Privacy and your data

Event creators open an Etkiva account with an email and password. Your account ID, display name and email are stored to identify your account and connect your events to you. Passwords are stored as scrypt-derived hashes with random salts; plaintext passwords are not stored. Only a hash of your recovery code is retained. Sessions use a cookie valid for 7 days with HttpOnly and SameSite attributes. Only a hash of the session token is stored in the database. Short-lived hashed counters derived from email and the server-provided IP address limit login attempts.

Event participants

No account is required to participate. A random participant cookie lasts 30 days and associates responses with the same browser. This cookie is not shown to the event owner. A chosen quiz nickname is shown on the leaderboard. Form creators can request a name, email or other information. Form details are visible only to authorized editors. Avoid sharing personal information in open text responses.

Response visibility

The event creator can view and export all responses and hide them for moderation. When results are enabled, participants who know the event code can view aggregate results and visible text responses.

Collaboration and media

Invitations are accepted with a private code and bound to the recipient’s native account ID. Comments, support tickets and their replies are stored. Uploaded images use object storage. External image and video providers may receive your browser requests; do not put private data in public media URLs. Chat messages are shown for one minute and excluded from exports; reaction and chat storage is cleared during subsequent session requests after one hour.

Plan and usage records

Your account plan, plan requests, quoted amounts, expiry dates and administrator change history are stored. Monthly usage is tracked with participant IDs derived per event; these are not real-person identities. Deleting an event does not reverse monthly usage. Plan management is restricted to authorised administrators. Card details and payment collection records are not collected at this stage.

Storage and deletion

Events and responses are stored until the owner deletes the event. Dashboard deletion moves the event to trash and disables participation. It can be restored for 30 days. Data may be retained until permanent account deletion. Deleting your account permanently removes your owned events, responses and image files.