Privacy policy

This policy explains what Altruism Choice collects, how the data is stored and used, and the rights you have over your data. Altruism Choice is operated by Scirenity, the data controller for the purposes of the General Data Protection Regulation (GDPR).

Data we collect

When you participate in a study, we collect:

• Your responses — the choices you make in each vignette (which charity received how much), plus any free-text feedback you submit voluntarily.
• Optional demographics — age, gender, education, country, prior donation frequency. Each field is opt-in; you can choose “prefer not to say”.
• Authentication — if you create an account, your email address and (if set) a password hash. If you sign in via Google or GitHub, we receive your name, email, and profile picture from that provider. If you sign in via ORCID, we receive your ORCID iD and name (ORCID does not share email addresses), and we read the employment affiliations you have made public on your ORCID record.
• Instructor access requests — if you request instructor access, we store your ORCID iD, the affiliation you chose (or the organization you stated), and the purpose and course you described, together with the decision on your request.
• External IDs — if you arrive via Prolific or SONA, we store the participant ID provided by that platform so we can confirm completion to it. Not linked to your account unless you explicitly log in.
• Server logs — request paths, timestamps, error stacks. No IP addresses are stored beyond Vercel's short-lived edge logs.

What we do not collect

• No analytics cookies and no advertising trackers. Page-view and page-speed statistics come from Vercel Web Analytics and Speed Insights, which set no cookies; pages whose address carries a one-time code or an email address are not reported.
• No advertising identifiers.
• No payment information — donations on this platform are notional (research scenarios), not real money.

Cookies

We use one functional cookie: a session JWT, set after you log in. HTTPS-only, SameSite=Lax, expires after 30 days. Without it you cannot stay logged in. There are no analytics or advertising cookies. Google reCAPTCHA, which protects the site against automated submissions, runs on every page and may set its own Google cookies. Anonymous participation uses a localStorage identifier (not a cookie) which never leaves your browser unless you choose to migrate your responses to a logged-in account.

Data processors

• Vercel (USA) — hosting and function execution. Standard Contractual Clauses cover EU data transfers.
• Neon (EU region: AWS Frankfurt) — Postgres database storing accounts, responses, and email events.
• AWS Simple Email Service (EU region: eu-west-1) — transactional email (verification, password reset, sign-in links).
• Vercel Web Analytics and Speed Insights — cookieless page-view and page-speed statistics.
• Google reCAPTCHA (USA) — bot protection on every page. Google receives your IP address and browser information under its own privacy policy and terms.
• AI providers: OpenCode Zen, Groq, Google Gemini — vignette suggestions and bug reports you submit are sent to one of these services for moderation and analysis. Your study responses are not sent.
• Google, GitHub, ORCID — only if you choose to sign in via these providers, and only the data you authorize.

Retention

• Anonymized response data — kept indefinitely as part of the academic research record.
• Account data (email, name, login history) — deleted on request, see below.
• Email events (delivery, bounce, complaint) — kept for 90 days for deliverability monitoring.

Your rights under GDPR

• Access the data we hold about you.
• Correct inaccuracies.
• Delete your account and any data linkable to you (anonymized response data may be retained but cannot be linked back to you).
• Export your data in a machine-readable format.
• Withdraw from a study at any point. Signed-in participants can do this themselves on the Privacy & Consent page.
• Lodge a complaint with your local data protection authority.

How to exercise your rights

Get in touch via scirenity.com. We respond within 30 days. For account deletion, you can also use the “Delete account” link in your profile settings once that feature ships.

Changes to this policy

Material changes are announced on the platform homepage and via email to active users at least 14 days in advance. Minor wording updates are reflected in the “Last updated” date above.

Contact

For all inquiries, including data requests: scirenity.com.