Anonymity and respondent data

Ethics applications usually ask exactly what data you collect, whether responses are anonymous, and where the data goes. This article sets out what Surbee records when someone takes your survey, so you can answer accurately.

What Surbee records for each response

• The answers your participants give.
• Timing and behaviour signals, when Collect behavioral data is on (it is on by default). These include time spent on each question and how the form was used, such as typing, mouse or touch activity, and whether the respondent left the tab. Cipher uses them to tell real, attentive people apart from bots and rushed answers.
• Device information: the device type, browser details, timezone, and a technical identifier for the device that helps Cipher spot repeat or automated submissions.
• The IP address of the connection, which is used for integrity checks and stored encrypted.
• Where the respondent came from, such as a link or a referring page.

Your exports include the answers, the timing totals, Cipher's score and flags, and the device type, browser, timezone and source. They do not include IP addresses, and they do not include names or email addresses unless your own questions ask for them.

Turning off behaviour signals

To collect less, click Share survey (or Collect responses before you publish) and turn off Collect behavioral data under Response settings. Surbee then stops recording per-question timing and interaction signals for that survey.

Basic device details and the IP address are still recorded, because Cipher needs them for its integrity checks. With behaviour signals off, Cipher has less evidence to go on, so it is less able to catch bots and inattentive respondents.

What respondents are told

When Cipher and behaviour signals are both on, participants see this notice on the survey:

This survey uses automated response-integrity checks. Surbee records how the form is used and a technical identifier for this device to detect fraudulent submissions.

It links to Surbee's Privacy Policy, where participants can read how this works and how to object. Unless you turn on Hide Surbee branding, the survey footer also tells respondents that their responses go to the survey's owner and that Surbee never sells their answers.

This notice covers Surbee's own processing. It does not replace your consent page, which should still explain your study's data handling in your own words. See Build a consent page.

Anonymous or signed-in responses

You choose who can respond under Who can respond in the Send and collect responses dialog.

• Anyone with the link: respondents open the link and answer without signing in. Surbee does not ask for their name or email. This is the right choice for an anonymous study, as long as your own questions do not ask for identifying details.
• Signed-in people only: respondents must sign in before they submit, so each response is tied to an account. Use this when you need to limit each person to one response, with One response per person. Responses collected this way are linked to a person, so describe them as confidential.

Even with Anyone with the link, Surbee records the technical data listed above, such as the IP address and device details. If your study must promise that no technical data is kept, raise this with your ethics board before you publish.

How the data is protected

Survey answers and respondent IP addresses are encrypted at rest by Surbee with AES-256-GCM before they are written to the database, and the keys are held separately from the database. Data is also encrypted in transit.

Who the data belongs to

Responses go to you, the survey owner. Surbee's Privacy Policy states that Surbee does not sell personal information and does not use the content of your surveys or responses to train third-party foundation models. As the survey creator, you are the controller of the responses you collect and are responsible for telling your respondents how their data will be used.

Participants under 18

Surbee accounts are for people aged 18 and over, but survey respondents do not need an account. You can send a survey to people under 18. If you do, you are responsible for getting any parental or guardian consent the law requires, and for meeting children's privacy laws that apply to your study. Your ethics board will also have its own rules for research with minors.

Because Signed-in people only asks respondents to sign in, use Anyone with the link for surveys aimed at participants under 18.

Deleting data

You can delete a survey, together with its responses, from All project settings, under Delete. To ask for your account and its data to be deleted, see Privacy and security or contact us at [email protected].