Privacy Policy

Miqyas ("Miqyas", "we", "us", "our") is, at the time of writing, a pre-company beta project operated by hhamad.net. We have not yet incorporated a separate legal entity for it. Until we do, hhamad.net is the controller responsible for the personal data described in this policy.

Postal address: [PLACEHOLDER: a postal address where legal correspondence can reach us]. Email: contact@miqyasdata.com.

We will update this section — and the effective date above — the moment this changes, for example once we incorporate a company. Who the controller is matters for how you exercise the rights described below, so we will not let it go stale.

Miqyas is a research data-collection platform: organizations ("customers") use it to design surveys, distribute them, and review the responses people submit. Personal data flows through Miqyas in six different ways, and this policy is organized around them — look for the section that applies to you:

We do not run any third-party analytics, advertising, or marketing tracking on this website. There is no tracking pixel, no advertising network, and no behavioural profiling.

We do keep a simple tally of how often each of our pages is opened, so we can tell which ones are useful. It is a single running total per page, per language, per day, kept on our own servers — we do not store anything at all about the person who opened the page: no identifier, no cookie, no IP address, no browser details, and no time more precise than the day. Because the tally is only ever a number going up, it cannot be traced back to you, and there is nothing in it for us to link to anything else.

Like effectively every website, our hosting provider’s network handles standard connection information (such as your IP address and browser type) purely to deliver the page to you and keep the service secure from abuse. We do not use this information to identify or profile visitors.

There are exactly two things we ever ask a visitor to type in. One is an email address, to join our pre-launch beta waiting list, offered near the foot of our homepage and again after you complete a survey — see "If you join the beta waiting list" below. The other is the short form for research teams asking to use the platform, at the foot of our homepage and on our contact page — see "If you ask us for access to the beta" below.

If you email us instead, see "If you contact us" below.

If you sign up to use Miqyas on behalf of a research organization, we process:

To run and troubleshoot the platform, we keep a small amount of technical operational data: which kind of action was taken, roughly how long it took, and whether it succeeded. It is kept as counts and timings — how many of a thing happened and how fast — and it is not tagged with your account identifier. It is not a record of what you personally did.

The pages people use to answer a survey are measured the same way, because we need to know if they are slow or failing. What is recorded is a count and a duration. There is no cookie, no tracking pixel, no device or browser identifier, no IP address, and nothing that identifies a respondent or that can be linked back to a response.

Some of these counts are per survey — how many responses we have finished processing for it, and how far behind that processing is. We keep that detail because "one of your surveys is running slowly" is not something we could act on, while knowing which one is. It is a number of responses and a delay, never their content and never anything about who sent them.

This data is held for us by Fly.io, our hosting provider, in their monitoring service. It is the same company that already runs the platform, the database and the file storage described below — so this is a second purpose for a provider that already holds the underlying data, not a new company gaining access to it. We chose it over a separate monitoring company for exactly that reason. It is kept for about 15 days and then deleted automatically. We set no longer period.

A small number of Miqyas administrators can suspend an account, lift a suspension, and change what an account is allowed to do. A suspension blocks sign-in and ends any session that is already open. It does not delete anything you or your organization have created, and it can be reversed.

Whenever one of them takes such an action, we record who took it, which account it affected, what changed, the reason they gave, and when. We keep that record so that a decision affecting you can be explained and, if necessary, justified — including to you. The reason is written by our staff for our own accountability: it is not shown to the person whose account was acted on, and it is never included in any notification we send.

An administrator can also see where your account is currently signed in — the approximate device and the network address of each open session — and end any of those sessions, which signs that device out. Because that view discloses your addresses and devices to a member of our staff, opening it is itself recorded, in the same record and for the same 36 months: who looked, at whose account, and when. The list is never shown as a side effect of an administrator simply opening your account page; it appears only when one of them deliberately asks for it, so that each entry corresponds to a decision someone actually made.

An administrator can correct the details held on your account — your display name, your email address, and the country recorded against it — for example when an address was mistyped when the account was created. When one does, the record described above keeps the value that was replaced: your previous name or your previous email address is retained, for the same 36 months, as part of the record of what changed. If your email address is changed by our staff, we send a notice to both the old address and the new one, so that a change you did not ask for reaches you at an address you still hold. An administrator can also mark an address as verified, which is recorded in the same way.

An administrator can add your account to one of our customer organizations, remove it from one, or change the role you hold inside it. Being removed from an organization ends your access to that organization’s work; it does not suspend your account and does not sign you out, and you are told in the app when it happens.

If you hold a field-collector account, an administrator can also see, on one screen, the areas you have declared yourself available for, the organizations that have engaged you, the devices holding collection credentials for your work, and any organizations you have asked not to be contacted by. That is not new information about you — it is what your own collector portal already shows you, and what the sections below already describe — but it is now visible to our staff as well, which is why we say so here.

If your account is suspended, we tell you so when you try to sign in, rather than giving you a misleading message about your password. If your role changes, or a suspension on your account is lifted, you receive a notification in the app.

Miqyas lets you connect an external AI assistant — Claude, ChatGPT, or any other client that speaks the same protocol — so you can ask questions about your own survey data in plain language. You start from the assistant, it sends you to Miqyas, you sign in and approve it on a screen that names it, and you are sent back. No password, key, or token is ever created for you to copy, and none is ever shown to you or held by you. This is entirely optional, off by default for every organization, and only an organization owner or administrator can switch it on.

Before you can approve one, the assistant introduces itself to us and we store the name and web address it reports about itself. We do not verify either — anyone can register an assistant under any name — which is why the approval screen shows you what it claims to be and says plainly that we have not checked it. Alongside that we keep the date you approved it and the date it was last used, so you can recognise it later on your connections page.

Miqyas does not run, host, or call any AI model. Your assistant runs on your side and calls us; we only answer. That means we add no AI sub-processor and make no transfer to one — but it also means the assistant you choose, wherever it runs and whatever it does with what it receives, is your responsibility and outside our control. Before connecting one, satisfy yourself that sending your organization’s research results to it is something you and your organization are entitled to do.

A connection can read exactly what you can already read in that organization, and nothing more. It sees the same surveys, is bound by the same regional restrictions, and stops working by itself the moment you leave the organization or lose access to analytics — no one has to revoke it. It cannot change anything, and it cannot reach another organization’s data.

What it returns is aggregated results — counts, averages, totals grouped by a question’s answers — never individual responses, never free-text answers, and never anything identifying a respondent. Please note that aggregated is not the same as anonymous: a result computed from few enough people can still say something about them, and the "hide small groups" setting available on charts is a presentation option, not a privacy or anonymisation control. We do not present these results as anonymised or de-identified data, and neither should you.

We keep a record of every connection’s use — who used it, when, which capability, which survey, and the names of the questions involved. That record never contains the values you filtered by, because a filter value can itself be someone’s answer. You can read the full history of your own connections at any time on your connections page, and your organization’s owners and administrators can read the whole organization’s.

Three separate retention periods apply. Access records are kept for 12 months and then deleted automatically. The saved request behind a result link is kept for 30 days and then deleted — a shorter window, because unlike the access record it does contain the values you filtered by. A connection itself lasts until you withdraw it, or lapses on its own if it goes unused for a long time. If your account is deleted, your connections and any saved requests go with it, and your name is removed from the access records; the entries themselves remain, under a randomly-derived reference that identifies nobody, because they record data leaving the platform and that record has to survive.

You can withdraw any connection instantly from your connections page, and an owner or administrator can withdraw any connection in the organization or turn assistant access off entirely. A withdrawn connection is refused the very next time it is used — not when some token happens to expire — and withdrawing also clears your approval, so connecting that assistant again asks you afresh rather than resuming quietly.

Registering as a data collector starts by giving us an email address. We send a short code to it to confirm the address is yours, and only create an account once you enter that code and choose a name, country, and password.

Between those two points we hold the address you typed, a one-way hash of the code (never the code itself), when it expires, how many attempts remain, which version of these terms you were shown, and which language you were reading in. We do this to create the account you asked for — in legal terms, because it is necessary to take steps at your request before entering into a contract.

If you never finish, that record is deleted 30 days after you started. Nothing else is kept: we do not add the address to any list, do not email you again about it, and do not share it with anyone. If you do finish, the record is replaced by your account and is deleted on the same schedule.

We also count how many registration messages have been sent — to each address, from each network address and neighbourhood, and across the platform as a whole — so that nobody can use registration to send mail to other people. These counts are kept for two days and are not linked to an account.

Some organizations gather responses in person, through trained field collectors, instead of or alongside public web links. There are two ways to hold a collector account: you can register yourself, or an organization can ask us to create one for you. Either way we process your name and email address, your password (stored only as a one-way hash, as above), the country you collect in, the surveys you have been engaged to collect, the fee terms the organization agreed with you for that work (a rate per accepted submission, its currency, and any deadline), and basic records of those engagements and when your device was last active — used to run the collection service and keep it secure. The fee terms are set and used by the organization that engaged you; we store and display them on its behalf.

If you registered yourself, we do not check your identity, your experience, or your right to work anywhere, and we do not tell organizations that we have. Holding a collector account means you confirmed control of an email address and told us which country you work in — nothing more. Organizations choose for themselves whom to offer work to and which responses to accept.

When you gather a response, that response is labelled with your name and account so the organization can see who collected it. This attribution is recorded once, at the time of collection, and is kept alongside the response for as long as the organization keeps the response itself; because it records who collected the data at that moment, it is not erased if your account is later renamed or deleted. A collector account is a distinct kind of account — it is not an organization-member account and cannot see the researcher application.

When the organization accepts a response you collected, we record the fee it owes you for that response against your collector account, building a running record — in the currency agreed for the engagement — of what you have earned. This financial record is permanent: individual entries are never edited or removed, only corrected by adding a further entry, so your balance and its history are retained indefinitely as part of our financial records. When a payment is made to you, we record it against the same account: the amount, the method used (cash, for now), the date it physically changed hands, the receipt or voucher number identifying it, and which of our administrators recorded it. We keep the receipt number so that the same payment cannot be recorded twice; a payment recorded in error is corrected by recording a reversal, never by deleting it. Each earning is also linked to the survey it came from, so you can see which work produced which amount. This information is stored on our own EU infrastructure and is not shared with any advertiser or data broker.

Your collector account also has an in-app inbox. We write a notification to it when an organization offers you work on a survey, when it ends one of your engagements, and when submissions you collected for a survey are approved or rejected — the last of these tells you how many, not which ones. These notifications stay in your inbox until your account is deleted, and are shown only inside Miqyas — we do not email, text, or push them to you, and no third-party notification service is involved.

You can tell Miqyas which administrative areas you are able to collect data in — a governorate, a district, or any mix of them — and turn on a switch that makes you findable by organizations searching for collectors in those areas. Both are entirely your choice. The areas you declare are personal data about you, and nothing about you is searchable until you turn that switch on. You can turn it off, or change or remove your declared areas, at any time; doing so stops you appearing in future searches immediately, and never affects work you have already agreed to.

While the switch is on, an organization searching an area you have declared is shown that someone available covers it, together with a summary of your track record on the platform — a band rather than a figure, such as "high approval" or "experienced" — and a code name that is meaningless outside that one organization's own results. It is not shown your name, your photograph, your email address, your other declared areas, or which organizations you have worked for. Each organization sees a different code name for you, so two organizations cannot compare notes to work out that they are looking at the same person.

Your name and photograph become visible to a particular organization only when you accept an offer of work from it. Declining an offer, letting one expire, or having one withdrawn discloses nothing: in each of those cases the organization learns only that the offer ended. Your email address is never shown to an organization, in any state, however the relationship began.

The track record shown alongside your code name is drawn from your work across the whole platform, not only from the organization looking at it. It is based on decisions people actually made about your submissions — automatic acceptances are counted as work delivered but are not treated as anyone's judgement of it — and an approval rate is published only once more than one organization has assessed your work, so that no single organization's review habits define how you appear to everyone else.

When you decline an offer you may also tell us that the organization should not contact you again. We then keep a record that they may not reach you, which hides you from that organization's searches and prevents it offering you work. The organization is not told that you did this, and it does not affect any engagement already running with them. You can lift it at any time from your portal.

We keep a record of every collector search an organization runs — which organization, which member of it, the area searched (including the outline if they drew one on a map), how many collectors matched, and when. We do this to detect and investigate anyone attempting to map out collectors area by area, which is a real risk of making people findable at all. These records are readable only by our administrators, are never shown to any organization, and are deleted after 12 months.

When an organization sends you an offer of work we tell you in your portal, and we also email you — once when the offer arrives, once more if it is about to expire unanswered, and once if it is withdrawn. The email names the organization and the survey and links to your portal; it does not contain the fee, the area, or the dates. These emails are on by default, because an offer you never hear about simply lapses. You can switch them off at any time from Settings in your portal, or from the link at the bottom of any of them without signing in; offers then reach you in the portal only. We write in your preferred language; if we do not know it yet, because you have not signed in since we began recording it, we write in both Arabic and English.

If you are filling out a survey created by a Miqyas customer organization, that organization is the controller of your responses — they decide what to ask and why. Look to their own communications, and any privacy notice shown on the survey itself, for that context. What follows describes the structural guarantees Miqyas itself builds into every survey, regardless of which organization created it.

Every survey is set to one of two modes by the organization that created it, and the mode is disclosed to you before you answer:

A small number of surveys ask a question by presenting a list the organization has already built up — for example, "which household is this a follow-up for?" drawn from an earlier registration survey. Answering that kind of question means the list of records (for instance, other households' names) is delivered to your device so you can pick from it — visible to anyone who opens that survey's link, not only to you. The organization that built the list is its controller, exactly as with any other survey content they configure; Miqyas stores and delivers it on their behalf, in the same region as the rest of that study's data (see "What we collect on every survey" below), and reaches you only through the survey link itself.

We ask you to self-declare your country at the start (we never infer it from your IP address). Depending on your answer, we may ask for your explicit consent — to your response being stored outside your own region, or to providing a sensitive category of information the survey has declared it collects. If your declared country is one we have determined we cannot lawfully accept responses from, we tell you plainly and do not collect anything.

Your response is stored in one specific region (for example, the European Union), decided by the organization before the survey opens and never changed afterwards. It is technically unreachable from any other region.

Some responses are gathered in person by a field collector using the ODK Collect mobile app rather than a web link. In that case your answers are held on the collector’s own device — the app is built to keep working without a connection — until the device is online and sends them to us, and the device and app also transmit the basic technical information needed to deliver the survey and receive your response. While your answers are on the device they are under the control of the organization running the survey and its collector, who is responsible for telling you, in person, how your data will be used; once we receive them, they are stored under exactly the same regional and anonymity guarantees described above.

To protect the integrity of survey data against automated and abusive submissions, we apply lightweight automated checks to responses submitted through public links: how long the response took to complete (measured on our own servers), whether the browser identifies itself as automated, and a hidden field that only automated form-fillers tend to fill in. These checks produce internal, advisory quality flags visible only to the research organization reviewing the responses — they never change, reject, or discard a response, and they involve no new third party. We do not store your IP address, a device fingerprint, or any similar identifier alongside your response for this purpose.

Every survey page offers you a way to report a problem with it — a confusing question, something displaying incorrectly, or a survey asking for information its privacy notice did not declare. What you write there is free text, so it can contain anything you choose to put in it, including details about yourself. Until now those reports were only written to our application log and were, in practice, lost. They are now kept as a record our own staff work through: we store the reason you selected, what you wrote, and which survey and organization it concerns, for 36 months and then delete it. We do not store your name, your IP address, or a link to the answers you submitted — nothing connects a report to a response, including for us. Reporting a problem is always optional, and it never affects the response you submit.

We count how our own survey links are doing, on our own infrastructure: how many times a link was opened, how many responses it produced, which three-hour window (UTC) an opening fell in, and which questions people could not get past when they pressed Send. These are tallies and nothing else — one row holds a day, a link, a window, and a number. There is no identifier for you in any of them, no IP address, no device or browser information, no time more precise than the three-hour window, and nothing that connects any of it to the answers you submitted, including for us. Two openings and two hundred are the same row with a different number in it. Nothing is stored on your device for this, and nothing is sent to anyone else.

We do not run any third-party analytics or tracking on the survey-filling experience.

On our homepage, and again after you complete a survey, we may offer you a place on the waiting list for the beta of our own platform — an account of your own, surveys you take part in yourself, and rewards for completing them. Joining is always optional; if you were offered it after a survey, declining does not affect the response you just submitted.

If you join, we store your email address, the interface language you were using, the day you joined — the day only, never the time — and which of those two pages you joined from. We do not store the survey you had just answered, the organization that ran it, or your IP address. No field in our systems could hold that link, so a signup cannot be traced back to a response, including by us.

Signups sit in the same EU database (Frankfurt, Germany) as the rest of our infrastructure, so no new sub-processor is involved. We will use your address for one thing only: a single invitation when the beta opens. Before it goes out, we will tell you plainly what a survey owner would be able to see about you as a registered respondent. You can leave the list at any time by emailing contact@miqyasdata.com.

At the foot of our homepage, and on our contact page, research teams can ask us to set them up on the beta. The form asks for your name and email address, which we need in order to reply, and optionally for your organization and a short description of what you are planning to collect, which help us give you a useful answer. Only the first two are required.

Please describe your study rather than any individual: the description box is free text, and there is no reason to put anyone’s personal details — least of all sensitive ones, such as anything about a person’s health, beliefs, or background — into it. If you do, we will remove it.

We store what you typed together with the interface language you were using, which of the two pages you sent it from, whether we have replied yet, and the date and time it arrived. We use it for one thing: to reply to you and, if it goes ahead, to set up your organization. We do not sell it, we do not add you to a marketing list, and we do not send you anything you did not ask for. It sits in the same EU database (Frankfurt, Germany) as the rest of our infrastructure, so no new sub-processor is involved.

This is separate from the beta waiting list described above, in our systems as well as on the page: that list is for people who want to answer surveys and is deliberately built so that a signup cannot be traced to any response, while an access request is you introducing yourself so that we can write back. Ask us at contact@miqyasdata.com and we will delete your request.

We keep the list of parties who can access personal data through Miqyas short:

We do not sell personal data, and we do not share it with advertisers or data brokers. Beyond what is listed above, we only disclose personal data if required by law, or to protect the rights, property, or safety of Miqyas, our users, or the public.

We use one cookie that is strictly necessary for the service to work: miqyas.session_token, which keeps you signed in after you log in. It is not used for advertising or tracking, and — because it is strictly necessary — it does not require a consent banner under EU cookie rules.

Your interface language and light/dark theme preference are stored in your browser’s local storage, not in a cookie. That information stays on your device and is never sent to us.

If you are filling out a survey, your in-progress answers are saved on your own device, in your browser’s storage, as you go — so you can close the page and continue later from the same device. This draft — your answers, the country you selected, and any files you have attached — stays on your device and is never sent to us before you submit. It is deleted automatically when you submit the survey, when you choose to start over, and in any case after 7 days.

When a survey is set to accept only one response per person, we place a small marker in your browser’s storage after you submit, so that the same browser cannot be used to send a second response. This marker records only that a response was submitted — never who you are, and no identifier or device fingerprint — and it never leaves your device. Clearing your browser’s storage or using a different browser removes it.

We do not use any analytics, advertising, or third-party tracking cookies today. If that ever changes, we will update this policy first and ask for your consent where the law requires it.

Under the GDPR, you have the right to:

If you are a survey respondent, please contact the organization that ran the survey first — they are the controller of your responses and best placed to act on your request. We will support them in doing so.

For anything else, contact us at contact@miqyasdata.com and we will respond as quickly as we can.

You can lodge a complaint with the data protection supervisory authority of the German state (Land) where we are based — [PLACEHOLDER: name of the relevant Landesdatenschutzbehörde once our operating address is finalized] — or the authority in your own country of residence.

Miqyas is intended for use by adults working on or participating in research studies. We do not knowingly collect personal data from children, and if we learn that we have, we will delete it.

We review this policy whenever something changes about what personal data we collect, process, store, or share — a new sub-processor, a new feature that touches personal data, a new hosting region — and update the date at the top when we do. We are currently a small, fast-moving beta project, so expect this page to change more often than a mature company’s would; we would rather keep it accurate than stale.

Questions about this policy or your data: contact@miqyasdata.com, or use our contact page.