What SurveyAll stores
SurveyAll is a live classroom polling tool. Students answer questions from their phones. This page describes exactly what is recorded when they do, what is not, and who can see it.
Last updated 16 August 2026.
Before sharing this page
Replace the two bracketed placeholders below — the operator's contact address, and the institution name — then delete this box. A privacy page with an unfilled placeholder in it undoes the point of having one.
The short version
- No student names are stored. There is no field to put one in.
- Students never create an account and never sign in. They enter a room code, which is not a password and identifies nobody.
- No emails, student IDs, or IP addresses are stored for anyone — student or instructor.
- No cookies, no analytics, no advertising, no third-party trackers.
- Answers are not linked to a person, and cannot be linked back to one after the fact.
- Instructors have accounts — a username and a password, and nothing else. This is the only personal data in the system, and it belongs to staff, not students.
What a student's device sends
When a student joins a session, their device is given a random two-word label — "Amber Falcon", "Teal Juniper". Their answers are filed under that label. That is the entire record of who answered what.
The label:
- is generated at random by the server, not derived from anything about the device or the person;
- exists only inside one session — the same student in your next class gets an unrelated label;
- cannot be joined across sessions, because no key exists that would connect them;
- is only shown to the student at all when the deck contains a scored quiz, so that a leaderboard can work.
Nothing else travels with an answer. Not a device identifier, not a browser fingerprint, not a location, not an IP address.
What is stored, in full
| Data | Why it exists | How long it is kept |
|---|---|---|
| The question text an instructor wrote | It's their teaching material | Until they delete it |
| Answers submitted, each tagged with a random session label | To show and export results | Until the instructor deletes the session |
| Q&A questions typed by students | The backchannel feature | Until the instructor deletes the session |
| Session join codes, timestamps, and settings | To run and archive a session | Until the instructor deletes the session |
| Background images an instructor uploaded | Projector styling | Until they delete them |
| Instructor: a chosen username | To tell accounts apart | Until the account is deleted |
| Instructor: a password hash | To sign in | Until the account is deleted |
| Instructor: a count of recent failed sign-ins | To slow down password guessing — each failure in a row makes the next attempt wait longer | Cleared on a successful sign-in; forgotten after a day |
That is the complete list. There is no other table and no other file.
Who can see what
- An instructor sees only their own decks, sessions, and results. Instructors sharing this site cannot see each other's material — every request is filtered by account, and asking for a colleague's session by its ID returns "not found".
- Students see the current question and, when the presenter chooses to share them, aggregate results. A student can never retrieve raw answers, another student's answer, or a quiz answer key. Answer keys are stripped on the server before a question is sent to a phone.
- The operator — the person who runs this deployment — administers the database and can therefore read what is in it. This is true of any self-hosted application and it is stated here rather than glossed over. See below.
Things this page will not claim
A privacy notice is worth something only if it says the awkward parts too. These are the limits of what is above.
The data is not inaccessible — it is unidentified
Stored data is encrypted at rest by the hosting provider, but this is not end-to-end encryption, and the operator can read the database. The protection offered here is different and, for a classroom, stronger: the records contain no student identity to read in the first place. Someone with full database access still cannot tell you who said what.
A student can type their own name into an answer
Open-ended and Q&A questions accept free text, so a student can write their name — or something identifying — into one. No polling tool can prevent this. Instructors can delete any individual response, and should tell students not to include their names.
The hosting provider sees network traffic
This site runs on Cloudflare. Serving any web page necessarily means Cloudflare's network handles the request, including the visitor's IP address, and it applies its own security logging. SurveyAll neither receives nor stores that. It is governed by Cloudflare's privacy terms, not by this page.
The sign-up code is a gate, not a lock
Instructor accounts are created with a shared code. That keeps out automated sign-ups and passers-by; it is not a strong access control, and anyone who is given the code — or guesses it — can create an account. It can be changed at any time. No student ever needs or receives it.
Uploaded background images are served by unguessable link
Projector backdrops uploaded by an instructor are served at a random URL that does not require signing in, because browsers cannot authenticate an image request. Anyone holding that exact link can view that image. These are decorative slides already projected in front of a room; no student data is in them, and no listing of them is public.
Not an official university service
SurveyAll is an independent tool built and run by an instructor. It is not operated, endorsed, hosted, or reviewed by [INSTITUTION NAME], and it is not covered by the university's own agreements with vendors. It is offered to colleagues as-is. Departments with a formal software review process should route it through that process before adopting it for coursework.
Deleting things
- A single response: an instructor can delete any individual answer from the results view.
- A whole session: deleting a session removes every answer and Q&A message in it.
- A deck: deleting a deck removes its questions and all of its sessions.
- An instructor account: ask the operator. Deleting an account removes its username and password hash.
Deletions are immediate and permanent — there is no recycle bin and no recovery, so be certain first.
Checking any of this yourself
The claims above are not assurances to take on trust. The source code is public, and each one corresponds to something specific you can go and read:
| Claim | Where to verify it |
|---|---|
| No column anywhere can hold a student name, email, ID, or IP | worker/schema.sql — the full database definition, about 200 lines |
| Quiz answer keys never reach a student's phone | sanitiseQuestion() in worker/index.js |
| Instructors cannot read each other's data | The ownership helpers in worker/index.js, and the isolation tests in tests/run-tests.mjs |
| Students cannot read raw responses | participantRoute() in worker/index.js — the participant API in full |
| Failed sign-ins are counted without storing an IP | The auth_throttle notes in worker/schema.sql |
| Passwords are not recoverable from the database alone | The hashing section of worker/auth.js |
| No cookies or third-party requests | Any browser's network inspector, on any page of this site |
Who runs this
This deployment is operated by Brandon Ballard on a personal Cloudflare account. The operator administers the database and is the person to contact about anything on this page — a deletion request, an account problem, or a question from a department reviewing the tool.
Contact: [OPERATOR EMAIL ADDRESS]
If this page and the software ever disagree, the software is what is true. Report the discrepancy and it will be corrected.