Privacy
In short: your email goes to MailerLite for one email per sheet. Your answers stay on your phone unless you choose "Yes, use my answers" at the end of the quiz. We never sell any of it.
What we collect
Your email address, when you join the list. We send it to MailerLite with the time you joined, which is our record that you asked to join, and nothing else: no IP address. You are on the list at once, with no confirmation step, and a welcome email follows straight away. The sheets open at once. MailerLite records, against your address, whether each email it sends you is opened, through an invisible image in the email, and which of its links you click, through links that pass via MailerLite first. We do not use Google Analytics or any other tracking in the emails.
Joining sets a cookie that marks this browser as joined, so the sheets open without asking for the address again. It lasts a little over a year (400 days) and holds nothing else. Joining also sets a second cookie, for the same time: a pseudonymous one, holding a code made from your email with a secret key (never the email itself) and an id for this device. Nothing is kept under that code until you choose "Yes, use my answers" at the end of the quiz.
While you read and answer, your place, your answers, how sure you were and the days you come back are recorded in this browser only. When you finish the quiz, it asks once whether we may use your answers. If you say "Yes, use my answers", what this browser recorded during that session is sent to us once, and from then on we keep which cards and entries you open and for how long, your quiz picks and how sure you were, and the days you come back. These are stored under that code, never under your email. Nothing is sent before you say yes. If you say "Keep them on my phone", or never reach the end of the quiz, nothing is ever sent. You can change your answer later: turn it off on this page, or on from the end of the quiz.
Before you join, we count page views under a code that lasts one browser tab and is never linked to you later.
If you send a report from the feedback page, we keep what you write, the evidence and link you add, the card or question it is about, and a reply address if you give one. The copy we work from has email addresses, phone numbers and ID numbers masked; where masking changed something, the original is kept so a correction can be checked. Do not include patient details.
What we never collect
What you type before you send it, including an address that failed to send. Your full browser details, the full page you came from, or keystrokes. We do not store your IP address: our rate limits use a scrambled form of it that expires within minutes. If your browser sends Global Privacy Control, nothing changes for you: nothing is sent unless you choose "Yes, use my answers".
What it is for
To open the sheets, to send a welcome email and then one email when each new sheet is up, to find which beliefs residents hold and which cards need work, and to check and correct the sheets from your reports. We do not sell any of it or share it for advertising.
Who holds it
Butters is run by an individual anaesthesia resident in Saudi Arabia, who is responsible for your data. Three services hold it, all outside Saudi Arabia. Cloudflare runs this site and holds reports until they are moved to the author's own computer. Neon holds your answers and a copy of each report, in its Frankfurt region (aws-eu-central-1); it never holds your email address. MailerLite holds the email list. Only the author reads reports and answers.
How long
Page views counted before joining: 90 days. A reply address given with a report: 90 days. A report: 12 months after it is closed. Your answers: until you ask for them to be deleted, or 24 months after your last visit. Your email address: until you leave the list; every email has an unsubscribe link. Reply addresses are removed automatically; the other limits the author applies by hand for now.
Your rights
You can ask what we hold about you, ask for it to be corrected or deleted, or withdraw your consent at any time. Stopping the use of your answers takes effect at once and nothing more is kept. If you ticked the box when you joined, before consent moved to the quiz, that choice stands until you stop it here. We act on a deletion request by hand within 30 days, across every copy: the database, the report spool, the author's computer and the email list. Every email has an unsubscribe link, and leaving takes effect at once. If an email from us reaches you and you did not join, unsubscribe from it or write to us, and the address is removed. Write to [email protected].