V.O.I.C.E.

Privacy

The strongest privacy guarantee is structural: don't collect what you don't need, and keep identities separate from answers.

In Phase 2, V.O.I.C.E. collects no participant data at all. There are no accounts, no surveys, and no response tables. The database schema intentionally contains no participant or identity tables — that isn’t an oversight, it’s the design. You can verify it: the schema is part of the project’s published foundation.

V.O.I.C.E. will never collect Social Security numbers or identity documents. When participant workflows launch in a later phase, verifying who someone is and recording what they think will run through separate systems, so that research responses can’t be traced back to individuals through the research data itself.

Before anyone ever answers a question, they’ll see a plain-language notice: what is collected, why it’s needed, how long it’s kept, and how to ask for it to be deleted. No legal ese as a substitute for an actual explanation. Those notices, and the data-minimization rule behind them — collect only what the study needs, nothing more — are committed below as proposed until the participant systems exist to implement them.

Controls in this area

Each safeguard below carries an honest status: proposed means committed but not yet built, implemented means live today, and verified means checked by an independent party.

  • No sensitive identity data collected

    Implemented

    V.O.I.C.E. does not collect Social Security numbers, identity documents, or other sensitive identifiers. Participant email addresses are verified and then discarded — only non-reversible hashes are kept, and raw emails are never stored.

    Where to check it: The database schema contains no columns for SSNs, identity documents, names, addresses, or raw emails.

  • Identity verification kept separate from research responses

    Implemented

    Verifying who someone is and recording what they think are separate systems, so answers can't be traced to individuals through the research data.

    Where to check it: The database holds an identity schema (eligibility, consent, sessions) and a research schema (one-time nonces, answers) with no joinable key between them. Raw emails are never stored — only hashes.

  • Data minimization

    Proposed

    Only the data needed to run a study and verify its integrity will be collected. Anything not needed won't be asked for.

  • Plain-language privacy notices before participation

    Implemented

    Before anyone answers a question, they see — in ordinary language — what is collected, why, how long it's kept, and how to ask for deletion.

    Where to check it: The versioned consent screen at step 3 of the participation flow; the exact text shown is hashed into each consent receipt.