Privacy & terms
Written to be read, not skimmed past. Last updated August 2026 · soft-launch version — this will evolve, and material changes will be dated here.
This page covers the survey instrument at this site, run by Iterum Ltd, trading as Psych Safety, a company registered in England. If anything here contradicts what the instrument's own pages say about anonymity, tell us — the whole design stands on those claims being true.
What the survey stores
When you answer a team survey, we store: your ratings, your probe answers (why you hold back, and on what kind of power it depends), anything you type into the comment boxes, the date (never the time) of submission, and roughly how long the survey took. That's the complete list.
We deliberately do not store your name, email address, IP address, device information, or any identifier that links a response to a person. There is no receipt or reference number, because a receipt is a handle and a handle is an identifier. Results are sealed until the survey closes with at least four responses, released once, and written comments are returned shuffled, detached from the ratings their author gave — so no individual's set of answers can be reassembled.
The individual self-check stores nothing at all unless you explicitly choose, at the end, to contribute your ratings to research.
Organisers are known; respondents are not
Two different people use this service, under two different promises. If you respond to a survey, everything above applies: nothing about you is collected, ever. If you organise a survey, you're a customer initiating a service for other people, and we verify and keep your email address. It attaches to your surveys — never to any response, which carries nothing it could be joined to — and we use it to send your creation link, recover lost owner links and PINs, and for messages about your surveys. We send marketing only if you tick the box saying so, and you can withdraw that any time. Organisers' GDPR rights are fully exercisable: ask and we can show you or delete everything we hold about you. The respond page tells your team this asymmetry plainly, because accountability on the organiser's side is part of what makes anonymity on the respondent's side credible.
Emails are delivered via Resend, who process the address in transit and keep standard delivery logs for a limited period.
What we can't promise — and say so
The database guarantees above are architectural: the anonymity cannot be undone by us changing our minds, because the identifying data was never collected. But two things sit outside the database. First, the infrastructure that serves this site and its API (Render and Supabase) keeps standard technical logs, which include IP addresses, for a limited period — we do not use them, cannot join them to responses, and keep their retention short, but they exist. Second, anonymity has arithmetic limits in very small teams: in a team of four or five, a colleague who knows you well may recognise your handwriting in a comment. The survey warns about this above every comment box; we repeat it here.
What the words you write become
Comments are shown to your team, verbatim and unattributed, in the released report. They are never summarised, paraphrased, or processed by AI. The report's "qualitative picture" is generated by fixed rules from the numbers alone. If you write something identifying — including someone's name — the team will see it, so write accordingly.
The research pool
If you opt in at the end of the self-check, your ratings (numbers only, plus any coarse, optional context you choose to give, like sector or team-size band) join an anonymous pool used for research on psychological safety across working life. This pool is never used to benchmark, rank, or compare individual teams — findings are published only at population level. There is no way to withdraw a specific contribution after the fact, because there is no way to find it: that is the anonymity working as designed, and it's why we ask before you contribute rather than after.
What we look at
We keep an admin view of how the service is being used, and it shows aggregates only: how many surveys exist, how many responses they've had, which questions get chosen, how often each reason for holding back is given across everyone. It does not show any individual team's report, any individual response, or anything anyone wrote. We could technically query the database directly — any operator of any service can — but the tool we built for ourselves is deliberately incapable of putting one team's answers on screen, because a habit is harder to break than a rule.
Self-check completions are counted by a bare daily tally: a number incremented by one, with no answers, addresses, or identifiers attached.
Cookies and tracking
None. No analytics, no advertising, no third-party scripts, no cookies, no fingerprinting. Fonts are served from this site, not from a font network. The one piece of feedback instrumentation is the optional "does this ring true?" tap on the report's qualitative picture, which stores a single word (yes / partly / no) against the survey — not against you.
Who holds what, and your rights
Iterum Ltd is the data controller for the little that exists. Survey data lives in a database hosted by Supabase in the EU (Ireland region); the site is served by Render's CDN. Under UK GDPR you have rights of access, rectification and erasure — but note their honest limit here: because responses carry no identifier, we cannot locate your response to show, correct, or delete it. What we can do: delete an entire survey and everything in it at the request of whoever holds its keys, and answer any question about the design at psychsafety.com/contact. You also have the right to complain to the ICO.
Survey organisers: you are responsible for telling your team the truth about this survey — the respond page does most of that for you — and for releasing the report you said you'd release.
Retention
During the soft launch, surveys and responses are kept while the pilot runs and until this policy is updated with a fixed schedule; infrastructure logs are kept per provider defaults, set as short as their tooling allows. When we set the fixed schedule, it will appear here with a date.
Terms of use, briefly
What this is
A free instrument for understanding psychological safety in a team, provided as-is during a soft launch. It is a prompt for a conversation, not a clinical assessment, a medical or psychological evaluation, or an HR-grade appraisal, and it should never be used to evaluate, discipline, or make decisions about individuals — the design makes that impossible on purpose, and attempting to defeat that design is a breach of these terms.
Acceptable use
Don't attempt to de-anonymise respondents, probe the system's security beyond your own surveys, scrape the item bank for a competing product, or misrepresent a report as something we certified. Survey creation may be rate-limited or gated; abuse gets surveys removed.
Intellectual property
The question bank is adapted from The Fearless Organization, © Amy Edmondson 2018, used with attribution; the sensemaking items, habitat framework, and this instrument's design are © Iterum Ltd. Reports belong to the teams they describe — share yours however you like.
Liability
Provided without warranty; to the extent the law allows, Iterum Ltd isn't liable for decisions made on the basis of a report. Nothing here limits liability that cannot lawfully be limited. These terms are governed by the law of England and Wales.
Plain-language notice, drafted in-house. If you're a lawyer and something above makes you wince, we would genuinely like to hear from you.