Privacy at Honne
UPDATED · October 23, 2026
Jump to…
TL;DR
We store what you give us (email, workspace, studies). We store what your participants give you (their responses). We don't sell it. We don't share it with advertisers. You can export or delete it anytime.
What we collect and why
When you sign up, we store your email and workspace name. That's the minimum we need to give you an account you can log back into.
When participants complete your studies, we store their responses, any free-text answers, and session recordings if you enabled them. These live in your workspace. You own them.
We also log standard server metadata — IP address, user agent, request timestamp — for 30 days, to detect abuse and debug outages.
Who sees it
Your workspace data is visible to you and whoever you invite. Nobody else on your team sees a study until you share it with them.
A small group of Honne engineers can access production systems when something breaks. Access is logged and requires two-person approval for anything touching participant responses.
We don't sell your data. We don't hand it to advertisers. We don't use it to train models for other customers.
How long we keep it
Studies and responses stay in your workspace until you delete them or close your account. After account closure, we keep data for 30 days in case you change your mind, then it's permanently removed from primary storage.
Encrypted backups may retain deleted data for up to 90 additional days before rolling off.
Your rights
You can see, export, correct, or delete any data we hold about you. Most of that is one click inside your workspace settings. If you need something we don't expose in the UI, email us and a human will handle it.
If you're in the EU, UK, California, or another jurisdiction with specific data-subject rights, those rights apply to you here.
Participants vs. researchers
Two different relationships exist on Honne, and they work differently.
If you're a researcher— the person running a study — we're your data processor. Your responses and participants live in your workspace; we help you store and analyze them.
If you're a participant— someone answering a study — the researcher who invited you is the data controller for your responses. Honne is their infrastructure. If you want to access or delete your responses, contact the researcher first; we'll help them fulfill the request.
Third parties we use
We use a small set of infrastructure providers to run the service:
- Supabase — our database, file storage and auth layer
- Railway — hosting for the web app
- Stripe — billing (only if you're on a paid plan)
- Resend — sending account and notification emails
- AI model providers (OpenAI, and Google through OpenRouter), reached through our model gateway — to moderate sessions, extract insights, and generate reports and personas from your study content
Each processes data only to provide its part of the service.
Connected AI assistants
You can connect an AI assistant such as Claude to your Honne account. When you do, it reads and changes your workspace only when you ask it to, with exactly your own permissions, and only in workspaces you belong to. Honne sends it just what each request needs.
What you share with the assistant is handled by its provider under that provider's privacy policy (for Claude, Anthropic's). You can disconnect an assistant at any time under Settings, Profile, Connected apps, and its access stops immediately.
Security practices
Data is encrypted in transit (TLS 1.2+) and at rest. Row-level security isolates every workspace in the database. We rotate secrets regularly and require two-factor auth for all staff accounts.
If we discover a security incident that affects you, we'll notify you within 72 hours with what we know and what we're doing about it.
Children's privacy
Honne isn't for anyone under 16. We don't knowingly collect data from children. If you believe a child has submitted data through a study on Honne, contact us and we'll delete it.
Contact
Privacy questions go to [email protected]. A real person reads that inbox and will reply within two business days.
For formal data-subject requests, include your account email and the workspace name so we can locate your data quickly.