Privacy policy

When you send me a message

The contact form asks for your name, your email address, your company or role if you want to give it, and your message. They are sent to my email inbox through Resend, an email delivery service, and are not saved in the site's database. I use them to reply to you.

Murat AI

What you type into Murat AI, and the address of the page you are on, are sent to Google's Gemini API, which writes the reply. Google handles that under its API terms. The site does not save your conversations on its servers. Your browser keeps your past conversations so you can come back to them, until you clear them.

To stop anyone flooding the chat, the server counts messages from each internet address for ten minutes, in memory only. Please don't put anything sensitive into the chat.

The free tools

The tools (card sorting, tree testing, first-click testing, surveys, live polling, the workshop board and the Question Bias Check) store what you make in a Postgres database hosted by Neon. There are no accounts. When you make a study, your browser keeps its secret owner key, and the key is what lets you see the results and delete it.

Depending on the tool, the database holds:

• a study's name and setup: its questions, cards, menu, tasks, instructions and settings
• in a first-click test, the screenshots its owner adds, stored in Cloudflare R2 and served from files.itsmurat.com under a random name, and for each person the point where they first clicked on each screen and how long that took. Everyone who takes part sees the screenshots, so leave anyone's personal details out of them
• the answers people give, how long they took, a participant label such as P7, and a short one-way hash of their browser details and internet address, used to spot duplicate and automated submissions
• in a live session, each vote and question, with the name the asker typed or none if they asked anonymously, and a random token the participant's browser makes so the same person can't vote twice
• on a workshop board, everything on the board (notes, text, shapes, drawings, pictures and votes), and while you are on it, the name, animal and colour you picked, where your cursor is and what you are typing into, so others can see who is there
• pictures added to a board, which are stored in Cloudflare R2 and served from files.itsmurat.com under a random name. Anyone who has a picture's address can open it, so only add pictures you are happy for everyone with the board link to see
• link cards: when you paste a web address onto a board, the site's server fetches that page to read its title, description and preview picture, and keeps a copy of the picture with the board's other pictures. The linked site sees a request from this site's server, not from you or the people viewing the board
• for the Question Bias Check, nothing unless you save a check. The script you paste is sent to Google's Gemini API to be checked; a saved check keeps the script and the result. The same check in the live polling and survey builders sends the questions to Gemini and keeps nothing
• theme summaries: when the organiser of a live session or survey asks for the themes in an open question's answers, the server sends those answers to Google's Gemini API to be grouped. The summary goes back to the organiser and isn't stored

Studies you take part in

A study, survey, session or board is run by the person who made it and sent you the link, not by me. They see everything you answer or put on it, and if they publish their results, so can anyone with the results link. Answers are not tied to your name unless the study asks for it or you type it in.

To have an answer removed, ask the person who sent you the link: they can delete their study. If you can't reach them, email me with the link and I will help.

Analytics

The site uses Google Analytics, Vercel Web Analytics and Vercel Speed Insights to see which pages are read, how fast they load and what breaks. They record the pages you visit, where you came from, your device and browser, a rough location worked out from your internet address, and a few actions such as opening Murat AI or using a calculator. Those events carry counts and lengths, never what you typed.

There are no ads on the site, and analytics is not used to target any.

Cookies and browser storage

The site sets two cookies of its own, and only when you enter a password: one opens the protected case studies and one opens the tools' admin page. Each is signed so it can't be forged, and lasts 30 days. Google Analytics sets its own cookies to tell visits apart.

Your browser also keeps:

• your light or dark theme
• your Murat AI conversations
• the studies you made, with their owner keys
• on a workshop board, your name, animal, colour and sound settings
• in a live session or survey, a token and your progress, so a second visit doesn't count twice
• which tip cards you've seen while the tab is open, whether you hid them or went to support from the coffee card, and the last 10 days you visited a page with them, which the coffee card stamps

Other services the site relies on

Each of these handles what it receives under its own terms and privacy policy.

• Vercel hosts the site and keeps short-lived request logs, which include internet addresses
• Neon hosts the tools' database
• Cloudflare stores the pictures added to workshop boards and first-click tests, and runs the site's domain names
• Resend delivers the contact form's emails
• Google runs the Gemini API behind Murat AI, the Question Bias Check and the theme summaries, and Google Analytics
• SomaFM: when you open the radio on a workshop board, your browser loads the stations' logos from SomaFM, and a station plays in SomaFM's own player on its site
• NurQuran: the NurQuran case study shows the live app and its screenshots from app.nurquran.org, which has its own privacy policy
• Ko-fi, Stripe, PayPal, Venmo, Wise, Square and the Algorand network, if you choose to support the site. I receive what they pass on, such as your name, email address, amount and message, and never your card details

How I use it

To run the site and its tools, reply to messages, keep the site working and stop abuse, and see what people find useful. I don't sell personal information or share it for advertising.

How long it is kept

Studies and boards stay until their owner deletes them; most other data goes within an hour to a day, or stays in your own browser. The data retention page has each one, and how to ask me to delete something sooner.

Your choices

You can read the site and use every tool without an account, block or clear cookies and site data in your browser, and delete your own studies from Your studies. Wherever you live, you can ask me what the site holds about you, and ask me to correct or delete it. Email me and I will reply as soon as I reasonably can.

Children

The site is meant for adults working in product, design and research. It isn't aimed at children under 13, and I don't knowingly collect their information. If you think a child has sent me something, email me and I will delete it.

Changes

When the site changes what it collects, this page changes with it and shows a new date at the top.