A plain-language overview of how Queza protects participants’ anonymity and organizers’ data. The Privacy Policy is the authoritative version.
How anonymity works
- Participants never create an account. Questions are anonymous by default; a participant can choose to add a name (up to 80 characters), and only then is a name stored with the question.
- Each participant’s browser gets a signed, anonymous visitor-id cookie. It’s used only to prevent duplicate votes and to count distinct visitors, askers and voters in the event report.
- Unless a participant adds a name, organizer and moderator views never show who asked a question - and they never show who voted for one.
- Google Analytics isn’t loaded on public event pages.
What we store and for how long
- Organizer accounts: name, email address and a hashed password.
- Events: the event details, questions, votes and anonymous visit records.
- Billing: subscription and invoice records. Card details are entered directly with our payment provider and never touch our servers.
- Technical data: IP addresses are used transiently for abuse and rate-limit protection, not stored long-term against an identity.
Workspace and account data is kept for as long as the workspace exists. After a workspace or account is deleted, the underlying data is removed within 30 days, except billing and invoice records, which are kept for 7 years for accounting and tax obligations. We don’t sell personal data.
Who processes data
- Railway - hosts the application and its database.
- Paddle.com - payment processing, as Merchant of Record.
- Resend - transactional email (invites, password resets, payment notices).
- Sentry - error monitoring.
- Google Analytics - traffic analytics on the marketing site and the signed-in dashboard only.
How the app is protected
- All traffic is served over HTTPS, with HTTP Strict Transport Security.
- A Content Security Policy and anti-framing headers limit which scripts can run and stop the app from being embedded in other sites.
- Passwords are stored as bcrypt hashes, never in plain text. New accounts must verify their email address before signing in.
- Sign-in, sign-up, password resets, question submission and voting are rate-limited to slow down password guessing and spam.
- Workspaces have two roles: Owners manage billing and membership, Members don’t. Organizer actions are checked against the user’s membership of that workspace.
- Every question passes through moderation before it’s shown to participants or on the speaker screen.
Reporting a security issue
If you believe you’ve found a security vulnerability, please tell us through the contact form with enough detail to reproduce it. Please don’t access other people’s data or disrupt the service while investigating.