Privacy Policy

This policy describes how Piper (“Piper”, “we”) handles your information when you use the Piper panel — the website, the app, and the surveys you answer through them. It covers you as a panelist. Our Terms of Service govern your account, your rewards, and what happens to your answers.

Piper is operated by a company incorporated in the United States, and that company is responsible for the personal information described here. Email [email protected] and we will tell you its legal name and registered address.

The panel is open to residents of the United States who are 18 or over, and this policy is written to United States law. If we open other countries we will update it before we do.

• Account details — your email address, your first and last name, your country, your date of birth, and your gender, collected when you sign up. Your password is stored only as a one-way hash. If you sign in with Google or Apple we hold no password at all.
• Profile answers — the demographic and lifestyle questions you choose to answer so surveys can be matched to you. Every one is a choice from a fixed list, there is no free-text box in your profile, and answering any of them is optional. Some are sensitive; see section 4.
• Participation records — which surveys you were offered, which you started, completed, were screened out of, or let expire, and quality signals such as whether an attention check was passed. The answers you give inside a survey are held by our survey platform, described in section 5, rather than by the panel itself.
• Earnings and payouts — your credit ledger, your balance, your payout history, and the redemption link for a reward you have requested. Redemption links are encrypted before they are stored, because whoever can read one can spend it.
• Verification and anti-fraud data — if you verify your phone number we send it to our verification provider and keep only a one-way hash of it, the country it belongs to, and the date. We never store your phone number itself. We also hold a device identifier from our fraud-detection provider and the outcome of automated risk checks — a score and reason codes such as “proxy detected”.
• Device and contact preferences — your notification settings, push tokens for any device where you have turned notifications on, and the time zone your device reports.
• Usage data — product analytics about how the panel is used, recordings of your sessions in the panel, and a referral cookie if you arrive through an invite link. Section 8 explains these.

What we do not collect. We hold no Social Security or taxpayer identification number, no driver’s licence or passport number, no bank account or card number, no precise location — your country and time zone are the most specific location data we have — no biometric or genetic data, no photograph of you, and nothing about your religion, your sexual orientation, or your union membership.

Your IP address. We do not keep your IP address in our own records. It is used at the moment you sign up or sign in, it is seen by the network and fraud-prevention providers named in section 6, and our analytics provider stores it alongside the events it records for us.

We use your information to:

• create and run your account and sign you in;
• match you to surveys you are likely to qualify for;
• run those surveys and record your participation;
• credit your earnings and deliver your payouts;
• verify that you are one real person and keep fraud out of the panel, which is what keeps rewards worth real money for everyone else;
• review answer quality and set your standing;
• send you the notifications you have turned on;
• support you when something goes wrong;
• understand how the panel is used so we can improve it;
• meet our legal, tax, and accounting obligations.

What we do not do with it. We do not use your personal information to advertise to you, or to help anyone else advertise to you. We do not buy data about you from data brokers to fill out your profile. We do not build a picture of you from your activity outside the panel. And, as section 8.2 of the terms says, we do not use your answers to train general-purpose AI models or licence them to anyone who will.

Some profile questions ask about categories that United States privacy law treats as sensitive — your racial or ethnic identity is the clearest example. We ask because customers commission research that targets them, and a panel that cannot represent a population cannot produce honest research about it.

• Every one of them is optional. Skipping a sensitive question costs you nothing except that you will not match surveys that screen on it, and you can clear an answer you have already given at any time from your profile page.
• We use them to match you to surveys, to report demographics to the customer as described in section 5, and to keep the panel honest. We do not use them to infer anything else about you.
• They are never used to set your pay. Your reward for a survey is the reward stated on that survey, and it does not vary by who you are.

This is the disclosure that matters most in a research panel, so it is stated exactly.

What the customer receives. Your answers to that survey, your panelist number, and demographic context: a standard set reported on every survey — your age range, gender, racial or ethnic identity, education, and household income, where you have answered them — together with any additional demographics that customer purchased for their report, and the traits their survey screened on. They can compare answers against those demographics.

What our survey platform receives. When you start a survey we pass the profile answers you have given to the platform that runs the questionnaire, so that it does not ask you again for things you have already told us. That platform is operated by the same company that operates Piper.

What no customer ever receives. Your name, your email address, your phone details, your date of birth, your address, or any other contact detail. To a customer you are a panelist number.

What customers may not do. Under section 8.2 of our terms, a customer receiving your answers may not attempt to determine your identity from them, may not combine them with other data in order to do so, and may not use your words in advertising without your separate consent.

What you control. If you type personal information into the text of an answer, it travels with that answer and we cannot take it back out. A name in particular undoes the protection above, because it attaches your identity to the demographics reported alongside it. Do not put anything in an answer that you would not want a stranger to read.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have never done either.

These service providers process personal information on our behalf. Each receives only what its job requires:

• WorkOS — sign-in. Receives your email, your name, and the identifier for your sign-in method.
• Postmark — email delivery. Receives your email address, your first name where a message is personalised, and the amount on an earnings receipt.
• Twilio — phone verification. Receives your phone number and the verification code.
• Tremendous — payout delivery. Receives your name, your email address, and the payout amount.
• PostHog — product analytics and session recording. Receives a panelist identifier, your email address, your country, your account status, your IP address, and the events and recordings described in section 8.
• Fingerprint — device identification, to catch duplicate and fraudulent accounts. Receives device and browser characteristics.
• IPQualityScore — IP reputation checks at signup and sign-in. Receives your IP address.
• Cloudflare — network security, bot detection, and content delivery. All traffic to the panel passes through it, including your IP address.
• Expo, with Apple and Google — push notifications. Receive your push token and the contents of the notification.
• Amazon Web Services — hosting and the database.
• Sanity — the content of our marketing pages. Receives no panelist information.

We also disclose information where section 9.5 of the terms allows it — to a customer, a payment or verification provider, a taxing authority, or law enforcement — where we reasonably consider it appropriate, and where the law requires it or permits it to protect the safety and integrity of the panel.

Tax. If your earnings in a year reach the threshold at which United States law requires us to report them, we will need to collect the information that report requires, and we will tell you before we do. We do not collect it today.

While your account is open we keep your account record, your profile answers, and your participation, earnings, and payout history.

When you delete your account we remove your name, email address, date of birth, gender, phone verification data, sign-in credentials, profile answers, devices, and notification settings, and we ask our analytics provider to delete your person record and the events associated with it. You can delete your account at any time from your settings.

What stays. Your participation history, your earnings ledger, your payout records, and your anti-fraud records remain, without the identifiers that connect them to you. We keep them because they are financial records with accounting obligations, and because a panel that erased every trace of a closed account could not tell when someone removed for fraud came back. We do not currently delete them on a fixed schedule; we are working towards published retention periods and will state them here when they are in force.

Fixed periods that do apply today. Session recordings are kept for 30 days. Analytics events are kept for up to seven years. Database backups hold a copy of data for up to 14 days after it changes or is removed.

Redeem your balance before you delete your account. Deleting removes the information we would use to confirm that a balance was yours.

If we close the panel. If we discontinue the panel under section 4.6 of the terms, we will tell you first, give you a period to redeem any balance, and then delete panelist personal information other than records we are required to keep. We will not sell the panel’s personal information as an asset.

Your sign-in session is held in your browser’s local storage rather than in a cookie. If you arrive through an invite link we set one cookie, piper_ref, which holds the invite code for 90 days and is removed as soon as you sign up. Our analytics provider sets its own cookies to recognise a returning browser.

We use one analytics provider, PostHog, on a project kept separate from the one used for PickFu’s customer-facing product. It records the pages you visit and the actions you take in the panel.

We record panel sessions. Those recordings can show the pages you visited and what you clicked, including on your profile page, and they capture browser console output. They are kept for 30 days. They cover the panel only — not the surveys you answer, which run on a different system.

We use no advertising pixels, no retargeting tags, and no third-party advertising cookies. There are none on the panel.

We do not currently detect or respond to “Do Not Track” or Global Privacy Control signals sent by your browser. Because we do not sell or share your personal information, there is no sale for such a signal to opt you out of.

We run automated checks that can affect you. At signup and sign-in we score the risk that an account is fraudulent, using IP reputation, device characteristics, and a bot check. During participation we score answer quality using attention checks and response patterns.

These checks can place your account on probation, restrict or suspend it, hold a payout while we investigate, or close it — the consequences set out in sections 9.1 to 9.4 of the terms.

You can ask a person to look. If an automated decision has restricted your account or a payout, email [email protected] and a person will review it. This is a commitment we have chosen to make. It does not change section 9.6 of the terms, under which our decision after that review is final.

Wherever you live, you may ask us to:

• tell you what personal information we hold about you, where we got it, why we have it, and who we have disclosed it to;
• give you a copy of it;
• correct anything that is wrong;
• delete your account and the personal information in it, as described in section 7;
• limit how we use sensitive information, as described in section 4.

We honour these for every panelist, not only those in states whose law requires it. The California Consumer Privacy Act gives California residents these rights and the right not to be discriminated against for using them.

How to ask. Email [email protected], or use the controls in your settings, which are the fastest route for correction and deletion.

How we verify you. For most requests, being signed in to the account is enough. For a copy of specific pieces of information we will ask you to confirm details we already hold, because handing your data to someone impersonating you would be the worse failure. We will not include your password hash, your phone hash, or a payout redemption link in any copy we send you.

How long we take. We will acknowledge your request within 10 days and answer it within 45 days. If we need longer we will tell you why, and take no more than a further 45 days.

If we say no. We will tell you why, and you may appeal by replying with “appeal” in the subject line — a different person will review it. You may also complain to your state Attorney General.

Someone acting for you. You may use an authorised agent. We will ask for your written permission and will still verify your identity directly.

No penalty. We will not deny you service, pay you differently, or give you a worse experience because you exercised a right.

Paying you for your answers is the whole arrangement, so California law treats the panel as a financial incentive programme and asks us to explain the exchange.

The programme. You give us profile answers and survey answers. We pay you the reward stated on each survey you complete. The reward is shown before you start, and you can decline any survey.

Joining and leaving. You join by creating an account. You leave by deleting it, or simply by not answering surveys. There is no penalty either way, and a balance you have already earned is not forfeited because you stopped.

What we think your information is worth. We value it at the reward we pay for it — the amount shown on each survey.

How we reached that. We use the price we actually pay in an arm’s-length exchange: we set the reward, you see it before you decide, and you can decline. We do not resell your information, so there is no downstream sale price to compare it against. Your profile answers on their own earn nothing until they match you to a survey you complete.

Passwords are stored only as modern one-way hashes. Phone numbers are stored only as one-way hashes, never as numbers. Payout redemption links are encrypted before storage. The database is encrypted at rest and is not reachable from the public internet.

Access to production data requires company single sign-on, is limited to named staff accounts with defined roles, requires a fresh re-authentication for sensitive actions, and is written to an append-only audit log — including a record of which staff member viewed which panelist.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and any regulator the law requires, without unreasonable delay.

Piper is for adults. We do not knowingly collect information from anyone under 18. If we learn an account belongs to someone under 18, we will close it and delete its data.

We may update this policy as the panel changes, and the date at the top always reflects the current version.

If a change meaningfully affects how we handle your information — a new category collected, a new purpose, a new recipient, or a longer retention period — we will tell you by email or in the app before it takes effect, and we will say what changed rather than only that something did.

Privacy questions, requests, and appeals: [email protected].