Privacy notice

This notice covers the PennyForYours website, the signed-in app, and the API and AI-agent connection that businesses use to ask questions. It explains what happens to your personal data whether you answer, ask, or both.

The short version

• We collect what we need to run your account, show questions and deliver answers. You sign in with a passkey or a code we email you, so we never hold a password.
• While you answer, the page records a summary of how the answer was made (timings and counts, never what keys you pressed) to check that answers come from people.
• Askers see your answers under a pseudonym that is different for every asker. They never see your name or email.
• Software can hold an answer for checking, but only a person can reject an answer or remove an account, and you can appeal.
• We do not sell your data or show adverts. Google Analytics receives basic measurement requests without cookies on public information pages, and uses analytics cookies only if you accept them.
• We do not train AI models on your data, and no AI provider receives it. Every automated check runs on software inside PennyForYours.
• Our database and server code run in London. Uploaded images are stored in the United States by our hosting provider, Netlify, under the UK’s data bridge with the US.

Who is responsible for your data

PennyForYours is run by David Bryan, a sole trader in the United Kingdom. No company has been formed. David Bryan is the controller of your personal data, which means he decides how and why it is used, and he is the person who deals with data protection questions. If a company takes over the service, we will update this notice and tell you before the change.

How to contact us about your data:

• Use the Help and support form. It works whether or not you are signed in; if you are not, add an email address so we can reply. Signed in, Settings has direct links to get a copy of your data or delete your account.
• By email: hello@pennyforyours.com

We have not appointed a data protection officer. The law does not require one for a service of this kind and size.

What we collect, why, and for how long

You give us almost all of this yourself, or it is created as you use the service. The only data we receive about you from someone else is what an asker writes or shows in a question, and the ratings askers give your answers.

To create an account you give your email (or use Google or Apple) and a display name, and confirm you are 18 or over and live in the UK. A passkey is optional: it makes signing in quicker. New accounts join a waiting list until an invite code or our approval lets them in; until then they cannot ask or answer. To answer, the answering signals must be recorded; without them we cannot offer you questions.

Signing in with an email code, Google or Apple

When you enter your email on the sign-in page, we either offer the passkey saved for that account or email you a 6-digit code. We keep only a one-way hash of the code, for 10 minutes of use, and delete the record a day after it expires. The email contains the code and fixed text only, never anything someone typed. To stop abuse we limit how many codes go to one address and from one connection, and we do not accept temporary inbox services.

If you choose Continue with Google or Continue with Apple (switched off until we turn them on), that company tells us your email address and that it has confirmed it. We keep the email address only: no password, contacts, photo or anything else, and we do not keep the tokens they send. Google or Apple handle your sign-in with them under their own privacy notices.

When you create an account we keep a few advisory signs to help a person decide who to let in from the waiting list: how you signed up, how long the form took, the same signs of automation as the join form, and the country your connection comes from. They never decline anyone automatically.

Asking for an invite

If you request early access or apply to answer, we keep your name, email address, which side you want to join (asking or answering) and what you tell us on the form: for askers, your company, role, what you want to test and how often; for answerers, that you are an adult living in the UK, the topics you are interested in and any expertise; and how you heard about us. We also keep a code made from your IP address that changes every day and cannot be turned back into the address.

We use this only to decide whether to invite you and to send you an invite code by email. A person reads every request. The lawful basis is our legitimate interest in running a fair, invite-only early access. We delete the request 12 months after you sent it, or 12 months after we invite you or decide not to, whichever is later.

The form also has a hidden field that people never see, and notes how long the form was open. A form with the hidden field filled in, or sent within 1.5 seconds of opening, is not accepted. We do not store either check with your request.

Answering questions

When you answer, we keep the option or rating you chose, the words you wrote and when you answered. The asker sees your answer, but not your name or email. Each asker sees you under a pseudonym made with a secret key we keep for that asker, so one asker’s pseudonym for you cannot be matched to another’s.

After you answer, you see how others answered as counts, never their words or names. The asker’s results summary may quote up to three answers word for word.

Topic preferences: the topics you choose to see first or hide on your question board. They only change which questions you are shown, never your pay or Standing, and you can change them at any time.

We also keep a record of which images and askers you have been shown, so that you never see the same picture twice and no single asker reaches you too often. About one question in ten is a known-answer check, used to measure answer quality.

Answering signals

While a question is on screen, the answer page records:

• how long the question was visible (time with the tab hidden is not counted), and how long before you started typing;
• how many times you typed or deleted in the answer box, and your typing rhythm, kept only as six counts of the gaps between key presses, grouped from under 50 milliseconds to over 800 milliseconds;
• whether you tried to paste or drop text (this is blocked);
• how many times the window lost focus and how many times you switched tabs;
• for a question with sound clips: how many clips you started playing, how many you played to the end, and for how long audio was playing. Playing is never required, and not playing a clip never stops you answering;
• signs of automation: whether the browser reports that automation software is driving it, short codes for signs of a scripted or headless browser, how many input events in the answer box were generated by software rather than by you, and, until you start typing, how many times the pointer or a finger moved and one number for how varied the direction of movement was. We never record where on the screen the pointer or your finger went.

When you join, the join form sends three things with your passkey: whether a hidden field that people never see was filled in, how long the form was open before you pressed the button, and the same signs of automation as above (counted from when the page opened). A form with the hidden field filled in is not accepted. The other signs never stop you joining: they are kept with your account, and if they are strong a person looks at your account. We never record where on the screen the pointer went.

With your answer, the server adds a hashed version of your IP address and a keyed hash of your browser’s user-agent string (see IP addresses).

We never record which keys you pressed, other than the answer you send. We do not record where your mouse or finger goes, your screen, your camera, your microphone or your location.

We use these signals to check that answers come from people and not from AI tools, scripts or copied text. Signs we look for include a paste attempt, answering faster than the minimum reading time (measured by our server from when it gave you the question, not only by your browser), timings or counts that our server’s own clock shows cannot be true, text that arrives without typing, a typing rhythm too fast and even for a person, many fewer key presses than characters, frequent tab switching, a browser that is being driven by automation software, an account sending more answers in an hour or a day than a person could, or at a machine-steady rhythm, wording typical of chatbots, and an answer that is a near-copy of another member’s answer to the same question. The wording checks run on software inside PennyForYours; your words are not sent to any outside AI provider for them. Some honest set-ups look unusual too: keyboard-only and screen-reader use, dictation, grammar checkers and text expanders. That is why these signs only hold an answer for a person to look at. The answer page explains this before you answer.

Is your typing rhythm biometric data? No. Data is biometric under UK law only when it can identify a particular person. Six grouped counts from one short answer cannot do that, and we do not use them to recognise you or to link accounts. We use them only to judge whether a single answer was typed by a person.

Quality, Standing and Marks

We keep your known-answer check results, the thumbs up or down askers give your answers, whether your answer matched the asker’s final choice, and the Standing and Marks worked out from these. Marks are points, not money. During early access we also keep internal accounting entries showing what each answer would earn once paid answering opens. No money moves.

When you join with a passkey we record that you passed that check. The service can also store an advisory “personhood” score from an outside provider. During early access no such provider is used and no score is stored: the placeholder software for it is switched off and does not run on the live site. No outside identity or personhood provider receives your data.

Asking questions

If you ask, we keep your question as you wrote it and as it is shown to members, its options, the answer type and number of answers you chose, any image you upload and its description, and the results. During early access a person reviews every new question and image before members see it, and we keep that decision and its reason.

We remove hidden metadata from images, such as location and camera details (EXIF, XMP and comments), before they are stored. The picture itself is not changed, so do not upload images that show people who have not agreed, or personal details such as addresses or car number plates. Images are never at a public web address: only you, members assigned your question and David Bryan when reviewing it can load them.

Sound clips

You can attach one short sound clip to a question, or two to compare. With each clip we keep the clip itself, its length, the one-sentence description you write, any transcript you add, and the time you confirmed that you own the audio or have permission to use it. We remove hidden tags, such as the title, artist, comments and cover picture (ID3, MP4 and Ogg tags, and WAV information chunks), before a clip is stored; the sound itself is not changed, so do not upload recordings of people who have not agreed, or anything that says personal details aloud. A person listens to every clip before members hear it. Sound clips are stored, kept, shown and deleted exactly as images are: in the same storage, never at a public web address, only you, members assigned your question and David Bryan when reviewing it can play them, and they are kept while your account is open and removed by our deletion routine.

Members never see who asked. If an asker uses an AI agent or our API, the question is linked to the organisation and its API key, and to the name the agent gives itself.

If you are shown in a question or image and did not agree to it, contact us and we will remove it.

Businesses and AI agents

Businesses and agent operators have an organisation record (name, type, and the account that owns it) and API keys. We store each key’s name, its visible prefix, a hash of the full key (never the key itself), its permissions and limits, and when it was last used. Questions sent by an agent are kept like any other question. Test keys only ever reach synthetic members, never real people.

Review by a person

David Bryan is the only administrator. He signs in with a passkey and must confirm it again before any decision. Every time he opens a page showing personal data, and every decision he makes, is written to a log that cannot be edited. The log records who did what, when, the reason given and a hashed IP address.

Automated decisions and profiling

Some of our checks are automatic and look at patterns in what you do, which is a form of profiling:

• Holding an answer. If the answering signals show a clear warning sign (such as a paste attempt or answering faster than the minimum time) or the combined score is high, software holds the answer. A held answer does not count in the results and earns no Standing or Marks until a person decides. Our target is a decision within 72 hours.
• Standing. Your Standing is worked out automatically from known-answer checks, askers’ ratings and how often you matched the asker’s final choice. You can see it in the app. In early access it does not change which questions you get or what you earn.

Software never rejects an answer, withholds pay or removes an account on its own. A person looks at the evidence, decides, records the reason and tells you. You can explain your side, ask for the decision to be looked at again and appeal it, using Appeals in the app. No decision with a legal or similarly significant effect on you is made by automated means alone.

IP addresses and browser details

Our own database never stores your IP address. We store a keyed hash of it: a one-way code made from your IP address, a secret key and the date, so the same address gives a different code each day. Without the secret key the code cannot be turned back into an address. Someone holding the key could test every possible address to find a match, so we treat these codes as personal data and keep the key secret. We store them with sessions, answers and the administrator log, and use them in request-limit counters, to spot abuse such as many accounts answering from one place.

We also store a keyed hash of your browser’s user-agent string, which describes your browser and device type. It is made the same way as the IP code, with the same secret key and the date, so it changes every day and cannot be worked out from a browser name without the key. We use it only alongside the IP hash to spot abuse.

Our hosting provider, Netlify, receives your full IP address with every request in order to deliver the site and protect its network (see Who we share data with).

Our lawful bases

UK data protection law requires a lawful basis for each use of your data. The table above gives the basis for each kind of data. In more detail:

• Contract. Running your account, passkeys and sessions, showing and answering questions, delivering answers and results, and keeping Standing and Marks are the service you joined.
• Legitimate interests. Answering signals, hashed IP addresses and browser details, known-answer checks, fraud signals, holds, receipts, request limits and the administrator log. Our interests are making sure answers come from real people, which is what askers rely on, and keeping the service and your account secure; the law recognises network and information security as a legitimate interest. We keep these signals to timings, counts and hashes so they reveal as little as possible about you, and only a person makes decisions. You can object at any time (see Your rights).
• Legitimate interests (site measurement). Google Analytics requests without cookies on public information pages, sent for every visitor before they choose and after they decline. Before you choose, Google Analytics receives basic measurement requests without cookies, such as the page, the referring site, your browser type and the time. Our interest is understanding how people find our public pages, including from search engines, and which pages help them. These requests set no cookies and are not used for advertising, and we do not send account or form activity. You can object with “Don’t count my visits” or Global Privacy Control (see Counting visits to our pages).
• Legal obligation. Handling data protection complaints, answering lawful requests from authorities and, once paid answering opens, keeping financial records that tax law requires.
• Consent. Being contacted about research, being emailed news when paid questions open, and optional Google Analytics cookies on public information pages. You can change your analytics choice through Cookie settings.

We do not set out to collect sensitive information, such as health, religion or political views. Please do not include it in answers or questions; if you do, we use it only to deliver that answer or question.

Who we share data with

We do not sell your personal data and we do not use it for advertising.

We do not train AI models on your data, and we do not give it to anyone else to train theirs. No outside AI provider receives your data: the checks on answer wording, the screening of questions and the results summaries all run on software inside PennyForYours. If that ever changes, we will name the provider here first and say what it receives.

• Askers, including businesses and their AI agents, see answers and receipts under a per-asker pseudonym, never your name, email or contact details. A receipt shows the answer’s ID, the checks it passed and when it was given, and a fingerprint of the answer rather than its words. Askers may share receipts with others.
• Members picked to answer see the question and any image, or hear any sound clip with its description and transcript, but not who asked.
• Netlify, Inc. hosts the website and runs our server code, database and file storage. Netlify acts only on our instructions under its data processing agreement, which forms part of its customer terms. Netlify uses its own sub-processors, including Amazon Web Services, which runs the servers, and Neon, which runs the database software. Netlify publishes the full list in its trust centre.
• Migadu-Mail GmbH, a Swiss company, runs our mailbox (hello@pennyforyours.com) and sends our email. When you send a form, it carries a notification to our mailbox with what you wrote and the email you gave, and, for the help and support form and invite requests, a short note to you saying we have it. These notes never repeat what you wrote and are not marketing. Migadu acts only on our instructions. The UK recognises Switzerland as giving adequate protection for personal data.
• Google Analytics receives page views and selected interactions on public information pages, plus standard browser and device information: as requests without cookies for every visitor, and with analytics cookies only after you accept them. We do not send it account or form activity, and Google Ads is not connected.
• Google LLC and Apple Inc., only if you choose to continue with them (switched off for now): you sign in on their page and they send us your confirmed email address.
• The police, regulators or courts, only where the law requires it.

Identity checks, payments, payouts and AI moderation are not switched on yet: the service uses simple test software for each, and no outside provider receives your data for them. Before any of them starts, we will update this notice to name the provider and what it receives.

Where your data is stored

• Our database is in London (Amazon Web Services region eu-west-2), and our server code runs in London too.
• Uploaded images and sound clips are kept in Netlify’s file storage in the United States (Ohio). Netlify does not yet offer a UK location for this storage.
• Pages are delivered through Netlify’s worldwide network, so a request may pass through a server outside the UK on its way to you.
• Netlify and its sub-processors are US companies, and their staff may access data from the US to run and support the service.
• Google Analytics receives information about your use of public pages and may process it outside the UK. Google states that its UK-to-US transfers are covered by the UK Extension to the EU–US Data Privacy Framework, with standard contractual clauses where required. See Google’s data transfer explanation.

Where data goes to the US, it is protected by the UK’s data bridge with the US (the Data Protection (Adequacy) (United States of America) Regulations 2023). Netlify, Inc. takes part in the UK Extension to the EU–US Data Privacy Framework and is listed as active on the official Data Privacy Framework list. If that arrangement ever stops applying, Netlify’s data processing agreement switches to the UK’s International Data Transfer Addendum to the EU standard contractual clauses.

How long we keep data

The summary table gives the period for each kind of data. Some deletion is automatic and some is not built yet, and we want to be plain about which is which.

Deleted automatically by a job that runs every minute while the site is in use, and at least hourly when it is quiet:

• sign-in and sign-up requests, which may include the name and email you typed: a day after they expire;
• email sign-in codes: a day after they expire;
• passkey attempt records (which kind of prompt, whether it worked or the error shown, how long it was open, browser and operating system family, and your account if known): 90 days, so we can fix sign-in problems;
• sign-in sessions: 30 days after they expire or you sign out;
• request-limit counters: after a day without use;
• answering signals: 12 months after the answer, unless the answer is held for review or under appeal. We then keep only how long the question was on screen and whether paste was tried, because the answer’s receipt states these; the typing-rhythm summary, key counts, focus and tab changes and the hashed IP address and browser details are removed;
• reports, complaints, appeals and support requests: 2 years after the matter is closed, unless a report must be kept for a legal claim;
• the administrator log: after 2 years each entry is cut down to what happened and when. Who it concerned, record IDs, the reason and the hashed IP address are removed. The log cannot be edited or deleted in any other way;
• internal records of background jobs, which hold only record IDs: 30 days after the job finishes;
• invite requests: 12 months after you sent the request, or 12 months after we invite you or decide not to, whichever is later.

Not yet deleted automatically. We delete these by hand, or sooner when you ask:

• your account, passkeys, answers, questions, images, Standing and Marks: while your account is open. When you ask us to delete your account, we check it is you and run our deletion routine within 30 days. It removes your name, email, passkeys, sign-in sessions, contact choices, the words of your answers, your answering signals, Standing, badges and quality records, the wording of questions you asked and your images and sound clips (with their descriptions and transcripts), and closes the account.
• What the deletion routine keeps: the account’s ID with no name or contact details, so that our accounting entries and Marks, which can never be edited, still add up; which option or rating each answer chose, without the words, because it is part of other people’s results; answer receipts already given to askers, which never contained your name; the terms you accepted and when you confirmed you were 18 or over; any decision about the account and its reason; and reports, complaints and appeals without your email address, until the 2-year period above ends.

Once paid answering opens, we will keep payment and tax records for 6 years after the end of the tax year, as HMRC requires. We will add this before any money moves.

Your rights

You have the right to:

• get a copy of your personal data;
• have wrong or incomplete data corrected;
• have your data deleted;
• restrict how we use it while a concern is checked;
• object to uses based on legitimate interests. We will stop unless we have strong grounds to continue. Answering signals are a condition of answering, so if you object to them we may have to stop offering you questions;
• receive the data you gave us, in a common machine-readable format;
• withdraw consent at any time, without affecting what we did before;
• be told about decisions made by software, explain your side, have a person look at the decision and challenge it.

How to use your rights

Signed in, use Settings: “Get a copy of your data” and “Delete my account” open a support request for you. We answer a request for a copy with a machine-readable file (JSON) of everything we hold about your account. Signed in or not, you can use the Help and support form, or email us at hello@pennyforyours.com. If you have lost your passkey, use the form without signing in and we will check who you are before acting.

There is no charge. We will reply within one month of receiving your request, or of receiving anything we need to confirm who you are. If a request is complex we may extend this by up to two months, and we will tell you why within the first month.

Complaints

If you are unhappy with how we have handled your data, please complain to us first, in the same ways. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

Age limit

PennyForYours is for adults only. You must be 18 or over and live in the UK to ask or answer, and you confirm this when you join. Joining needs a personal invitation during early access. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data.

How we protect your data

• You sign in with a passkey that needs your fingerprint, face or device PIN. These never leave your device, and we never see the passkey’s private key.
• Session tokens, invitation codes and API keys are stored only as hashes. The sign-in cookie cannot be read by scripts and is sent only over secure connections.
• All traffic is encrypted in transit (HTTPS, enforced by HSTS). Forms are protected against cross-site requests. Google Analytics runs only on public information pages, and sets analytics cookies only after consent.
• Request limits slow down automated abuse.
• In our back office, only David Bryan, as administrator, can see personal data. He must confirm his passkey again before decisions, and every view and decision is logged.
• Netlify runs its security programme to SOC 2 Type II and ISO 27001 standards, and must tell us about a personal data breach within 48 hours. We will report breaches to the ICO within 72 hours where the law requires, and tell you if a breach puts you at high risk.

Counting visits to our pages

Separately from Google Analytics, we count arrivals at our public pages ourselves, as statistics to improve the site. Each page request adds one to a daily total. A total is kept only by UK day, page address (without anything after a ?) and a few fixed categories: the kind of source (a named search engine, an AI assistant such as ChatGPT or Perplexity, social media, email, another website, within our site, or unknown), the category of any campaign tag on the link, and whether the request came from a browser, a page loaded ahead of a click, or a bot.

• What we do not keep. No IP address, browser or device details, full address of the page you came from, other parts of the address, cookie or identifier. We do not fingerprint devices or link visits together. The request is read in memory at our host’s network edge only to choose the categories. The totals count page arrivals, not people, and do not identify anyone.
• No cookies. The counting sets no cookies and runs no script in your browser. It works on cached pages and when scripts are blocked.
• Why, and the law. Our legitimate interest is knowing which pages help people and how they find us, including from search engines and AI assistants. UK law allows this kind of statistics without consent since 5 February 2026 (the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025), provided it only improves the site, is explained clearly and can be refused easily and for free.
• How to object. Turn on Don’t count my visits in the cookie policy. It stores one cookie, pfy_no_count, that records your objection; from then on we do not count your requests and Google Analytics does not load at all. A browser that sends Global Privacy Control gets the same result with no cookie. Our counter also skips requests that send Do Not Track.
• Where and how long. The current day’s totals are held in Netlify’s file storage in the United States (Ohio), then moved into our London database, where they are deleted automatically after 25 months.

Cookies and storage on your device

Signing in sets one cookie, __Host-pfy_session, which keeps you signed in. When you choose whether to ask, answer or both, the app stores that choice in a second cookie, pfy_mode. Some pages also keep small notes in your browser’s storage. On public information pages, Google Analytics runs for every visitor. Until you choose, and if you decline, it sets no cookies and receives basic measurement requests without cookies, such as the page, the referring site, your browser type and the time. If you accept, it also sets analytics cookies. Either way it records page views, scrolling, outbound link clicks, video engagement and file downloads. Site search and form interaction measurement are off. The cookie policy lists the items, explains their purpose and lets you change your choice.

You can decline or withdraw analytics cookies immediately. This sets Google Analytics back to requests without cookies and removes analytics cookies we can access in that browser. Withdrawing also creates a private deletion request using the existing Google visit identifier if available. Failed deliveries retry on later visits; the status message distinguishes waiting from received. David submits identifiable requests to Google, which can take up to 63 days after submission to permanently process them. We remove the raw identifier up to 70 days after acknowledged Google submission, or immediately on final resolution. We retain the minimal request receipt and dates for two years after resolution. Unprocessed requests stay open for review; a missing identifier can prevent matching earlier visits. You can also contact us through the support form at any time. We will assess whether we can identify the visits and request deletion from Google where possible; aggregate reports may no longer identify individual visits.

Changes to this notice

We will update this notice when the service changes, for example before paid answering, identity checks or open sign-up start. If a change affects how we use your data, we will tell you before it applies. The date and version at the top show the latest text.

• Version 1.11, 7 October 2026: our own cookie-free count of page arrivals (daily totals only, kept 25 months) and “Don’t count my visits”, which also stops Google Analytics loading; Global Privacy Control is honoured the same way.
• Version 1.10, 7 October 2026: Google Analytics runs on public information pages for every visitor, with basic measurement requests without cookies (legitimate interests) until you accept analytics cookies (consent), and how to decline, withdraw or object.
• Version 1.9, 7 October 2026: optional Google Analytics on public information pages, the data it receives and how to decline or withdraw consent.
• Version 1.8, 7 October 2026: we keep a short record of each passkey attempt for 90 days to find and fix sign-in problems.
• Version 1.7, 7 October 2026: questions with sound clips are open. What we keep with each clip and how it is handled are unchanged from version 1.6.
• Version 1.6, 7 October 2026: sound clips on questions (not open yet): what we keep with each clip, that hidden tags are removed, that a person listens before members hear it, the listening signals on the answer page, and that clips are stored and deleted exactly as images are.
• Version 1.5, 6 October 2026: one sign-in page for everyone. Email codes (what we keep and for how long), Continue with Google or Apple (switched off for now), the waiting list, and the advisory signs kept when an account is created.
• Version 1.4, 6 October 2026: email is switched on. Our mailbox and outgoing email are run by Migadu (Switzerland); each form emails us a copy, and the help and support form and invite requests send you a short note that we have your message.
• Version 1.3, 6 October 2026: invite requests from the request early access and apply to answer forms: what we keep, why, and that they are deleted automatically after 12 months.
• Version 1.2, 5 October 2026: the checks on the join form (the hidden field, how long the form was open and signs of automation); topic preferences on the question board; we do not train AI models on your data.
• Version 1.1, 5 October 2026: answering signals, closed cases, background-job records and the administrator log are now deleted or cut down automatically; browser details are hashed with the same daily secret key as IP addresses; what our account deletion routine removes and keeps; copies of your data are given as a JSON file.
• Version 1.0, 5 October 2026: full rewrite; summary table; storage locations confirmed; automatic and manual deletion separated.
• Drafts, 4 October 2026: first published text, marked as a draft.