Trust and data
What leaves your building, and what we can see.
An instrument that measures an organization is asking its leaders to describe what is actually happening, which they will only do accurately if they know where the answers go. So this states it plainly rather than in the language of a privacy policy.
Everything below is a property of how the product is built rather than a commitment we intend to honour. Where a number appears, it is read from the same constant the software enforces.
Three kinds of data, treated three different ways.
Most privacy pages fail by averaging. These are genuinely different and are described separately.
The instruments you run alone
Executive Organizational Diagnostic short form, the individual tier, the Builder Orientation Profile, the Builder Leadership Self-Check, the Forecast Calibration Scorer.
- What is transmitted
- Nothing. Your answers are held in your own browser and are never transmitted.
- What is stored, and for how long
- Nothing on our side. Clearing your browser data deletes the result.
This is also why the company portal shows no completion funnel for these. Counting a completion would mean transmitting the fact of an answer, and that promise is worth more than the metric.
A team or organizational engagement
The team tier and the comprehensive tier, run across a leadership group.
- What is transmitted
- Your answers, sent in and stored unlinked from you. No record connects a response to the person who gave it, so no one sees an individual answer, the facilitator included. Only the group result exists.
- What is stored, and for how long
- Individual responses are deleted automatically after 90 days.
Nothing is shown to anyone until every leader has responded, which is what stops a partial result being read as a verdict on whoever answered first.
Reading the site
Any page, including this one.
- What is transmitted
- A page path with its query string and fragment removed. Nothing is written to your device: no cookie, no local storage, no fingerprint.
- What is stored, and for how long
- Daily counters and probabilistic sketches. A sketch answers how many and can never answer who.
Returning visitors are estimated from a one-way hash that exists only inside a single request and is then discarded. Its salt expires monthly, so even a complete copy of the store cannot link one month to the next.
What is never collected.
- A row per visit, a visitor profile, or any way to enumerate who has been here.
- Any record joining a diagnostic response to a person, an email address or an organization name.
- Anything at all from the company portal or the API routes: neither is ever counted.
- Identifier-shaped URL segments. Respondent links carry tokens, so paths are normalized before anything is stored.
- Your results in a benchmark, a published statistic or a comparison, unless your organization has explicitly agreed to it.
Keeping a result on purpose.
A readiness measurement is only useful against a later one, and a later comparison needs the earlier result to still exist. So an organization may agree, explicitly and in advance, that its group result outlives the 90 day window: four scores and how widely the team disagreed on each, with no answers, no names and no individual figures attached.
That agreement is per engagement and is off unless someone turns it on. The invitation every respondent receives states which of the two applies to them, because a respondent who later discovers a different answer would be right to be annoyed.