Skip to content
Where We're At

Privacy Policy

Last updated 3 November 2026

Where We're At is an annual survey of the people building on the AT Protocol. The 2026 survey closed on 1 November 2026. This site now publishes its results and an anonymized dataset, and this page describes every piece of data that was collected while the survey ran and what happens to it now.

Who is responsible

The controller under Article 4(7) GDPR is Louis Escher, Marsweilerstrasse 20, 88255 Baindt, Germany, who runs this survey as an independent project. Reach the controller at [email protected]. There is no statutory data protection officer, because the thresholds in section 38 BDSG are not met.

What was collected about your account

Taking part needed a sign-in with AT Protocol OAuth. Your password was entered on your own PDS and never reached the survey. What the survey received and stores about your account is:

  • your DID, the stable identifier for your account
  • your handle at the time you signed in
  • your PDS host and your DID method, read from your DID document
  • the creation date of your account, read from the PLC audit log, which exists to make a wave of accounts created the week the survey opens visible
  • when you first signed in and when you were last seen

Your DID also ties your answers to one response, which is what kept a single person from filling the survey in twenty times.

This site has no sign-in. The OAuth tokens and sign-in sessions stored while the survey ran are deleted together with the Workers KV store that held them.

What the survey stores

Your answers were saved as you went, one section at a time. Alongside the answers themselves, each response carries when it was started, when it was last changed, how long it took, how complete it is, whether you finished it, and whether you consented to the public dataset.

Anything you typed into a comment box or a free-text question is stored exactly as you wrote it.

The pseudonym

Each response also carries a pseudonym: an HMAC-SHA256 of your DID under a secret key that only the operator holds. Once the 2026 report is published, your DID, handle, PDS host and DID method are deleted and the pseudonym stays, so the 2027 edition can tell whether the same person answered twice without holding an identifier that points back at you. The pseudonym is still personal data under the GDPR and is treated as such.

Cookies and browser storage

This site sets no cookies, which is why there is no cookie banner.

The theme switch stores your choice of day or dusk in localStorage under the key sky. It never leaves your browser.

There is no analytics, no advertising and no tracking of any kind on this site.

Who else is involved

Hosting

The site runs on a server operated by the project. The server handles connection data including your IP address, and request logs are kept for operational monitoring.

Cloudflare

Responses collected while the survey ran are stored in Cloudflare D1. Cloudflare acts as a processor under Article 28 GDPR. Processing can happen on servers outside the EU, covered by Cloudflare's data processing addendum and the standard contractual clauses.

Fonts

Both typefaces are served from this domain. Your browser makes no request to Google Fonts.

What gets published

The published results contain aggregate numbers. No individual response appears in them.

The anonymized row-level dataset published alongside them contains only finished responses whose author ticked the consent box on the submit page. In that file your identity is replaced by a random per-edition id that has no connection to your DID or your pseudonym, it contains no free-text prose, and rare combinations of country, role and company size are coarsened before release.

How long things are kept

Your response, with your DID attached
Until the 2026 report is published in January 2027.
Your account details
Deleted at the same point. Handle, PDS host, DID method and account creation date go with the DID.
Your answers under a pseudonym
Kept for as long as the survey runs as an annual series, so editions can be compared. The retention is reviewed at the start of each edition.
Free text awaiting normalization
Raw text is kept in a normalization table so the mapping from what people wrote to a known tool stays reproducible. It carries no identifier.
The published report and dataset
Permanent. Both are anonymous and cannot be withdrawn once published.

Legal bases

  • Your answers are processed on your consent under Article 6(1)(a) GDPR, given by answering, and withdrawable at any time.
  • Publishing your answers in the open dataset rests on the separate consent you give with the checkbox on the submit page.
  • Your DID, handle, PDS host, DID method, account creation date and the timestamps rest on legitimate interests under Article 6(1)(f) GDPR: running a survey that cannot be trivially stuffed, and being able to exclude a coordinated batch of responses.
  • Operating the site securely, including the server's connection logs, rests on the same legitimate interest.

Nothing here involves automated decision-making or profiling within the meaning of Article 22 GDPR.

Your rights

You can, at any time:

  • have your response deleted by writing to[email protected], which is also how you withdraw your consent
  • ask for a copy of everything held about you, under Article 15
  • have anything inaccurate corrected, under Article 16
  • have your data erased, under Article 17
  • have processing restricted, under Article 18
  • receive your answers in a machine-readable form, under Article 20
  • object to the processing based on legitimate interests, under Article 21, on grounds relating to your situation

Withdrawing consent leaves everything done before the withdrawal lawful. Aggregate figures already published cannot be pulled back out, because they no longer identify anyone.

Send any of these to [email protected]. Requests are answered within one month.

Complaints

You can complain to a supervisory authority, in the member state where you live, where you work, or where you think something went wrong. The authority responsible for the controller is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Minimum age

The survey was open to people aged 16 and over, the age at which consent under Article 8 GDPR is valid in Germany.

Changes

This policy changes when the project changes. The date at the top says when it was last revised, and the full history is in the project's public repository.