:00 UTC; the second closed on Oct 3 at 04:00 UTC, which was Fri Oct 2 at 21:00 PDT. Neither wave retained an eligible completed sitting, so we could not measure a human benefit. The reports and exclusions are in the repository. Both windows stored the same things, listed above. The second window followed docs/analysis_plan_v3.md in the repository.

On November 30, 2026, after the winners are announced, we delete the raw second-look answers and session records from the live database. We keep a de-identified export and the summary results. The export has no browser token hash or original session ids. Private database backups may still hold older copies until they rotate out after the next 30 daily backups.

What we never store

• Your name, email, phone number or IP address.
• Free text, except the name you give a new spot, which is shown on its public page. Every other answer is a choice from a list or a number.
• Anything from third parties. This site loads no third-party scripts, fonts, maps or trackers.

What the hosts log

The web host and the API host keep their own access logs for a short time. Our API logs no client addresses. docs/DATA_HANDLING.md in the repository says what each host logs and for how long.

Quitting and deleting

You can quit the test at any time by closing the page. Because sessions are anonymous, we cannot find yours to delete it afterwards. A contributor token can be forgotten by clearing this site's data on your phone.

Questions: alejandro-publius@berkeley.edu